Almost every production AI agent today has Simon Willison's "lethal trifecta": access to private data, exposure to untrusted content, and a channel to communicate externally. Naming the trifecta is step one. It does not tell you which of your fifty agents to fix first, and most agentic-AI security talks stop exactly there — necessary framing, not a triage method.

This talk applies a reachability-first lens, the same discipline that turns an unusable pile of SAST and dependency-CVE findings into an actual priority list, to agentic AI. The trifecta tells you an agent is structurally vulnerable. Reachability tells you whether the vulnerable path is actually exposed to an attacker today: which tools an agent can reach, which of those tools touch untrusted content, and how far a compromised step can travel before something stops it.

The method has been independently pressure-tested across technical review sessions with senior security practitioners at multiple organizations, surfacing real gaps: MCP-specific tool poisoning, rug-pull updates that change a trusted tool's behavior after the fact, memory and context poisoning across sessions, and tool shadowing that impersonates a legitimate integration.

You leave with a way to rank your own agents by actual exploitability instead of trifecta-presence alone, and a short list of the MCP-specific attack patterns most threat models still miss.

Format: Talk, 20-25 minutes, Intermediate level.
Audience: AppSec, product security, and AI/ML security practitioners
building or securing agentic systems and MCP integrations.
No special AV or technical requirements.