# Lethal trifecta test (10 minutes) (cheat sheet)

> Three questions to ask about every agent, and how to break one leg.

Source: https://conversationalaidesign.com/cheatsheets/lethal-trifecta-test.html. Author: Nelson Abacherli Kawakami. Reviewed November 3, 2026.

## Ask three questions
| Leg | Question | Support examples |
|---|---|---|
| Private data | What sensitive data can this agent reach? | Customer records, order history, internal notes, credentials |
| Untrusted content | What text can an outsider put in front of it? | Tickets, forms, emails, chat messages, attachments, web pages |
| Outbound path | How can anything leave? | Replies, emails, API calls, notes, links or images that load from a URL |

## Decide
- All three present: **redesign** before launch
- Two present: add controls and test the third
- One present: normal controls

## Break one leg
- **Remove the outbound path** for this task, or limit replies to the verified requester with links and images stripped
- **Remove access to private data** for the step that reads untrusted text
- **Keep untrusted text away** from the tool-using agent: a reader agent summarizes it into a short structure
- **Require human approval** for any send or write

## Not enough on its own
- A prompt that says to ignore hidden instructions
- A detection product that catches most attacks: a data leak needs only one that gets through
- Trusting that the model will notice

## Keep evidence
- Record the three answers in the design spec
- Log tool calls
- Add injection cases to the evaluation set and re-run them on every change

Related modules: Safety, security and ethics (https://conversationalaidesign.com/modules/18-safety.html), Tools, function calling and MCP (https://conversationalaidesign.com/modules/08-tools-and-mcp.html)