TinkerStep 18 of 18 · Model → Host appThank you. The delivery address on the invoice, 14 Mill Lane, Ashford, matches the one we have on file for you. Larkspur Supply Co.all three legs in place · 1 sent by send_email
Chapter 4 of 7
The lethal trifecta
The allow-list and the output filter each stopped one way out. Each check catches the leaks it was written for. Larkspur wants a rule that doesn’t depend on spotting the attack at all.
This chapter: What does an attack need to steal data, and which piece can Larkspur take away without stopping the job?
You will learn
- The three legs of the lethal trifecta: private data, untrusted text, a way out
- What removing each leg costs the customer
- How a taint rule removes the way out only once untrusted text is in
Words you’ll meet (3)
- Lethal trifecta
- Simon Willison's lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate externally. Together they let an attacker steal data.
- Leg
- One of the trifecta’s three parts. Here each is a tool or an input: get_customer, the email, send_email.
- Taint rule
- A host rule: once the model has read untrusted text, stop offering tools that send data out, for the rest of the case.
The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.
Step 1 of 4
With no checks, the forwarded invoice ends the same way every time: a customer's private record sent to an outside address. Why does it work at all? Simon Willison's lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate externally. Together they let an attacker steal data. The stage names the three legs. Larkspur’s assistant has every one: it reads email someone outside wrote, looks up customer records, and can send email anywhere. Before you try:
Private data: get_customer. Removed: get_customer is no longer offered.
Untrusted text: read_inbox. Removed: every email is quarantined before the model reads it.
The way out: send_email. Removed: send_email is no longer offered.