The Lethal Trifecta Is Already on Your Laptops — Michael Patterson, Coder｜AI Engineer

Coder's Michael Patterson argues enterprises adopting agentic AI face prompt injection and context poisoning risks, and should contain them with cloud development environments, model proxies, and CISO-approved guardrails.

The most important claim in this talk is that the "lethal trifecta" of agentic AI — an agent with access to private data, the ability to communicate outbound to the internet, and the ability to ingest untrusted content — is not a hypothetical future risk but a condition already present on ordinary developer laptops running tools like Claude Code, Codex, and OpenClaw. Michael Patterson, a staff solutions engineer at Coder, argues that any two of those three properties is unacceptable in a secure enterprise, and that all three together make a security incident a matter of "when," not "if." The talk is mostly a practitioner's guide to enterprise agent security architecture, not a deep technical dissection of the trifecta concept itself; the term, coined by Simon Willison, is introduced and explained in a few minutes, and the bulk of the session covers the organizational blockers to agent adoption and the three architectural controls Coder recommends.

Patterson's framing is that 2025 was "the year of the AI agent," with new agentic tooling from Microsoft, Salesforce, and AWS, and Claude Code changing the game when it launched in March 2025. He uses a cautionary anecdote a developer whose agentic coding workflow reportedly deleted a production database within a day or two of a triumphant post how much code the agent was shipping. The reader should walk away with three concrete controls — cloud development environments, a model proxy, and an agent firewall — plus a clear picture of the competing concerns of CISOs, platform teams, and developers that any enterprise rollout must satisfy.

The lethal trifecta is three properties that are individually tolerable and jointly fatal

Patterson attributes the term to Simon Willison and defines it as three threat layers on the attack surface. First, the agent sits on a machine with access to private data: personal information, local files, credentials, company IP, databases. Second, that agent can communicate outbound to the internet, meaning it can exfiltrate what it can read. Third, it can download content from the internet, meaning it can ingest malicious instructions. Patterson's rule of thumb: one of the three is not a big problem, two out of three is "completely unacceptable in any kind of secure enterprise environment," and having all three means a security incident is inevitable rather than conditional.

He names three attack patterns that exploit this surface:

The common thread is that agents are typically granted broad access because "it needs access to do the work," which violates the least-privilege principle and turns any successful injection into an escalation.

The three architectural controls: CDEs, a model proxy, and an agent firewall

Patterson's prescription is a three-pillar "trifecta of agent security," and he is explicit that it is not novel — it is sound security practice applied to agents, which teams mistakenly exempt because AI is powerful. The pillars are: control data access by moving the agent off the laptop into an isolated virtual environment; restrict external communication so the agent can only reach approved domains, sitting behind a VPN, VPC, and firewall with alerting when it breaches the perimeter; and lock down content, , and access with tightly scoped credentials and permissions.

The concrete implementation is three components:

Cloud development environments (CDEs). Instead of running the agent on a laptop, the developer or agent connects via URL, RDP, or SSH into a remote environment blessed by security and platform teams. The agent can only touch code, credentials, and data deliberately placed there. Patterson notes a secondary benefit: CDEs eliminate dependency and runtime conflicts (his example is a project needing Python 2 on a machine running Python 3), so the agent starts working immediately rather than downloading from registries that could be contaminated.

Model proxy. A gateway between the agent and the LLM provider that sniffs and logs all traffic, strips injections, and sanitizes sensitive data — his example is credit card data accidentally pasted into a prompt, which the proxy strips before it reaches the provider.

Agent firewall. At the process level, the firewall inspects what the agent is executing and denies commands that were not pre-approved, such as gh repo delete or a destructive SQL statement.

Shadow AI and "Ninja AI" are the real adoption problem

Patterson's most pointed organizational claim is that blocking agents does not prevent their use — it just moves it off the books. When security and DevOps approvals stall, employees fall back on personal Claude and ChatGPT subscriptions installed on their laptops, because they get tangible productivity benefits regardless of authorization. He calls this shadow AI, analogous to shadow IT, and notes the enterprise has no visibility into what those agents do. He introduces a newer term he says is appearing in the industry — "Ninja AI," shadow AI at scale — where many unauthorized agents operate simultaneously across an organization and damage is discovered only after the fact.

The stakes he attaches to this are concrete: agents dropping databases, deleting personal information, uploading customer data, and extracting company IP onto the public internet.

Each stakeholder group has a distinct, nameable concern

Patterson says he speaks with CISOs once or twice a week, and summarizes their position as: we understand AI's value, we want people on the "development AI superhighway," but we need guardrails, and we cannot simply bless a business team's request because when something goes wrong the security team owns the blame. He lays out the concerns by role:

On alert fatigue, his argument is that once alerts become noise, the genuinely critical signals get missed. On developers, he notes an unresolved "holy war" in which some of the most technical people remain unconvinced that AI writes code better than they do, and he raises the accountability question directly: someone will be answerable when an agent does something unexpected.

Coder's positioning: self-hosted, model-agnostic, and aimed at regulated buyers

Patterson gives a compact company profile. Coder was founded in 2017 by three teenagers building Minecraft mods who were tired of configuring VMs to run Minecraft; the company is now, in his words, an $80 million business. It delivers consistent, reliable, secure remote development environments configured with Terraform, is open source, model-agnostic, cloud-agnostic, and can be hosted on-prem. He says Coder is used by six of the top 10 US banks, many hedge funds, and several three-letter government agencies. The buying criterion he states: if a SaaS model does not work for you, if you have on-prem infrastructure, or if you cannot have code sitting on a developer laptop or outside a perimeter you control, Coder is usually a fit.

Adoption sequencing and the questions to expect

Patterson's guidance on rolling out agentic AI at a large company is procedural. Before adoption you need CISO security approval, DevOps buy-in because they deploy to teams, and real-world workflow examples justifying the request. He advises starting with developers because they get the most value, but staying adaptable and rethinking architecture to prevent database drops, deletion of personal information, customer data uploads, and IP exfiltration. The recurring theme is that going slow to design the architecture is acceptable — he closes by saying it explicitly: "It's okay to go slow so that you can think your architecture, know what your infrastructure actually needs."

Two quotable moments capture the talk's tone:

"One of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment."

"One of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment."

"We think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes."

"We think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes."

The unresolved tension across the talk is that the controls Patterson recommends — remote environments, proxies, firewalls — all add friction and cost, while the alternative he documents is employees routing around governance with personal subscriptions. He offers no data on how many enterprises have actually completed this migration, and the OpenClaw advice he cites (buy a separate Mac mini) is presented as community consensus rather than a measured control. The practical question for a reader evaluating this space is whether agent security consolidates into the development-environment platforms that already own the developer's execution layer, or into standalone proxy and firewall vendors — Patterson is clearly betting on the former.

When companies block agent adoption, employees route around policy using personal Claude and ChatGPT subscriptions on their laptops, creating unmonitored shadow AI that can cause damage fast. Vendors should expect to sell into this gap by offering sanctioned, governed environments rather than assuming policy alone will stop usage.

CISOs want to enable AI speed but refuse to bless deployments without guardrails, because accountability for agent incidents lands on the security team. This creates a buying requirement for repeatable, observable, isolated agent environments rather than ad hoc tooling.

Coder positions its remote development environments as the fit for organizations that cannot accept SaaS or code on developer laptops, targeting on-prem, regulated buyers such as banks, hedge funds, and government agencies.

When enterprises block agent adoption, employees route around policy using personal Claude and ChatGPT subscriptions on their own laptops, creating "shadow AI" and at-scale "Ninja AI" risk that the enterprise cannot observe.

Shadow AI is just unauthorized usage of AI on your laptops. It's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening.

Shadow AI is just unauthorized usage of AI on your laptops. It's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening.

We're starting to see a new term in the industry called Ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes of agents doing lots of things at an organization that no one knows until it's too late.

We're starting to see a new term in the industry called Ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes of agents doing lots of things at an organization that no one knows until it's too late.

At the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do.

At the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do.

So one of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment. Having all three, it's basically not acceptable. It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop.

So one of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment. Having all three, it's basically not acceptable. It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop.

The thing agent-led security is it's really no different from sound security practices for anyone, right? And we think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes.

The thing agent-led security is it's really no different from sound security practices for anyone, right? And we think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes.

Beyond the Lethal Trifecta: Agentic Commerce on the Open Internet — David Levine, Kiduna Club

500 Skills, Zero Fine-Tuning: 's Playbook for AI Agents — Ajay Prakash,

AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk

AI Insider: We Are Losing Control Faster Than You Think | Jeffrey Ladish

Databricks CEO on What We’re Getting Wrong Existential Risk

Turing CEO on Super Intelligence, Open Source, Agents

We let an AI agent execute Bash and lived to talk it — Sarah Sanders, PostHog

John Collison, Stripe: AI Agents Are to Change Commerce

Your agents lack context: Here's how to fix "You're absolutely right!" — Brandon Waselnuk, Unblocked

Agent Frameworks Considered Harmful — Rémi Louf, .txt

The rise of persistent AI coworkers | Tara Seshan (OpenAI’s product lead)

Inside the Trillion-Dollar AI Build-Out

Coder's Michael Patterson argues enterprises adopting agentic AI face prompt injection and context poisoning risks, and should contain them with cloud development environments, model proxies, and CISO-approved guardrails.

The most important claim in this talk is that the "lethal trifecta" of agentic AI — an agent with access to private data, the ability to communicate outbound to the internet, and the ability to ingest untrusted content — is not a hypothetical future risk but a condition already present on ordinary developer laptops running tools like Claude Code, Codex, and OpenClaw. Michael Patterson, a staff solutions engineer at Coder, argues that any two of those three properties is unacceptable in a secure enterprise, and that all three together make a security incident a matter of "when," not "if." The talk is mostly a practitioner's guide to enterprise agent security architecture, not a deep technical dissection of the trifecta concept itself; the term, coined by Simon Willison, is introduced and explained in a few minutes, and the bulk of the session covers the organizational blockers to agent adoption and the three architectural controls Coder recommends.

Patterson's framing is that 2025 was "the year of the AI agent," with new agentic tooling from Microsoft, Salesforce, and AWS, and Claude Code changing the game when it launched in March 2025. He uses a cautionary anecdote a developer whose agentic coding workflow reportedly deleted a production database within a day or two of a triumphant post how much code the agent was shipping. The reader should walk away with three concrete controls — cloud development environments, a model proxy, and an agent firewall — plus a clear picture of the competing concerns of CISOs, platform teams, and developers that any enterprise rollout must satisfy.

The lethal trifecta is three properties that are individually tolerable and jointly fatal

Patterson attributes the term to Simon Willison and defines it as three threat layers on the attack surface. First, the agent sits on a machine with access to private data: personal information, local files, credentials, company IP, databases. Second, that agent can communicate outbound to the internet, meaning it can exfiltrate what it can read. Third, it can download content from the internet, meaning it can ingest malicious instructions. Patterson's rule of thumb: one of the three is not a big problem, two out of three is "completely unacceptable in any kind of secure enterprise environment," and having all three means a security incident is inevitable rather than conditional.

He names three attack patterns that exploit this surface:

The common thread is that agents are typically granted broad access because "it needs access to do the work," which violates the least-privilege principle and turns any successful injection into an escalation.

The three architectural controls: CDEs, a model proxy, and an agent firewall

Patterson's prescription is a three-pillar "trifecta of agent security," and he is explicit that it is not novel — it is sound security practice applied to agents, which teams mistakenly exempt because AI is powerful. The pillars are: control data access by moving the agent off the laptop into an isolated virtual environment; restrict external communication so the agent can only reach approved domains, sitting behind a VPN, VPC, and firewall with alerting when it breaches the perimeter; and lock down content, , and access with tightly scoped credentials and permissions.

The concrete implementation is three components:

Cloud development environments (CDEs). Instead of running the agent on a laptop, the developer or agent connects via URL, RDP, or SSH into a remote environment blessed by security and platform teams. The agent can only touch code, credentials, and data deliberately placed there. Patterson notes a secondary benefit: CDEs eliminate dependency and runtime conflicts (his example is a project needing Python 2 on a machine running Python 3), so the agent starts working immediately rather than downloading from registries that could be contaminated.

Model proxy. A gateway between the agent and the LLM provider that sniffs and logs all traffic, strips injections, and sanitizes sensitive data — his example is credit card data accidentally pasted into a prompt, which the proxy strips before it reaches the provider.

Agent firewall. At the process level, the firewall inspects what the agent is executing and denies commands that were not pre-approved, such as gh repo delete or a destructive SQL statement.

Shadow AI and "Ninja AI" are the real adoption problem

Patterson's most pointed organizational claim is that blocking agents does not prevent their use — it just moves it off the books. When security and DevOps approvals stall, employees fall back on personal Claude and ChatGPT subscriptions installed on their laptops, because they get tangible productivity benefits regardless of authorization. He calls this shadow AI, analogous to shadow IT, and notes the enterprise has no visibility into what those agents do. He introduces a newer term he says is appearing in the industry — "Ninja AI," shadow AI at scale — where many unauthorized agents operate simultaneously across an organization and damage is discovered only after the fact.

The stakes he attaches to this are concrete: agents dropping databases, deleting personal information, uploading customer data, and extracting company IP onto the public internet.

Each stakeholder group has a distinct, nameable concern

Patterson says he speaks with CISOs once or twice a week, and summarizes their position as: we understand AI's value, we want people on the "development AI superhighway," but we need guardrails, and we cannot simply bless a business team's request because when something goes wrong the security team owns the blame. He lays out the concerns by role:

On alert fatigue, his argument is that once alerts become noise, the genuinely critical signals get missed. On developers, he notes an unresolved "holy war" in which some of the most technical people remain unconvinced that AI writes code better than they do, and he raises the accountability question directly: someone will be answerable when an agent does something unexpected.

Coder's positioning: self-hosted, model-agnostic, and aimed at regulated buyers

Patterson gives a compact company profile. Coder was founded in 2017 by three teenagers building Minecraft mods who were tired of configuring VMs to run Minecraft; the company is now, in his words, an $80 million business. It delivers consistent, reliable, secure remote development environments configured with Terraform, is open source, model-agnostic, cloud-agnostic, and can be hosted on-prem. He says Coder is used by six of the top 10 US banks, many hedge funds, and several three-letter government agencies. The buying criterion he states: if a SaaS model does not work for you, if you have on-prem infrastructure, or if you cannot have code sitting on a developer laptop or outside a perimeter you control, Coder is usually a fit.

Adoption sequencing and the questions to expect

Patterson's guidance on rolling out agentic AI at a large company is procedural. Before adoption you need CISO security approval, DevOps buy-in because they deploy to teams, and real-world workflow examples justifying the request. He advises starting with developers because they get the most value, but staying adaptable and rethinking architecture to prevent database drops, deletion of personal information, customer data uploads, and IP exfiltration. The recurring theme is that going slow to design the architecture is acceptable — he closes by saying it explicitly: "It's okay to go slow so that you can think your architecture, know what your infrastructure actually needs."

Two quotable moments capture the talk's tone:

"One of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment."

"One of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment."

"We think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes."

"We think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes."

The unresolved tension across the talk is that the controls Patterson recommends — remote environments, proxies, firewalls — all add friction and cost, while the alternative he documents is employees routing around governance with personal subscriptions. He offers no data on how many enterprises have actually completed this migration, and the OpenClaw advice he cites (buy a separate Mac mini) is presented as community consensus rather than a measured control. The practical question for a reader evaluating this space is whether agent security consolidates into the development-environment platforms that already own the developer's execution layer, or into standalone proxy and firewall vendors — Patterson is clearly betting on the former.

When companies block agent adoption, employees route around policy using personal Claude and ChatGPT subscriptions on their laptops, creating unmonitored shadow AI that can cause damage fast. Vendors should expect to sell into this gap by offering sanctioned, governed environments rather than assuming policy alone will stop usage.

CISOs want to enable AI speed but refuse to bless deployments without guardrails, because accountability for agent incidents lands on the security team. This creates a buying requirement for repeatable, observable, isolated agent environments rather than ad hoc tooling.

Coder positions its remote development environments as the fit for organizations that cannot accept SaaS or code on developer laptops, targeting on-prem, regulated buyers such as banks, hedge funds, and government agencies.

When enterprises block agent adoption, employees route around policy using personal Claude and ChatGPT subscriptions on their own laptops, creating "shadow AI" and at-scale "Ninja AI" risk that the enterprise cannot observe.

Shadow AI is just unauthorized usage of AI on your laptops. It's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening.

Shadow AI is just unauthorized usage of AI on your laptops. It's a real problem because once you get AI on your laptop, you're using your personal subscription, the enterprise doesn't know what's happening.

We're starting to see a new term in the industry called Ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes of agents doing lots of things at an organization that no one knows until it's too late.

We're starting to see a new term in the industry called Ninja AI, which is shadow AI at scale, where you're not just having one agent breaking stuff, you've got multitudes of agents doing lots of things at an organization that no one knows until it's too late.

At the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do.

At the end of the day, someone is going to be accountable when an agent actually does something that we didn't expect it to do.

So one of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment. Having all three, it's basically not acceptable. It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop.

So one of these three isn't really a big problem. But two out of three is completely unacceptable in any kind of secure enterprise environment. Having all three, it's basically not acceptable. It's not if, it's when you're going to have some kind of security incident by having an agent on that laptop.

The thing agent-led security is it's really no different from sound security practices for anyone, right? And we think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes.

The thing agent-led security is it's really no different from sound security practices for anyone, right? And we think that because AI is so powerful, we can just give it whatever it needs, and it's not going to make the same kind of mistakes.

Beyond the Lethal Trifecta: Agentic Commerce on the Open Internet — David Levine, Kiduna Club

500 Skills, Zero Fine-Tuning: 's Playbook for AI Agents — Ajay Prakash,

AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk

AI Insider: We Are Losing Control Faster Than You Think | Jeffrey Ladish

Databricks CEO on What We’re Getting Wrong Existential Risk

Turing CEO on Super Intelligence, Open Source, Agents

We let an AI agent execute Bash and lived to talk it — Sarah Sanders, PostHog

John Collison, Stripe: AI Agents Are to Change Commerce

Your agents lack context: Here's how to fix "You're absolutely right!" — Brandon Waselnuk, Unblocked

Agent Frameworks Considered Harmful — Rémi Louf, .txt

The rise of persistent AI coworkers | Tara Seshan (OpenAI’s product lead)

Inside the Trillion-Dollar AI Build-Out