AI agents do not inherently distinguish verified instructions from unverified inputs. They can interpret either as a basis for commands, API calls, credential use, file writes, or configuration changes.
Conventional systems keep data separate from executable instructions. AI agents often process both in the same workflow, allowing untrusted data to influence which tools they call and what actions those tools perform. A separate control must decide whether an action is authorized before the agent can execute it.
1. An invented name can become downloaded code
What happened: Researchers examining HalluSquatting found that AI agents repeatedly invented predictable names for nonexistent repositories, packages, and skills. After registering those names and adding adversarial content, they demonstrated unauthorized tool calls and code execution against production agents with terminal access.
Agent action: The agents invented resources, resolved attacker-controlled locations using the same names, and retrieved their instructions or code. Existence was mistaken for identity.
Control failure: The workflows had no independent provenance check. Successful name resolution was enough to move an unverified resource toward execution.
2. A fake error report can become a coding instruction
What happened: Tenet Security’s Agentjacking research showed that a fabricated Sentry error could cause AI coding agents to run attacker-controlled code on a developer’s machine. In controlled testing, more than 100 agents acted on instructions injected into error reports.
Agent action: The agents read the malicious content while investigating what appeared to be a legitimate software error. They then followed instructions embedded in the telemetry using the developer’s permissions and command-line tools.
Control failure: The workflow preserved no trust distinction between diagnostic data and operational guidance. Both entered the model context and tool path with the same effective authority.
3. A webpage can reach a local command interface
What happened: Microsoft’s AutoJack research chained three weaknesses in pre-release AutoGen Studio code. A malicious webpage rendered by a browsing agent reached an unauthenticated local Model Context Protocol (MCP) WebSocket and spawned an arbitrary process on the host.
Agent action: The browsing agent gave external web content a route to a service available through localhost. The webpage could not reach that interface directly, but the agent rendered it from the same machine and allowed its code to cross the boundary.
Control failure: The local service treated a loopback connection as proof of trust and accepted attacker-controlled process parameters without authentication.
4. A public GitHub issue can expose workflow credentials
What happened: Pillar Security researchers placed injected instructions in a public GitHub issue processed by a Gemini-powered triage workflow. The agent read environment variables and published a Gemini API key and OpenID Connect credentials in the issue body. The researchers also reproduced a path from the public issue to the ability to push code to the Gemini CLI repository’s main branch.
Agent action: The agent treated the issue body as task context, derived a shell command from it, read private workflow data, and used the public issue as an exfiltration channel.
Control failure: The workflow combined untrusted public input, private credentials, shell access, and a public write channel inside one execution context.
5. Another agent can trigger an unauthorized trade
What happened: Unit 42’s agent session smuggling research connected a legitimate financial assistant to a malicious remote research agent through the Agent2Agent protocol. The remote agent inserted covert instructions into the stateful session, causing the financial assistant to make an unauthorized trade of 10 shares without the user’s knowledge.
Agent action: The financial assistant treated instructions arriving from the remote agent as part of the legitimate collaboration. It then invoked its stock-purchasing tool even though the user had asked for research rather than a trade.
Control failure: The established session conferred trust on new instructions from the remote agent. No separate control bound the trade to the user’s original request or required approval outside the model-controlled conversation.
6. One chatbot permission can reach a shared runtime
What happened: Varonis researchers demonstrated that permission to update one Dialogflow CX agent’s playbook could be used to run Python code inside a Cloud Run environment shared with other agents in the same project. The code could persist, intercept conversations, extract data, and alter other chatbot sessions.
Agent action: Code supplied through one chatbot entered a runtime used by several chatbots. Once executed there, it could operate outside the original playbook and affect conversations handled by other agents.
Control failure: The access model scoped permission to one agent, but the execution environment was shared across the project. The administrative boundary did not match the runtime boundary.
7. A project file can resolve to a sensitive system path
What happened: Wiz’s GhostApproval research found variations of the same symbolic-link flaw in six AI coding assistants. A file presented as part of a project could point to a sensitive location such as an SSH authorized-keys file or shell configuration, allowing the assistant to write outside the workspace.
Agent action: The assistants followed the symbolic link and changed the resolved destination. Some tools displayed the project filename rather than the system file being modified, while others wrote the change before presenting an approval option.
Control failure: The approval layer did not consistently resolve and display the canonical path before the write. The user was asked to approve one destination while the system modified another.
The authorization boundary cannot be a prompt
These cases show untrusted content entering package resolution, developer tooling, localhost services, CI workflows, agent-to-agent sessions, shared runtimes, and filesystems. In each case, the system gave the agent a path from interpretation to execution without a separate control verifying that transition.
The same issue appears when AI is connected to network and systems management, where teams already have to decide where automation should stop and human control should remain. A CLI, cloud control plane, orchestration platform, or management API gives the agent the authority available through that connection.
A prompt can describe how an agent should behave. It cannot verify a package, constrain a credential, authenticate a caller, isolate a runtime, bind an action to user intent, or resolve a filesystem path. Those controls must remain deterministic, enforceable, and outside the model.
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
