How Tailscale and Aperture mitigate the lethal trifecta for AI agentsJoin us in San Francisco for TailscaleUp!Grab your ticket ->

Blog|insightsAugust 06, 2026<br>How Tailscale mitigates the lethal trifecta

Safely using AI agents can seem like a daunting, if not impossible, task. The qualities that make them so useful—access to data, the ability to take action, and the flexibility afforded by non-deterministic output—also make them dangerous. But it’s not impossible, with the right tools and a little bit of setup, to run agents and keep some peace of mind.<br>How do we define a safe(r) AI system?<br>The lethal trifecta describes three characteristics of an agentic system that, when combined, leave the system open to exploitation by an attacker. They are:<br>Access to private data<br>Exposure to untrusted content<br>Ability to communicate externally<br>Using this framework, it’s not too difficult to see there are some major, intrinsic problems.<br>First of all, untrusted content is everywhere, from emails to web searches to support tickets to GitHub pull requests. It’s effectively impossible to avoid when doing useful AI work against your data. By their very nature, LLMs (large language models) cannot entirely ignore malicious instructions in untrusted input.<br>Second, LLMs are most useful when we give them access to rich personal data. What makes this such a fiendish problem is that, in their most common use as a kind of next-generation search engine, LLMs also need to communicate externally.<br>It’s not just that all three parts of the trifecta are dangerous when tied together. It’s that desire to make the most of your LLM in an agent. To make an agent useful, you often want exactly the kind of interplay that makes it all so dangerous.<br>Common “solutions” to the lethal trifecta<br>If combining all three elements is dangerous, how do teams deploy useful AI systems today? It’s typically in one of three ways:<br>They don’t : It’s unfortunately too common to go full YOLO (you only live once) mode with your favorite harness and pay the price: deleted data, exposed personal data, new vulnerabilities, and more.<br>They make the system no longer useful : Possibly just as common as YOLO mode is a system so locked down, and locked out of useful information, as to be no better than basic chat.<br>They drown in permission prompts : Approve this tool call. Approve that Bash command. Approve another file write. Yes, the agent is doing work, but as soon as approval fatigue sets in, it’s yes-yes-yes, and not much better than YOLO’ing it.<br>Why is it so hard to address the trifecta?<br>Beyond the inherent relationship between usefulness and danger, it’s quite difficult to meaningfully adjust permissions afforded to an agent for each individual task. If we assume untrusted input is unavoidable, for now, it means choosing between giving our agent the ability to communicate externally, or giving it private data.<br>Agent harnesses let you enable or disable tools that access data, but those controls are coarse. A broad permission like “terminal access” can let an agent work around narrower restrictions. Training and guardrails can make this kind of escalation less likely, but cannot reliably prevent it. Model behavior is nondeterministic, and no safeguards can reliably stop escalations entirely.<br>Using an AI gateway to mitigate the lethal trifecta<br>Using Aperture’s combined LLM and MCP (model context protocol) gateway, along with Tailscale’s identity-based mesh network, it’s possible to mitigate the issues with harnesses and model-based controls. And it can do all of this without sacrificing the user experience or annoying users to the point of giving up or going around.<br>The first step many people have taken is putting the agent in a sandbox, or contained development environment. Local or remote, the sandboxes end up with the same problem. It’s great to start off away from the user’s primary machine, but real-world utility makes agents want access to data and external communication abilities. Now they’re a clone of the user’s primary machine again.<br>Aperture’s gateway helps prevent this unintentional cloning process. Aperture can decouple the agent’s access to both the data and the LLM, and mark and control the connectivity of the sandbox environment running those agentic systems. Here’s how it works.<br>Configuring the Aperture Gateway<br>Mitigating the lethal trifecta involves two features of the Aperture Gateway, as well as device postures from Tailscale ACLs.<br>First, you’ll need to configure all of the MCP and API endpoints that you’d like your agent to be able to access as connectors in Aperture. After configuring each connector, you apply a label to each one, indicating whether it contains sensitive data. In our case we use hasCustomerData and noCustomerData as the label names.<br>Once configured, if you’re using OAuth for MCP authentication (the typical choice), users will need to authenticate to each endpoint as themselves. The good news is that once they’re authenticated in...