Figure 17.2 The lethal trifecta. Each capability on the left is individually useful, and each is often individually fine. An agent holding all three can be turned into a data thief by anyone who can write to its inputs: the attacker plants an instruction through the untrusted-content leg, the instruction gathers secrets through the private-data leg, and the loot leaves through the outbound leg. The audit is fast, and so is the remedy: removing any single leg defeats the theft.
