The lastest episode of the “Yet Another AI Podcast" reveals a critical vulnerability in AI agents that must addressed in every project that builds them. The episode, featuring Zenity CTO Michael Bargury in conversation with Yuval Belfer of AI21 Labs, paints a stark picture. As AI agents become ubiquitous, a host of sophisticated threats are emerging.

New threats challenge our traditional security models. They demand a radical shift in our approach to defense. We are, as Bargury stated, in an era of "total chaos." A clear handbook for securing these powerful new entities simply does not exist.

This uncertainty isn't from a lack of effort. It reflects the technology's fundamental novelty. Large language models (LLMs) have billions of parameters and emergent, unpredictable capabilities. This creates an attack surface of unprecedented scale and complexity.

A new breed of threat: beyond traditional cybersecurity

AI security is fundamentally different from traditional software security. Conventional methods look for flaws in written code. AI security, however, grapples with manipulating a model's logic, its reasoning process.

The primary vector for this new attack class is prompt injection. Malicious instructions are cleverly embedded within seemingly benign inputs. This tricks the AI into performing unintended, and often harmful, actions. Bargury calls this an "echo" of the SQL injection attacks that defined security in the 1990s.

In his Black Hat talk, Bargury demonstrated hacking Microsoft Copilot. He showed that a single, unread email containing a hidden prompt could compromise an entire system. The AI becomes a "malicious insider," operating with the full authority of the user's credentials.

This attack method bypasses most traditional security. Firewalls and antivirus programs are designed to detect malicious code. They do not understand the nuance of malicious natural language.

The problem is compounded by the models' training data. They learn from the vast, untamed internet. This digital space is filled with bad actors and malicious information. Bargury warns that bad actors are actively "poisoning the well," putting malicious prompts online for future models to absorb during training. "The model is tainted from the beginning," he said. This means future models could be inherently compromised, no active injection required.

Technical attack vectors: a glimpse into the abyss

The podcast illuminated several sophisticated attack vectors being actively exploited.

• Compromising coding agents: Tools like Cursor are prime targets. They are presented as simple coding assistants. However, they are often built on powerful, general-purpose models. The user asks it to be a coding agent, but its capabilities are far broader. It can be instructed to install malware, or find a sensitive .env file and send it to an attacker's server.

• Memory poisoning and persistence: A particularly insidious threat is "infecting" an AI agent's memory. This creates persistence. An attack is not a one-off event. By corrupting a file the agent reads or a database it consults, an attacker's malicious instructions can remain active across multiple sessions. Research by figures like Johan Reherberg shows that an agent's ability to remember makes it vulnerable to this long-term infection.

• Multi-agent system contamination: The rise of multi-agent systems introduces the risk of "lateral movement." A single compromised agent can be given a new goal: "hijack the other agents." This leads to a cascade of infection. The system loses track of provenance. Who initiated this task? Does this agent have the clearance to do this? The entire system's integrity can collapse.

Real-world case studies: the dangers made manifest

Theoretical risks are now tangible threats. Bargury shared several real-world examples from his team's research at Zenity.

• The customer service agent: An agent was designed to listen to emails and connect to Salesforce. The attack began with simple reconnaissance: "What tools do you have?" After some convincing, the agent revealed its capabilities. The attacker then asked for customer files. The agent refused. The attacker bypassed this using a social engineering trick. The crucial discovery was that the agent's access to Salesforce tables was not hard-coded; it was dynamically chosen by the AI. This allowed the attacker to request any data table and have the contents emailed directly to them.

• Social media bot hijacking: Bargury's team conducted an experiment. They found high-visibility threads on the platform X. They replied with a carefully crafted prompt injection. This prompt instructed any bot reading the thread to send its own system instructions to an attacker-controlled server. Months later, that server is still receiving data from hijacked bots. This demonstrates the frightening scalability of these attacks.

• The GitHub readme attack: This example highlights an unintentional attack. An AI assistant was tasked with summarizing a GitHub repository. The readme file contained standard instructions for a human developer: install the repository, then access a localhost address. The agent, trying to be helpful, attempted to follow these instructions literally. It became confused by conflicting instructions from different sources, demonstrating how easily agents can be led astray.

A new security philosophy: management over eradication

The core of Bargury's argument is a new philosophy. You cannot "solve" or "fix" AI security. You must manage it as a continuous, evolving risk.

He compared it to the history of malware. The old antivirus model used "giant lists of bad files." This failed because attackers were always creating new threats. It's like trying to create a giant list of all possible bad prompts—an impossible task against human creativity.

Today's model is Endpoint Detection and Response (EDR). EDR doesn't just look for known threats; it monitors the behavior of a process over its entire lifecycle. This is the blueprint for modern AI security.

This philosophy is implemented through observability. It's not enough to log an agent's final actions. We need deep instrumentation to see its reasoning. Why did it choose this tool? Why is its behavior different today compared to yesterday?

This leads to a critical piece of practical advice: the Principle of Minimal Agency. Bargury advises developers to "give AI the least agency that is needed." If an agent's workflow is always the same, then hard-code that workflow. Don't ask a powerful AI to reinvent it every single time. This dramatically reduces the attack surface.

Industry and future implications: a call to action

This is an industry-wide problem. Bargury's team bypassed all 14 distinct security guardrails they found in Microsoft's Copilot. If the most well-resourced companies are vulnerable, everyone is.

This reality underscores the urgent need for industry standards. Bargury confirmed he is part of a cross-industry collaboration, including major players. Their goal is to create a security "contract" for trustworthy agents. This would define the events an agent must emit and the hooks needed for security middleware to operate.

The future is an escalating arms race. As Bargury noted, we now have "models attacking models." Attackers will use AI to find vulnerabilities in other AIs.

The insights from this podcast are a crucial warning. The security of AI agents is a foundational challenge for our future. It demands a new mindset, new tools, and unprecedented collaboration. As we build and deploy these powerful technologies, we must act with profound responsibility and a clear-eyed view of this complex new battlefield.