ContextArticle

Regular Claude chat is vulnerable to lethal trifecta attacks because it combines access to private data, exposure to untrusted content, and a mechanism for exfiltrating data.

Simon Willison explains that Claude chat is at risk because it has memories of past interactions (private data) plus a tool that can both read hostile instructions and exfiltrate data via URLs. ✦ AI generated

Simon Willison · Simon Willison's Weblog · 2026-07-15 · original ↗

Share card ↓Export .md Export .txt

regular Claude chat is at risk of lethal trifecta attacks, because it has access to private data (in the form of memories of your past interactions) and has a tool for accessing online content which can both read hostile instructions and exfiltrate data through the URLs it accesses.

Read full article ↗excerpt · fair-use quotation

✳ Claude ✳ lethal trifecta

Related moments

Claim◆Article · 48 words

The most serious risk in a multi-tenant system is a data leak, where one customer is shown another's data, and together with faulty deployments that can impact every tenant at once, these situations must be actively handled by the system.

the author · ByteByteGo Newsletter

Fact◆Video · 50:39 · 2m

Grok build CLI was silently uploading entire private Git repositories (including unredacted secrets) to a Google Cloud bucket, transferring far more data than the coding task required.

Scott Tolinski · Syntax

Fact◆Video · 74:25 · 2m

The Claude Code CLI covertly alters the format of its system prompt (using slashes instead of dashes, and a different apostrophe unicode character) when it detects the user is in Chinese time zones like Shanghai or northwestern China, effectively fingerprinting Chinese users to Anthropic's backend, likely to help detect distillation attempts by Chinese AI labs.

CJ Reynolds · Syntax