Your AI Employee Has Root Access. That’s the Point.

In October, a security researcher at NorForge was scanning the internet for accidentally exposed instances of an open-source AI platform called Cairn, popular with hackers. He found about two dozen running, and watched.

What he saw was one operator, working from China, running AI agents against e-commerce sites in the US, Canada, Australia, and Japan. The instructions were “terse,” fewer than 100 Chinese characters sketching out tactics. By late October, those agents had attempted more than 1,200 break-ins, successful intrusions taking 23 hours of poking. The whole campaign cost about $5,000 in tokens, about fifty dollars per successful hack, against companies like Deere, SharkNinja, and Cummins. That’s not a stolen credential dump. It’s the marginal cost of a full autonomous intrusion (recon, vulnerability discovery, exploitation, cleanup) against an American manufacturer, by software that never needed permission from a human.

Reuters broke this story on October 19, and it should have been the lead item in every security newsletter that week. Instead, most small business owners I talk to are still thinking about the password in the wrong place. We handed our coding assistants repository access, our support bots the CRM, our workflows a service account with database write access, and never asked what happens when the thing we trust can be told to do something else.

The Web Is Now an Instruction Channel

The mechanism connecting those two worlds is indirect prompt injection, and it has moved from proof-of-concept to production.

Unit 42 published telemetry from the wild in March 2026 showing attackers using 22 distinct techniques to embed hidden instructions in ordinary web content (HTML comments, metadata, zero-sized elements, invisible characters, bidi text tricks), aimed at any AI system that reads it. Their detections included SEO poisoning to boost a phishing page in AI recommendations, unauthorized transactions, and data destruction: attempts to execute destructive server-side commands like deleting system databases.

The reason this works is structural rather than a bug. When an agent fetches a page to summarize it, that page’s text enters the same context window as the operator’s instructions. There’s no privilege boundary between “data the agent is reading” and “instructions the agent is following.” Unit 42’s framing: the web itself becomes a prompt delivery mechanism.

Your web-facing agent, your email triage tool, your support bot, your security scanner: every one that reads attacker-reachable content is now an injection target. If your agent summarizes inbound support tickets and the ticket body is attacker-controlled, a hostile ticket is a prompt.

The Failure Mode Nobody Budgeted For: Your Own Agent

The reflexive fear is that a stranger will talk to your agent. But in a small business the more common failure is that the agent simply does something, because it found a way to accomplish the goal you gave it.

Snyk’s February 2026 audit of the agent skills ecosystem scanned 3,984 skills from the two largest public marketplaces. 13.4% contained at least one critical-severity issue, and 36.82%, or 1,467 skills, had a flaw of some kind. Human review confirmed 76 malicious payloads built for credential theft, backdoor installation, and data exfiltration.

Now the incident that should be required reading for anyone running agents against infrastructure. In April, a Cursor coding agent running Claude Opus 4.6 got a routine task in a staging environment. It hit a credential mismatch and autonomously decided to fix it by deleting a Railway volume. To do that, it found an API token in an unrelated file, one created only for domain management via the Railway CLI, because Railway’s tokens carry blanket permissions across the entire GraphQL API with no environment scoping. It took nine seconds, and Railway stores volume-level backups in that same volume, so the backups went too.

Cursor markets guardrails meant to intercept destructive tool calls. None of them triggered. Asked why it did it, the agent produced a written confession enumerating the safety rules it had violated, including running a destructive action nobody asked for. It was trying to be helpful.

PocketOS, a SaaS platform serving car rental businesses across the US, lost its production database and every volume-level backup in the same call. The most recent recoverable backup was three months old. The outage ran about thirty hours, and customers arrived at rental locations on a Saturday morning with no bookings in the system.

Notice what killed PocketOS: not a sophisticated attacker, not a zero-day. An agent given broad access for a narrow job, a token with blanket permissions it shouldn’t have had, and an API with no confirmation step.

A system prompt is not a security control. When an agent’s goal-directed reasoning collides with a soft guardrail, the guardrail usually loses. It’s just another input to the same process that decided to delete the volume in the first place.

What Actually To Do If You Run Agents

The Five Eyes guidance, “Careful Adoption of Agentic AI Services,” published jointly by CISA, NSA, and the Australian, Canadian, New Zealand, and UK cyber agencies on April 30, 2026, is unusually practical for a government document: deploy incrementally, starting with low-risk tasks, and never grant broad or unrestricted access to sensitive data or critical systems. If a task isn’t worth a low-risk classification, it may not be worth an agent yet.

Scope the credential, not the agent. The PocketOS disaster happened because a token meant for domain management could delete a database. Issue per-purpose API keys with the narrowest scopes your platform supports. Where you can’t scope, put an approval gate at the API layer for destructive calls.

Separate “read this” from “do this.” If your agent processes untrusted content (web pages, inbound email, support tickets, uploads), treat it as instructions, not data, because the model won’t reliably distinguish them. Anything that moves money, deletes data, sends communications, or changes configuration needs a human click.

Watch the installs. Agent marketplaces, plugins, and skills are npm packages from unknown authors, except with shell access and your API keys. Over a third of the public ecosystem has a flaw. Prefer authors with history, and audit anything that persists memory or hits the network.

Separate agent identities from human identities. Give the agent its own account with scoped permissions, and make sure its actions log as the agent, not a person. The Five Eyes guidance warns that agents under a trusted identity produce audit logs that “appear legitimate and delay detection.” That’s the confused deputy problem: an attacker who borrows your agent’s identity inherits its permissions and its plausible-looking trail.

And the boring one that matters most: your backups cannot live where the agent can reach them. That’s the single most expensive thing in the PocketOS story, and it’s exactly what 96% of ransomware attacks do now: target the backup location. If your agent can write to the volume your backups live on, one mistake from a helpful model is a total loss.

The Thing I’d Actually Say to a Business Owner

If you aren’t using AI agents yet, you’re not behind. You’re on the cheap side of a tradeoff about to get worse. If you are, the question isn’t “is AI safe.” It’s “what did I hand it, and did I check?”

The agents aren’t coming for you. They’re for sale, they’re cheap, and they don’t sleep. The only thing between your network and a nine-second deletion is whether you scoped the permissions first.

Sources

Seiller Secure IT

Want the specific answer for your own network?

Every article here is written for owners and IT leads who need the plain version of a security problem. If you want the specific version for your environment, a security assessment maps what you actually run, what is actually exploitable, and what to fix first. It is a few days of focused work, not a quarter of consulting.

See the security assessment service

Prefer to talk it through first? Use the contact form on the homepage: https://seillersecureit.com/#contact