Lethal trifecta → Rule of Two

Willison to Meta, including the autonomy-depth gap the rule does not cover.

◆ Rule of Two configurator

You know the model will be fooled and that the fix is architectural. Which architecture? This module gives you the cheapest useful answer in the field: a rule you can apply in a design review, before any code exists, using nothing but a list of what the agent can touch.

The lethal trifecta

In June 2025 Simon Willison named a pattern practitioners had been circling for a year. OWASP adopts it directly in LLM01 prevention guidance, as a pre-deployment check:

An agent that can simultaneously access private data, ingest untrusted content, and communicate externally has the conditions for high-impact exploitation, and removing any one leg removes them.

OWASP LLM01:2026, citing Willison (2025)

Its power comes from needing no knowledge of the attack. You do not imagine the payload, guess the phrasing, or predict which model version breaks. You enumerate three capabilities and count.

Untrusted content is how the attacker gets instructions in front of the model. Private data is what those instructions target. External communication is how the answer gets out. Cut any leg and the chain has a gap.

Remove	What the attacker loses
Untrusted content	The entry point. No mechanism to deliver instructions at all. The strongest cut, and the one people forget is available.
Private data	The prize. They can still hijack behaviour, but there is nothing worth stealing.
External communication	The exit. They can read anything, and cannot get it out of the building.

Meta's Rule of Two

Late in 2025 Meta turned the same diagnosis into a design rule with a prescription attached, and OWASP folded it into the standard as LLM01 mitigation #8. The labels matter, so do not paraphrase them:

	Property
A	Processes untrustworthy input. Anything an attacker could have authored.
B	Accesses sensitive systems or private data. Anything worth stealing.
C	Changes state or communicates externally. Anything that leaves a mark or leaves the building.

An agent session should satisfy at most two of these.

OWASP attaches requirements rather than leaving it as advice. An [A,B,C] agent needs per-action human approval. [A,B] or [A,C] configurations need an explicit residual-risk assessment, because being inside the rule is not the same as being finished.

Rule of Two configurator

Which properties does the agent session have?

Autonomy depth

Step, recursion and cost limits, no per-action approval.

3/3All three, high risk

OWASP: an [A,B,C] agent needs per-action human approval. This configuration is outside the Rule of Two.

This is the EchoLeak shape: untrusted email in, organisational data reachable, an outbound channel available. Zero user interaction required.

Autonomy caveatYou have all three properties and no per-action approval. This is precisely the configuration OWASP prescribes against.

Properties and required mitigations follow OWASP LLM01:2026 mitigation #8, which adopts Meta's Agents Rule of Two and calls it a floor, not a certification.

Two things people get wrong

It is not “any two of three.” OWASP names [A,B] and [A,C]. It omits [B,C], and the omission is deliberate. Both named pairs include A. Without untrustworthy input there is no injection vector at all, so [B,C] carries a genuinely different risk profile. Any tool or checklist that treats the three properties as interchangeable tokens is teaching the rule wrong.

It is a floor. That is OWASP's word. Passing means you cleared the minimum bar, not that you finished the threat model.

Partial control· necessary, not sufficient

OWASP describes the Rule of Two as “a floor” and flags, in the same sentence, that it is silent on autonomy depth. A two-property agent looping unattended a thousand times is still a two-property agent by the rule, and can still do unbounded damage. Pair it with the step, recursion and cost limits in module 1.7.

OWASP raises that caveat itself, citing Noma Security. Guidance that admits its own gaps is more trustworthy than guidance that does not.

Why this rule carries unusual weight

Plenty of security heuristics circulate without ever being ratified. This one was picked up fast and broadly. OWASP notes that both NIST AI 100-2e2025 and joint operational-technology guidance from CISA, the FBI, the NSA and the ACSC endorse it.

When a rule appears in Five Eyes guidance it stops being a design preference and becomes a procurement expectation, which makes it a rule you can use in an argument with someone who does not report to you.

Deep diveApplying the rule when the agent has phases4 min›

The rule is stated over an agent session. So what if the agent needs all three properties across a workflow, just not simultaneously?

Good instinct, and the basis of several real architectural patterns. If a research phase reads untrusted web content and a later phase writes to the database, those are two sessions with different property sets, [A] then [B,C], rather than one [A,B,C] session. Provided the boundary between them is real.

“Real” is the load-bearing word. The phases must not share a context window, and the untrusted phase must hand forward structured, validated data rather than free text. If phase one summarises a poisoned web page into a paragraph and phase two reads that paragraph, nothing was split. The injection moved into a different turn and gained a trusted-looking provenance. Module 5.4 covers the patterns that do this correctly (Plan-Then-Execute, Dual LLM, CaMeL) and the ways each can be undone.

A useful test: can the untrusted phase influence which action the trusted phase takes, or only the data inside a pre-committed action? If the former, the phases are not separated.

Check yourself

Self-check

1. An internal analytics agent reads the data warehouse and posts
   summaries to a Slack channel. It never touches external content.
   Which properties does it have, and is it inside the rule?

2. A support assistant reads customer tickets (written by customers)
   and can look up account records. It has no send capability and its
   UI renders Markdown. Count the properties honestly.

3. Why does OWASP name [A,B] and [A,C] but not [B,C]?

4. The agent has two properties and runs unattended in a loop with no
   step limit. Does it pass the Rule of Two, and is it safe?

Answers

1. B and C: sensitive data plus external communication. Two properties, inside the rule, and notably the [B,C] pair with no untrusted-input leg, so there is no injection vector. Ordinary appsec risk remains. Prompt injection has no entry point.

2. All three. Tickets are attacker-authored, so A. Account records are B. The Markdown renderer is C, an outbound channel that appears nowhere in the tool list. Extremely common in production.

3. Both named pairs contain A, and A is the entry point. Without untrustworthy input there is nothing to inject through, so [B,C] is a materially different risk profile rather than “also two.”

4. Yes and no respectively, which is the point of the caveat. It passes, because the rule counts properties and it has two. It is not safe, because the rule is explicitly silent on autonomy depth. Passing a floor tells you that you cleared the floor.

Sources

T1OWASP Top 10 for LLM Applications 2026 · LLM01:2026 prevention #8 (Rule of Two as 'a floor'; the [A,B,C] and [A,B]/[A,C] requirements; the autonomy-depth caveat via Noma Security) and the prevention preamble (Willison's trifecta)
T1Willison, S. (2025, June 16) · The lethal trifecta for AI agents: private data, untrusted content, and external communication
T1Meta AI (2025, October 31) · Agents rule of two: a practical approach to AI agent security
T2Noma Security (2025) · Why the Rule of Two can't protect your agents (the autonomy-depth gap, as cited by OWASP)
T1Endorsement by NIST AI 100-2e2025 and joint CISA/FBI/NSA/ACSC OT guidance is as reported by OWASP LLM01:2026 mitigation #8