Agentic-Security

An indexed web page can carry a natural-language payload that targets, in a few lines, all four defensive layers of an AI agent: evasion, persistence, exfiltration, concealment. Worse, the outbound channel used for exfiltration is bidirectional: behind the URL, an attacker talks to the agent in real time. This article details the mechanism, shows why warning the model is a necessary but never sufficient first line, and why security comes from architecture — not from the prompt.

A chatbot writes sentences; an AI agent acts — it reads your email, runs code, calls APIs, spends money. That shift moves the risk: it is no longer about making the AI say something forbidden, but about making it do something dangerous. This article explains, with detailed and accessible examples, how these attacks actually work, why naive guardrails fail, and what a decision-maker must demand before putting an agent into production.

Classic security tools hunt for dangerous words: ‘hack’, ‘bomb’, ‘urgent’. But you don’t subvert an AI agent with suspicious vocabulary — you subvert it with the ordinary language of the business: a role, a process, a plausible emergency. And when the agent that monitors, the SIEM that correlates and the auditor that checks are themselves AI agents, the attacker no longer has to defeat a system: it corrupts them in a chain. This article explains that recursive-corruption mechanism and what a decision-maker must demand to break it.