My AI agents read everything. That is exactly the problem.
This morning I reviewed a free AI hacking course by NahamSec, and it stopped me cold. The topic was indirect prompt injection, and the punchline hit close to home: the most common way AI agents get hacked is through the content they are allowed to read. Not a malicious prompt pasted into a chat. Something you ask your own agent to fetch and process.
My agents read a lot. They scan the web through a search engine, they process email, they pull in clippings from my vault, they read WordPress content. That is precisely the attack surface NahamSec is talking about. An attacker does not need to reach my chat window. They just need to plant a payload somewhere my agent will read it — a website, an email, a PDF, a comment in a repository — and my own agent does the dirty work.
The part almost everyone gets wrong
The course made one point that shifted how I think about this. Most people test a basic injection payload, see it get blocked, and conclude they are safe. But a blocked basic payload is the beginning, not the end. Real agent applications have input guardrails — what gets in — and output guardrails — what gets out. The real attack is getting a payload past both. Encoding tricks, context manipulation, abusing a tool the agent trusts. The block you tested was never the finish line.
That maps uncomfortably well onto my setup. I run several agents that share memory and infrastructure. They were built to be useful, not to assume they are under attack. I optimised for more — more cron jobs, more skills, more autonomy — and never once asked what happens when one of them reads something hostile.
What I am doing about it
I am not going to write a wall of security theory. I am going to do the concrete thing the course pushes: take my agents — Hermes, the MCP servers, the team — and evaluate whether they survive an indirect injection planted in content they read. The course ships free labs, so I can run a few against real scenarios instead of guessing. And I am going to stop treating “it was blocked” as proof of safety.
If you run agents that read external content, do the same. The test is simple: can an attacker get their instructions into something your agent reads, and will your agent act on them?
The question I am leaving you with
Have you ever checked what happens if one of your AI tools reads a hostile webpage or email? What is the one source of content you trust your agent to read — that you have never questioned?
Wat vond je van dit bericht?
