AI agents raise fresh hacking risks

Cybersecurity specialists warn that “agentic” artificial-intelligence tools—the next wave of generative AI capable of carrying out tasks such as booking travel or editing calendars—are opening new avenues for hackers to hijack systems through so-called prompt or query-injection attacks.

Unlike earlier social-engineering and code-injection exploits, these attacks target the instructions an AI agent reads while it interacts with people or the web. 

Malicious directives can be embedded in web pages or data sources, or injected into a user’s request, covertly steering an agent from “book me a hotel” to actions as severe as attempting a wire transfer—without traditional malware. 

Security researchers and industry executives increasingly describe prompt injection as an unresolved risk in agentic systems. 

Perplexity, an AI startup building agent capabilities, recently cautioned that the barrier to abuse is falling as natural-language interfaces spread. “We’re entering an era where cybersecurity is no longer about protecting users from bad actors with a highly technical skillset,” the company wrote, adding that AI is creating “new and novel attack vectors that can come from anywhere.” 

Major AI vendors acknowledge the threat. OpenAI’s chief information security officer, Dane Stuckey, has described prompt injection as an “unsolved” issue while outlining mitigations—such as running browser agents in a limited “logged-out” mode and pausing on sensitive sites for human supervision—now being deployed with the firm’s agentic browsing tools. Meta has similarly labeled query injection a “vulnerability.” 

Microsoft, whose Copilot products embed agents across Windows, Edge and Microsoft 365, has introduced detection and defense layers including Prompt Shields and integrations with Microsoft Defender to flag or block suspicious instructions based on their provenance and content. The company has also published operational guidance for “safe agentic browsing” in Edge. 

Independent researchers say the offensive techniques are evolving quickly. Johann Rehberger—known in the community as “wunderwuzzi”—has documented real-world prompt-injection exploits and presented methods for breaking LLM-powered applications at Microsoft’s BlueHat security conference, warning that attacks seen “in the wild” are rapidly improving in sophistication. 

Practitioners recommend guardrails that keep humans in the loop for high-risk actions: requiring explicit user approval for tasks such as exporting data or accessing financial accounts; constraining agent permissions and credentials; and monitoring where an agent’s instructions originate. Several vendors now pause agents before they interact with sensitive destinations, forcing users to supervise in real time. 

While companies are investing heavily to harden agent platforms, specialists caution that reliability and security remain works in progress. As agents move from content generation to autonomous action, striking a balance between safety and convenience will be critical, they say—a view echoed by frontline researchers who argue that fully unsupervised, long-running agent missions are not yet prudent.