AG-TRIFECTA: Information-Flow Exfiltration Path (Lethal Trifecta)
What this rule means
The agent has a provable exfiltration path: an untrusted input source can steer an egress tool (control influence), while internal/sensitive data flows into that same tool's payload (data path). This is the 'lethal trifecta' — attacker control × secret data × egress = exfiltration.
The finding includes a proof-witness: the exact control-flow and data-flow chains are shown, plus the minimal set of tool restrictions that would provably break every exfiltration path.
Why it matters
This is the exact pattern behind every major AI agent data breach:
- EchoLeak (CVE-2025-32711): zero-click Copilot exfil via injected email
- GitHub-MCP toxic-agent: poisoned tool description → secret exfil
- Supabase/Cursor: MCP token passthrough → credential leak
The SEP benchmark proves LLMs cannot reliably separate instructions from data, so classifiers alone cannot stop this. The only provable fix is deterministic IFC enforcement at the tool boundary (CaMeL/Fides pattern).
How to fix it
Minimal fix: restrict the tools named in the min-cut (shown in the finding).
Architectural fix (provably secure — CaMeL/Fides pattern):
- Tag all tool return values as UNTRUSTED (they may carry injected instructions).
- Tag data from files/DB/secrets as INTERNAL or SECRET.
- At every egress call: if the payload carries INTERNAL+ data AND the call
was triggered by UNTRUSTED input, BLOCK it — regardless of model intent.
- Maintain an explicit allowlist of declassified egress calls (e.g.
'user explicitly clicked Send' overrides the block).
Short-term: add a human-approval gate on every egress tool call.
Detect it
pip install lucin
lucin scan . # all rules
lucin explain AG-TRIFECTA # this rule, in your terminalFindings carry a file:line and, where the rule supports it, a witness
path showing the flow that triggered it. Precision and recall for the whole rule set,
with the commands that regenerate them, are on the
benchmarks page — and the gaps are on
limits.