Toxic flow
Also called: toxic agent flow, lethal trifecta
A combination of capabilities in one agent session — access to private data, exposure to untrusted content, and a way to communicate outward — that together enable data theft even when each part is benign alone.
The framing shifts attention from individual bugs to dangerous compositions. If an agent can (1) read something sensitive, (2) be steered by attacker-controlled text, and (3) send data somewhere the attacker sees, then an indirect prompt injection in step 2 can walk the private data from step 1 out through step 3. No single tool is vulnerable; the flow is.
Why it matters
It gives defenders something concrete to look for: enumerate what a session can read, what untrusted input it touches, and what its outbound channels are. Break any leg of the trifecta — scope down the data, sanitize or isolate the untrusted input, or remove the exfiltration path — and the flow stops being toxic.
Real-world context
Invariant Labs (Snyk) coined "toxic flow" / "toxic agent flow" in 2025, and on 26 May 2025 used it to describe a GitHub MCP exploit that walked data out of private repositories via a poisoned public issue. Simon Willison's "lethal trifecta" (16 Jun 2025) names the same three-part condition.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.