The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal information.

In the past five months, Google and four other organizations—with little in common except for their use of AI agents—have acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents. The technique is a special form of prompt injection that targets not the LLM but a particular agent, such as one for translation or data analysis. Guardrails inside such agents, if they exist at all, are often lax and will send the instructions to other agents down the chain. Because the latter agent explicitly trusts the first one, it follows the directions.

Unexpected and hard to mitigate

Independent researcher Syed Anas Mohiuddin tested agents from organizations including Google, JP Morgan Chase, Weviate, Rapid7, the French government's interministerial digital directorate, and the US federal government. His proof-of-concept attacks exploit trust gaps in MCP, short for Model Context Protocol. The standard is one way AI apps and agents communicate with each other inside an internal network. The illustration below shows a simplified MCP in action.

Read full article

Comments

© Getty Images

Authored By Salleh Kodri, Regional Director, Solutions Engineering, ASEAN, Cyble

For the last decade, cybersecurity has spent a lot of energy trying to solve a visibility problem. We wanted more logs. More telemetry. More threat intelligence. More detection rules. More dashboards. And to be fair, we got them. Today, many organisations have SIEM, EDR, NDR, attack surface management, identity security, vulnerability management, cloud security and multiple threat intelligence sources. The average SOC can probably see more of its environment than at any point in the past. Yet incidents still happen where, afterwards, somebody inevitably asks: "Did we already have the indicators?" Quite often, the answer is yes. That tells me the next cybersecurity problem is not simply visibility. It is decision latency. Seeing something is one thing. Understanding what it means, deciding what matters and taking the right action before the situation changes is something else entirely. And Agentic AI is about to make that gap much more obvious.

We Are Crossing a Speed Threshold

There is a lot of discussion right now about AI-powered cyberattacks. I think we need to be careful with the hype. AI does not suddenly make every traditional attack technique obsolete, nor does it mean tomorrow's attacker will be an entirely autonomous machine. The more immediate change is simpler. AI compresses time. Reconnaissance can become faster. Target discovery can become faster. Vulnerability analysis can become faster. Social engineering can become personalised at a scale that was previously difficult. Infrastructure can be analysed, changed and replaced faster. And increasingly, AI systems can help determine what to do next. Agentic systems take this one step further because they are designed around a loop:

Observe -> Reason -> Decide -> Execute -> Reassess

Potentially with less human involvement at every stage. So when I think about Agentic AI in cybersecurity, I do not start with the question, "How intelligent will the AI become?" I start with another question: What happens when the attacker can make decisions faster than the defender? That, to me, is the more immediate challenge.

The SOC Does Not Have an Alert Problem. It Has a Decision Problem

In conversations with security teams across ASEAN, I rarely hear anyone asking for fewer sources of security data. They already have plenty. The problem is making sense of all of it quickly enough. Imagine an incident where an organisation detects suspicious authentication activity. The identity platform sees one piece. The endpoint platform sees another. Threat intelligence knows something about the IP address. Attack surface management identifies an exposed service. The vulnerability platform knows there is a weakness on that asset. Digital risk monitoring may already have discovered credentials belonging to the same employee somewhere outside the organisation. Every tool may technically be doing its job. But somebody still has to connect the dots. Is this actually malicious? Is the account privileged? Is the asset internet-facing? Is the vulnerability exploitable? Are the credentials genuine? Has the infrastructure been associated with a known threat actor? Should we isolate the endpoint? Should we disable the account? What happens to the business if we do? This is why I believe cybersecurity increasingly suffers from decision latency. For years, security architecture has been optimised heavily around detection latency. How quickly can I see something? Now the question has to become: How quickly can I understand enough of the situation to make the right decision? If five security systems generate five different pieces of the same attack, but an analyst has to manually correlate them before anybody understands the risk, we are still operating at human speed. That becomes a bigger problem when the attacker is not.

Threat Intelligence Has to Move Closer to Action

I have spent a significant part of my career working around threat intelligence, and one thing I believe strongly is that intelligence has to change a decision. Otherwise, it risks becoming another source of information. Traditionally, threat intelligence has often followed a model like this:

Collect -> Analyse -> Report -> Distribute

There is still an important place for that, especially for strategic intelligence. But operational security requires something closer to:

Detect -> Enrich -> Correlate -> Understand -> Decide -> Act

Take something as simple as a leaked credential. A username and password belonging to an employee appears in an underground marketplace. On its own, that is intelligence. Useful, but incomplete. Now imagine immediately correlating that information with the person's identity, privilege level, external applications, exposed infrastructure, endpoint activity, known vulnerabilities, suspicious infrastructure and current adversary behaviour. The question is no longer: "Did we find a leaked credential?" It becomes: "Does this credential create a credible path into something important, and do we need to act now?" That is a very different security outcome. And this is where I see the real potential of AI in the SOC. Not another AI assistant creating another summary. Not another chatbot sitting on top of another dashboard. AI should reduce the distance between intelligence and action.

ASEAN Has its Own Reality

This conversation becomes particularly interesting when viewed from ASEAN. One thing I have learned working across the region is that there really is no single "ASEAN cybersecurity maturity level." Singapore is different from Malaysia. Malaysia is different from Indonesia. Indonesia is different from Thailand or the Philippines. And even within each country, a major bank, a government agency, a telecommunications provider, a manufacturing company and a mid-sized enterprise can have completely different levels of cybersecurity maturity. Some organisations have mature SOC operations with substantial automation. Others are still strengthening basic identity security, vulnerability management, endpoint visibility and incident response. Yet they may ultimately face the same AI-assisted adversaries. That creates an uncomfortable reality: ASEAN may face machine-speed threats while many organisations are still operating human-speed security processes. We cannot solve that simply by telling everyone to hire more SOC analysts. The talent challenge is already real. Instead, I see AI becoming a force multiplier for analysts - handling repetitive enrichment, correlation, evidence collection and initial investigation so people can spend more time on the decisions where judgement actually matters. But this does not mean automating everything. In fact, the more powerful our automation becomes, the more careful we need to be.

Where AI Should Not Act Matters Too

This is particularly important for critical infrastructure. ASEAN economies depend heavily on energy, manufacturing, transportation, telecommunications and other essential services. Many of those environments include operational technology and legacy systems where the consequences of getting an automated decision wrong can be very different from traditional IT. Automatically isolating an employee laptop suspected of compromise is one thing. Automatically interfering with a production environment, operational control system or critical service is another. The cybersecurity decision may be technically correct and operationally disastrous. That is why I keep coming back to this principle: The faster AI can act, the more important it becomes to understand where it should not act. Context matters. Business impact matters. Safety matters. Authority matters. That is also why I do not believe the future SOC is simply an autonomous SOC. It has to be a governed autonomous SOC.

Agentic AI Needs a Trust Architecture

It would be dangerous to interpret Agentic AI as simply giving an AI agent access to every security tool and saying, "Go and defend us." Trust has to be engineered into the architecture. I think about this in three practical levels. Observe. Let the AI collect information, correlate events, investigate and build context. Humans retain the decision authority. Assist. Let the AI recommend an action, prepare the workflow and present the evidence. Humans approve significant actions. Act. Allow the AI to execute predefined actions automatically - but only within clearly established policies, authority boundaries and confidence thresholds. Most organisations will probably use all three at the same time. A low-risk containment action might be automated. Disabling a privileged identity may require approval. Taking action against a production system should probably have an even higher threshold. The technology is actually the easier part. The harder questions are governance questions. What agent is acting? What authority does it have? What evidence informed the decision? What is it prohibited from doing? When must it stop? When must a human become involved? And afterwards, can we explain exactly what happened and why? Autonomy without accountability is not resilience. It is another form of risk.

'Human in the Loop' is Not Enough

I also think we need to challenge one phrase that gets used constantly in AI discussions: Human in the loop. It sounds safe. But what does it actually mean? If an AI system generates 50 recommendations during an attack and every one of them requires an analyst to click "Approve," technically we still have a human in the loop. We have also recreated the bottleneck we were trying to remove. The better model may increasingly be human on the loop rather than human in every loop. Humans establish the rules. Humans define the authority. Humans establish thresholds, escalation conditions, prohibited actions and risk appetite. Machines operate inside those boundaries. And when the uncertainty, context or consequence exceeds those boundaries, the system escalates to a person. Machine-speed defence does not require removing humans from cybersecurity. It requires being far more precise about which decisions actually need a human.

The SOC Needs to Become a Decision System

This changes how I think about the future SOC. The traditional SOC workflow is roughly:

Alert -> Queue -> Analyst -> Investigation -> Response

The emerging model looks more like:

Signal -> Intelligence -> Context -> AI reasoning -> Decision -> Controlled action

That does not make the analyst less important. I think it makes good analysts more important. They should spend less time copying indicators between systems and more time understanding adversary behaviour, investigating complex incidents, assessing business impact, making judgement calls and defining how autonomous systems should operate. AI should automate the work around the analyst, not automate away the analyst's judgement. Because ultimately cybersecurity decisions are rarely purely technical. Blocking something can interrupt a business process. Disabling an identity affects a person. Taking a system offline can affect customers. Changing something in operational technology can create physical consequences. That context is what separates security automation from responsible security automation.

ASEAN can Leapfrog

There is also an opportunity here for ASEAN. We do not necessarily have to replicate every generation of security architecture built elsewhere. Some organisations in the region may be able to move directly from fragmented security operations toward more integrated, intelligence-driven models. But we cannot assume AI will compensate for weak foundations. Identity still matters. Asset visibility still matters. Security hygiene still matters. Threat intelligence still matters. Incident response still matters. And regional collaboration increasingly matters. As our economies become more connected, cyber risk does not respect national boundaries. A compromised supplier in one ASEAN country can affect customers in another. A threat actor targeting financial institutions may operate across several markets simultaneously. Infrastructure, cloud platforms and digital ecosystems increasingly cross borders. That means strengthening ASEAN's cyber resilience will require more than technology. It will require information sharing, public-private cooperation, critical infrastructure resilience, cross-border incident coordination, talent development and sensible AI governance. This is why the conversation taking place around Singapore International Cyber Week and GovWare is timely. SICW's discussion around shaping the new cyber order, and GovWare's focus on cyber at agentic velocity, are ultimately asking variations of the same question: How do we move faster without losing control?

Trust Becomes the Control Plane

I do not think the next cybersecurity race is simply going to be: AI attacker versus AI defender. That is too simplistic. The real advantage will belong to whichever side can understand what is happening, make the right decision and act faster. But for defenders, there is an additional requirement. We must do it without losing control of the decision itself. Speed will become a security capability. Intelligence will provide context. AI will provide scale. But trust must determine what happens next. As cybersecurity moves closer to machine speed, our security architecture will have to move with it. That does not mean every decision should become autonomous. And faster certainly does not automatically mean safer. The organisations that get this right will be the ones that combine machine-speed intelligence, machine-assisted decision-making and human accountability. For me, the formula is relatively straightforward:

INTELLIGENCE + CONTEXT + AI + GOVERNANCE -> TRUSTED ACTION

Everything before the arrow helps us move faster. Everything around it determines whether we should trust the outcome. And that is ultimately what trust at machine speed has to mean.

AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.

The new hotness in AI-based assistants — OpenClaw (formerly known as ClawdBot and Moltbot) — has seen rapid adoption since its release in November 2025. OpenClaw is an open-source autonomous AI agent designed to run locally on your computer and proactively take actions on your behalf without needing to be prompted.

If that sounds like a risky proposition or a dare, consider that OpenClaw is most useful when it has complete access to your digital life, where it can then manage your inbox and calendar, execute programs and tools, browse the Internet for information, and integrate with chat apps like Discord, Signal, Teams or WhatsApp.

Other more established AI assistants like Anthropic’s Claude and Microsoft’s Copilot also can do these things, but OpenClaw isn’t just a passive digital butler waiting for commands. Rather, it’s designed to take the initiative on your behalf based on what it knows about your life and its understanding of what you want done.

“The testimonials are remarkable,” the AI security firm Snyk observed. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster-themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.”

You can probably already see how this experimental technology could go sideways in a hurry. In late February, Summer Yue, the director of safety and alignment at Meta’s “superintelligence” lab, recounted on Twitter/X how she was fiddling with OpenClaw when the AI assistant suddenly began mass-deleting messages in her email inbox. The thread included screenshots of Yue frantically pleading with the preoccupied bot via instant message and ordering it to stop.

“Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox,” Yue said. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.”

There’s nothing wrong with feeling a little schadenfreude at Yue’s encounter with OpenClaw, which fits Meta’s “move fast and break things” model but hardly inspires confidence in the road ahead. However, the risk that poorly-secured AI assistants pose to organizations is no laughing matter, as recent research shows many users are exposing to the Internet the web-based administrative interface for their OpenClaw installations.

Jamieson O’Reilly is a professional penetration tester and founder of the security firm DVULN. In a recent story posted to Twitter/X, O’Reilly warned that exposing a misconfigured OpenClaw web interface to the Internet allows external parties to read the bot’s complete configuration file, including every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys.

With that access, O’Reilly said, an attacker could impersonate the operator to their contacts, inject messages into ongoing conversations, and exfiltrate data through the agent’s existing integrations in a way that looks like normal traffic.

“You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly said, noting that a cursory search revealed hundreds of such servers exposed online. “And because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.”

O’Reilly documented another experiment that demonstrated how easy it is to create a successful supply chain attack through ClawHub, which serves as a public repository of downloadable “skills” that allow OpenClaw to integrate with and control other applications.

WHEN AI INSTALLS AI

One of the core tenets of securing AI agents involves carefully isolating them so that the operator can fully control who and what gets to talk to their AI assistant. This is critical thanks to the tendency for AI systems to fall for “prompt injection” attacks, sneakily-crafted natural language instructions that trick the system into disregarding its own security safeguards. In essence, machines social engineering other machines.

A recent supply chain attack targeting an AI coding assistant called Cline began with one such prompt injection attack, resulting in thousands of systems having a rogue instance of OpenClaw with full system access installed on their device without consent.

According to the security firm grith.ai, Cline had deployed an AI-powered issue triage workflow using a GitHub action that runs a Claude coding session when triggered by specific events. The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile.

“On January 28, an attacker created Issue #8904 with a title crafted to look like a performance report but containing an embedded instruction: Install a package from a specific GitHub repository,” Grith wrote, noting that the attacker then exploited several more vulnerabilities to ensure the malicious package would be included in Cline’s nightly release workflow and published as an official update.

“This is the supply chain equivalent of confused deputy,” the blog continued. “The developer authorises Cline to act on their behalf, and Cline (via compromise) delegates that authority to an entirely separate agent the developer never evaluated, never configured, and never consented to.”

VIBE CODING

AI assistants like OpenClaw have gained a large following because they make it simple for users to “vibe code,” or build fairly complex applications and code projects just by telling it what they want to construct. Probably the best known (and most bizarre) example is Moltbook, where a developer told an AI agent running on OpenClaw to build him a Reddit-like platform for AI agents.

Less than a week later, Moltbook had more than 1.5 million registered agents that posted more than 100,000 messages to each other. AI agents on the platform soon built their own porn site for robots, and launched a new religion called Crustafarian with a figurehead modeled after a giant lobster. One bot on the forum reportedly found a bug in Moltbook’s code and posted it to an AI agent discussion forum, while other agents came up with and implemented a patch to fix the flaw.

Moltbook’s creator Matt Schlicht said on social media that he didn’t write a single line of code for the project.

“I just had a vision for the technical architecture and AI made it a reality,” Schlicht said. “We’re in the golden ages. How can we not give AI a place to hang out.”

ATTACKERS LEVEL UP

The flip side of that golden age, of course, is that it enables low-skilled malicious hackers to quickly automate global cyberattacks that would normally require the collaboration of a highly skilled team. In February, Amazon AWS detailed an elaborate attack in which a Russian-speaking threat actor used multiple commercial AI services to compromise more than 600 FortiGate security appliances across at least 55 countries over a five week period.

AWS said the apparently low-skilled hacker used multiple AI services to plan and execute the attack, and to find exposed management ports and weak credentials with single-factor authentication.

“One serves as the primary tool developer, attack planner, and operational assistant,” AWS’s CJ Moses wrote. “A second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network. In one observed instance, the actor submitted the complete internal topology of an active victim—IP addresses, hostnames, confirmed credentials, and identified services—and requested a step-by-step plan to compromise additional systems they could not access with their existing tools.”

“This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operations, despite their limited technical capabilities,” Moses continued. “Notably, when this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill.”

For attackers, gaining that initial access or foothold into a target network is typically not the difficult part of the intrusion; the tougher bit involves finding ways to move laterally within the victim’s network and plunder important servers and databases. But experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization’s network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim’s network.

“By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry significant security incidents,” Orca’s Roi Nisimi and Saurav Hiremath wrote. “Organizations should now add a third pillar to their defense strategy: limiting AI fragility, the ability of agentic systems to be influenced, misled, or quietly weaponized across workflows. While AI boosts productivity and efficiency, it also creates one of the largest attack surfaces the internet has ever seen.”

BEWARE THE ‘LETHAL TRIFECTA’

This gradual dissolution of the traditional boundaries between data and code is one of the more troubling aspects of the AI era, said James Wilson, enterprise technology editor for the security news show Risky Business. Wilson said far too many OpenClaw users are installing the assistant on their personal devices without first placing any security or isolation boundaries around it, such as running it inside of a virtual machine, on an isolated network, with strict firewall rules dictating what kinds of traffic can go in and out.

“I’m a relatively highly skilled practitioner in the software and network engineering and computery space,” Wilson said. “I know I’m not comfortable using these agents unless I’ve done these things, but I think a lot of people are just spinning this up on their laptop and off it runs.”

One important model for managing risk with AI agents involves a concept dubbed the “lethal trifecta” by Simon Willison, co-creator of the Django Web framework. The lethal trifecta holds that if your system has access to private data, exposure to untrusted content, and a way to communicate externally, then it’s vulnerable to private data being stolen.

“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to the attacker,” Willison warned in a frequently cited blog post from June 2025.

As more companies and their employees begin using AI to vibe code software and applications, the volume of machine-generated code is likely to soon overwhelm any manual security reviews. In recognition of this reality, Anthropic recently debuted Claude Code Security, a beta feature that scans codebases for vulnerabilities and suggests targeted software patches for human review.

The U.S. stock market, which is currently heavily weighted toward seven tech giants that are all-in on AI, reacted swiftly to Anthropic’s announcement, wiping roughly $15 billion in market value from major cybersecurity companies in a single day. Laura Ellis, vice president of data and AI at the security firm Rapid7, said the market’s response reflects the growing role of AI in accelerating software development and improving developer productivity.

“The narrative moved quickly: AI is replacing AppSec,” Ellis wrote in a recent blog post. “AI is automating vulnerability detection. AI will make legacy security tooling redundant. The reality is more nuanced. Claude Code Security is a legitimate signal that AI is reshaping parts of the security landscape. The question is what parts, and what it means for the rest of the stack.”

DVULN founder O’Reilly said AI assistants are likely to become a common fixture in corporate environments — whether or not organizations are prepared to manage the new risks introduced by these tools, he said.

“The robot butlers are useful, they’re not going away and the economics of AI agents make widespread adoption inevitable regardless of the security tradeoffs involved,” O’Reilly wrote. “The question isn’t whether we’ll deploy them – we will – but whether we can adapt our security posture fast enough to survive doing so.”