JPMorganChase's Lethal Trifecta: A Risk Classification Tool for Agentic AI Security

See also (wiki): wiki/agentic-ai-governance.md · wiki/ai-cybersecurity.md · wiki/assistive-to-agentic-shift.md · wiki/agent-identity-permissions.md

Source credibility: HIGH. TIER 1.

Practitioner account from a Tier 1 financial institution operating at global scale with live agentic deployments. JPMorganChase Technology Blog, “Securing the Next Generation of AI Agents,” published March 23, 2026. No quantitative data provided; treat as authoritative qualitative framework from a credible operator. Original trifecta concept attributed to Simon Willison (independent security researcher); JPMC operationalized and published it as enterprise guidance.

Executive Summary

• JPMorganChase published a three-factor risk classification framework for agentic AI security in March 2026, drawn from its own production deployments. The “Lethal Trifecta” identifies the specific combination of agent capabilities that creates acute data exfiltration risk.
• An agent that simultaneously processes untrusted inputs, has read access to sensitive organizational data, and can trigger external actions is in the highest-risk zone. A compromised instruction in any untrusted input — an email, a web page, a document — can direct the agent to exfiltrate sensitive data without any user action or awareness.
• This is not a theoretical scenario. JPMC’s framing acknowledges real-world 2025 incidents where prompt injections caused agents to leak API keys and internal documents. The threat model is live and production-relevant.
• The security threat has shifted from the model to the runtime context. Traditional software security focused on code and data at rest. Agentic AI shifts the attack surface to the context window — what the model is given at runtime, not what the model weights contain.
• JPMC’s core governance insight: security cannot stop at deployment. The threat is runtime, so governance must be runtime — continuous monitoring, not periodic audits; evidence production as a first-class output, not an afterthought.

The Lethal Trifecta: Three Factors, One Classification

An agent is in the Lethal Trifecta zone if it combines all three of the following:

Factor 1 — Processes untrusted inputs The agent reads content from external or untrusted sources: emails, web pages, documents, API responses, user inputs from unknown parties. Any content the agent ingests that was not authored by a trusted internal source counts.

Factor 2 — Has access to sensitive data The agent can read private organizational data: emails, files, databases, customer records, internal systems. Read access to a CRM, an internal document store, or an employee directory all qualify.

Factor 3 — Has authority to act externally The agent can write, transmit, or trigger actions outside the organization: send emails, call external APIs, post content, execute transactions, write to external systems.

When all three are present: An attacker who can inject a malicious instruction into any untrusted input can direct the agent to locate sensitive data and transmit it externally — without the user knowing. The attack requires no code execution, no network penetration, and no credential theft. It requires only that an untrusted input reaches the agent’s context window.

Why Agentic AI Expands the Attack Surface

Traditional software security focused on two surfaces: code (can an attacker execute unauthorized code?) and data at rest (can an attacker read or modify stored data?). Both are well-understood with established defenses.

Agentic AI introduces three new surfaces:

Orchestration layer vulnerabilities: Tool sequencing and external integrations create injection points that did not exist in static software. Each tool call is a potential trust boundary — the agent does not inherently distinguish between a tool invoked legitimately and one invoked via a compromised instruction.

Delegated authority propagation: A compromised sub-agent can propagate risk across an entire multi-agent environment via its delegated authority. The orchestrator’s authorization scope becomes the attack blast radius.

Input-driven behavior manipulation: Attackers target inputs to influence agent behavior, not model parameters. The model itself is unchanged — the attack lives in the runtime context. This is why standard model security assessments (red-teaming model weights and training) are necessary but insufficient for agentic deployments.

JPMC’s Recommended Controls

Authorization Boundaries

• Explicit, documented scope for what each agent is permitted to do
• Permissions are inherited, not acquired — agents cannot elevate their own privilege through task execution
• Machine-to-machine authentication for all agent-to-agent and agent-to-system interactions

Interaction Constraints

• Sandboxed environments during development and testing
• Explicit allowlists for which external services an agent can reach
• Differential safeguards for high-risk operations: irreversible actions, financial transactions, and data-exfiltrating operations require additional checkpoints beyond standard execution

Audit Records

• Tamper-evident, complete runtime records of every action taken across automated workflows
• Action traceability — every action in an agent’s execution chain must be attributable to an authorization source
• Agent behavior deviation detection — alerts when an agent departs from expected action patterns

Runtime Governance

JPMC’s most practically significant insight: security review at deployment time is necessary but insufficient. The threat is runtime — it arrives via content the agent encounters after deployment. Runtime governance requires:

• Continuous monitoring, not periodic audits
• Evidence production as a first-class output: every agent run produces an auditable trail automatically
• Reference architectures for agent-to-system and agent-to-agent authorization management

Key Data Points

Applying the Trifecta: Audit Protocol

For every planned agent deployment, audit against the three factors:

1. Does the agent process any untrusted input (user content, web results, external documents, API responses from third parties)?
2. Does the agent have read access to sensitive organizational data (CRM, internal files, employee records, financial data)?
3. Can the agent write, transmit, or trigger external actions (send email, call external APIs, post to external systems, execute transactions)?

All three present: Lethal Trifecta zone. Required controls: explicit authorization boundaries (documented, auditable), runtime logging (not deployment-time review only), human checkpoints before high-stakes external actions, adversarial testing (prompt injection attempts) before production.

Two factors present: Lower risk, but document which two and apply the relevant controls for those factors.

One factor present: Standard AI governance applies; no Trifecta-specific controls required.

Relationship to Singapore MGF

The Singapore Model AI Governance Framework for Agentic AI (published January 2026) and JPMC’s Lethal Trifecta are complementary, not redundant:

Use Singapore MGF to design the governance program. Use JPMC’s trifecta to identify which specific agents within that program require the highest security scrutiny.

What This Means for Your Organization

Most enterprise AI security programs in 2026 are still applying a model-review paradigm: assess the model, test the model, approve the model. The JPMC framework identifies why that paradigm is insufficient for agentic deployments. The risk is not in the model — it is in what the model is given at runtime by people and systems the organization does not control.

The practical implication: every agent with external data ingestion, internal data access, and external action authority needs a runtime monitoring program, not just a pre-deployment security review. In financial services, this is analogous to the distinction between approving a trading system and monitoring its live behavior — both are required, and the latter is ongoing.

The Lethal Trifecta classification is immediately usable as an audit instrument. A CIO or CISO can apply the three-factor test to the current agent deployment portfolio in a single afternoon and identify which deployments require remediation. In most enterprises, the catalog of agents in the Trifecta zone is longer than security teams expect — because agents were provisioned for convenience rather than least-privilege.

For organizations beginning or scaling agentic AI programs in regulated industries, getting the security architecture right before deployment is substantially less expensive than remediating it after an incident. I’d welcome the conversation — brandon@brandonsneider.com.

Sources

• JPMorganChase Technology Blog — “Securing the Next Generation of AI Agents” (March 23, 2026): https://www.jpmorganchase.com/about/technology/blog/securing-agentic-ai
• HiddenLayer research on Lethal Trifecta: https://www.hiddenlayer.com/research/the-lethal-trifecta-and-how-to-defend-against-it
• Original concept attribution: Simon Willison (independent engineer, original public framing)
• Singapore IMDA MGF for Agentic AI (January 2026): https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf

Brandon Sneider | brandon@brandonsneider.com May 2026