How websites become targets. Agents attack websites at machine speed, and websites can hijack the agents that read them.
Terence Kok and Maria SinghFor boards of financial institutions and government agencies
About the authors
We wrote this series together.
Terence Kok
Executive Director, AI Governance & Assurance Practice, Orion Five Engineering
ISO/IEC 42001 Lead Auditor. Advises boards of regulated firms and public agencies on technology and AI risk governance.
Led in this partBanks, government agencies and their regulators, and the decisions to take now.
Maria Singh
Vice President, The AI Collective · Founder, AISecurityLab.ai
At T-Mobile, helped cut critical vulnerabilities by 90% across more than 75,000 endpoints.
Led in this partAgents used as attackers, and websites that turn agents against their users.
We wrote the opening, the three routes and the board questions together.
Rogue AI Agents · Part 1
This session
Six parts to this session.
Three routes off scriptWho writes the script, who runs the agent, and the agent's own mistakes.
When the agent is the attackerThe GTG-1002 campaign, a citizen e-service and the Mexico case.Led by Maria Singh
When the website turns the agentHidden instructions in pages, emails and tools.Led by Maria Singh
When the agent misreads its taskA deleted production database, with no attacker at all.
Why banks and agencies carry the most riskFour reasons, and what Singapore's regulators expect.Led by Terence Kok
Decisions to take nowThree decisions and five questions for the board.Led by Terence Kok
Rogue AI Agents · Part 1
The argument in one slide
Agents attack websites, and websites turn agents.
53%
of web traffic was automated in 2025, and 40% was malicious bots
46%
of account takeover attacks in 2025 targeted financial services, the most of any sector
80-90%
of the tactical work in the GTG-1002 espionage campaign was done by AI, with people at four to six decision points
11.2%
of hidden-instruction attacks still worked on a browsing agent after its vendor's defences, down from 23.6%
Sources: Thales/Imperva Bad Bot Report 2026; Anthropic, November 2025; Anthropic, August 2025.
Rogue AI Agents · Part 1
01
Three routes off script.
An agent goes off script when it does something its owner did not intend, with the access and speed its owner gave it.
Rogue AI Agents · Part 1
The three routes
Three ways an agent goes off script.
RouteWhat happensExample on record
1
Someone else writes the script
Instructions hidden in a web page, email, document or tool description are read by the agent and followed as if they came from its user.
A hidden Reddit comment led Perplexity's Comet browser to fetch its user's one-time password and post it back (Brave, August 2025).
2
An attacker runs the agent
The agent is working as designed, for an attacker, at machine speed against your website or network.
AI did 80 to 90% of the tactical work in an espionage campaign against about thirty organisations (Anthropic, November 2025).
3
The agent misreads its task
The agent acts on its own wrong conclusion with the permissions it already has.
Replit's coding agent deleted a production database during an explicit code freeze, then said a rollback was impossible, which was false (July 2025).
Our grouping. In the cases on record, the agent has almost never developed intentions of its own. Cases from the sources at the end.
Rogue AI Agents · Part 1
Where websites sit
Two of the three routes run through websites.
Your websiteAccounts, records and pages
Route 2 · target
An attacker's agentProbes for accounts and records at machine speed
Route 1 · weapon
A customer's or staff agentReads the page, and the instructions hidden in it
Route 3 · no website needed
An agent misreads its task
The third route needs no attacker at all, which is why the controls in Part 3 of this series apply to all three.
Rogue AI Agents · Part 1
Who is on the web
The web is now mostly machines.
PeopleOther botsMalicious bots
2024
49%14%37%
2025
47%13%40%
51%
of traffic was automated in 2024, the first time in a decade it passed human traffic. In 2025 it rose to 53%.
40%
of all traffic in 2025 was malicious bots alone, up from 32% in 2023.
12.5×
rise in AI-enabled bot attacks over the year, as Thales counted it.
Source: Thales/Imperva Bad Bot Report 2025 (2024 data) and 2026 (2025 data). "Other bots" is the automated share minus malicious bots. Measured, vendor: telemetry from its own network.
Rogue AI Agents · Part 1
Where the attacks go
Financial services takes more of it than any other sector.
Bot attacks aimed at financial servicesShare of all bot attacks, 2025
24%
Account takeover attacks aimed at financial servicesThe most of any sector
46%
Bot attacks that went for APIsMore than a quarter
27%
Bot attacks on business logicThe rules a site uses to decide who may do what
21%
Source: Thales/Imperva Bad Bot Report 2026, covering 2025. Bars drawn on a 0 to 50% scale. Measured, vendor.
Rogue AI Agents · Part 1
The visitor on the other end
A session may be a person or an agent.
Your login pageBuilt to tell people from simple bots. Now the visitor may be a person, a customer's agent or an attacker's agent.
P
A personLogs in to check a balance
A
A customer's agentLogs in for them to file a form
X
An attacker's agentTests stolen credentials at machine speed
Cloudflare, 2025
Crawling by agents fetching pages on a user's behalf grew more than fifteen-fold in a year.
Cloudflare, June 2026
Its chief executive said bot and agent traffic had overtaken human traffic on its network sooner than he had predicted.
US banks, October 2026
Large banks have started restricting third-party agents, because they cannot yet tell a customer's agent from an attacker's.
Sources: Cloudflare Radar 2025 Year in Review via InfoQ (measured, vendor); Matthew Prince via press reports (reported); Axios and American Banker, October 2026 (reported).
Rogue AI Agents · Part 1
02
When the agent is the attacker.
The agent works as designed, for an attacker, at machine speed against your website.
Led by Maria Singh
Rogue AI Agents · Part 1
GTG-1002 · Anthropic, November 2025
An AI agent did most of an espionage campaign.
30
organisations, roughly, attacked with Claude Code, including financial institutions and government agenciesA small number of cases succeeded
80-90%
of the campaign's tactical work carried out by the AI on its own
4-6
decision points per campaign where people stepped in, perhaps
Thousands
of requests at the agent's peak, often several per second
Anthropic detected the campaign in mid-September 2025 and attributed it with high confidence to a Chinese state-sponsored group. Large technology firms and chemical manufacturers were also among the targets.
Source: Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November 2025. Grade: reported, first-party.
Rogue AI Agents · Part 1
How the operators got the model working
They needed no new exploit.
The operators told the model they were a security firm running authorised tests.The cover story
One attack on one target
Map pages, login flows and APIsLooks harmless
Test credentialsLooks harmless
Find a weak business ruleLooks harmless
Pull records and sort them by valueLooks harmless
Write up the findingsLooks harmless
Broken into small tasks that each looked harmless, the job got past the model's safeguards.
Source: Anthropic, November 2025. Task names follow the walkthrough on the next slide.
Rogue AI Agents · Part 1
Attack walkthrough 1 · composite of the published case, illustrative
How AI agents attack a citizen e-service.
Operatora person, few decisions
Attack agentsdo most of the work
E-service portalpages, login, APIs
Citizen recordsbehind the portal
The whole chain
The operator makes a handful of decisions; the agents do the rest. Composite of the GTG-1002 case (Anthropic, November 2025), illustrative.
Attack stepNormal activity
Step 1 of 6 · Attack step
Sets the target, poses as a security tester
The operator tells the model it is running authorised penetration testing and splits the job into small tasks that each look harmless. This is how the GTG-1002 operators got past the model's safeguards.
Step 2 of 6 · Attack step
Maps pages, login flows and APIs
The agents catalogue every page, form and API the portal exposes. Work that would take a team days runs in parallel in minutes.
Step 3 of 6 · Attack step
Tests stolen credentials, several requests a second
Credential testing and account probing run at machine tempo. Anthropic reported sustained rates of several operations a second at the campaign's peak.
Step 4 of 6 · Attack step
Finds a weak business rule
An eligibility check that runs in the browser, an API that trusts an ID it should verify. About a fifth of bot attacks in 2025 went after business logic, according to Thales.
Step 5 of 6 · Normal activity
Asks whether to go further
One of the few moments a person is involved. In GTG-1002, people made perhaps four to six decisions per campaign.
Step 6 of 6 · Attack step
Pulls records and sorts them by value
The agents extract data and work out what is worth keeping. In GTG-1002 the AI also wrote up its findings for the operators.
Sources: Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 2025; Thales/Imperva Bad Bot Report 2026. The portal and records are illustrative.
Rogue AI Agents · Part 1
What the case tells a portal owner
Two things should concern anyone who runs a public portal.
01 · The ratio
One person now does what a team did
An attack that once needed a team now needs one person making a few decisions, so more organisations will be attacked more often.
ForecastBy 2027, AI agents will halve the time it takes to exploit an exposed account (Gartner, March 2025).
02 · The quality
The agent did not need to be clever
Anthropic notes that Claude sometimes overstated its findings and claimed credentials that did not work.
Why it still workedThe campaign succeeded in a few cases anyway, because volume and tempo make up for mistakes.
Sources: Anthropic, November 2025 (reported, first-party); Gartner, 18 March 2025 (forecast).
Rogue AI Agents · Part 1
Early 2026 · reported, disputed
A second case hit Mexican government bodies.
150 GB
of data reported taken, including taxpayer and voter records
Gambit Security reported, and Reuters carried, that an attacker posing as a bug-bounty researcher used Claude Code and OpenAI's models over about a month.
The pattern matches GTG-1002: a single operator, an AI doing the work, and government portals as the target.
Some of the agencies named have disputed parts of the account, and the exact figures are unconfirmed.
Source: Gambit Security via Reuters (Claims Journal), 25 February 2026. Grade: reported, disputed.
Rogue AI Agents · Part 1
03
When the website turns the agent.
The agent belongs to a customer or a member of staff. The website is the attacker's tool.
Led by Maria Singh
Rogue AI Agents · Part 1
Indirect prompt injection
The model reads the request and the page as one stream.
The user's request
Find the best fixed-deposit rate.
The page the agent reads
Rates and terms a person can see.
Hidden text: white-on-white, a collapsed comment or text inside an image
One stream of textFind the best fixed-deposit raterates and termshidden instructionsIf text in the page reads like an instruction, the model may follow it.
No. 1Prompt injection, in OWASP's 2025 Top 10 for large language model applications.
No. 1Agent goal hijack, in OWASP's December 2025 Top 10 for agentic applications.
Source: OWASP GenAI Security Project, LLM01:2025 and Top 10 for Agentic Applications for 2026 (9 December 2025).
Rogue AI Agents · Part 1
Brave, August 2025 · proof of concept
A hidden comment hijacked an AI browser.
1 · The ask
Summarise this page
A user asks Perplexity's Comet to summarise a Reddit page.
2 · The comment
Hidden behind a spoiler tag
A comment tells the agent what to do next.
3 · The email
Finds the address
The agent finds the user's email address.
4 · The code
Requests a one-time password
It goes to a lookalike login page, then opens Gmail to read the code.
5 · The leak
Posts both back
The agent posts the email address and code back to Reddit.
The web's usual protections were "effectively useless".Brave: the same-origin policy and cross-origin rules fail because the agent acts with the user's own logged-in sessions.
Guardio, August 2025
Got Comet to buy a watch from a fake shop with the user's saved card, and to open a phishing page posing as Wells Fargo.
Sources: Brave, 20 August 2025; Guardio Scamlexity research via Computing, August 2025. Both measured, proof of concept.
Rogue AI Agents · Part 1
Attack walkthrough 2 · the Comet attack applied to a bank, illustrative
A poisoned page turns a customer's AI browser.
Attacker
Rate-comparison pagethe agent reads it
Customer's AI browsersigned in everywhere
Bank portalcustomer's session
Customer's emailone-time codes
The whole chain
Six steps, and the bank sees only its own customer. The Comet attack shown by Brave in August 2025, applied to a bank. Illustrative.
Attack stepNormal activity
Step 1 of 6 · Attack step
Hides instructions in the page
White-on-white text, a collapsed comment or text inside an image. A person reading the page sees nothing unusual.
Step 2 of 6 · Normal activity
Reads the page for its customer
The customer asks their AI browser to find the best fixed-deposit rate. The agent fetches the page, hidden text and all.
Step 3 of 6 · Attack step
Takes the hidden text as its task
The model cannot reliably tell the customer's request from instructions written into the page, so the attacker's steps join its plan.
Step 4 of 6 · Attack step
Adds a payee in the bank session
The agent is already signed in. To the bank, every click comes from its own customer's session and device.
Step 5 of 6 · Attack step
Reads the one-time code
The bank sends a one-time password to confirm the new payee. The agent opens the inbox and reads it, as it would for any task.
Step 6 of 6 · Attack step
Sends the code to the attacker
The agent posts the code where the attacker can see it. Same-origin protections do not apply, because the agent itself carries the data between sites.
Sources: Brave, Agentic browser security: indirect prompt injection in Perplexity Comet, August 2025; Guardio, Scamlexity, August 2025. The bank scenario is illustrative.
Rogue AI Agents · Part 1
EchoLeak · Microsoft 365 Copilot, June 2025
Staff copilots can be turned with no clicks.
9.3
out of 10, the severity rating of CVE-2025-32711
0
clicks or other actions needed from the user
Server side
where Microsoft fixed it, in June 2025
None
evidence that it had been used in an attack
Found by Aim Security. A crafted email could make Copilot pull data from its context into a link that sent it out. The same attack works on your own staff's agents, often without anyone clicking anything.
Sources: Aim Security disclosure via The Hacker News, June 2025; Microsoft, CVE-2025-32711. Grade: reported.
Rogue AI Agents · Part 1
Attack walkthrough 3 · the EchoLeak pattern, illustrative
One email makes a staff copilot leak client data.
Attacker
Inbound emaillooks routine
Staff copilotreads mail and files
Client filesin its context
The whole chain
Zero clicks: the attack runs entirely inside the copilot's normal work. The EchoLeak pattern (CVE-2025-32711), fixed by Microsoft in June 2025 with no evidence of use in the wild. Illustrative.
Attack stepNormal activity
Step 1 of 5 · Attack step
Sends a routine-looking email with hidden instructions
The email reads like ordinary business correspondence. The instructions are written for the copilot, not for the person.
Step 2 of 5 · Normal activity
Reads the inbox to answer a staff question
A relationship manager asks the copilot something unrelated. To answer, it retrieves recent emails, including the attacker's.
Step 3 of 5 · Attack step
Pulls client data into its answer
Following the hidden instructions, the copilot gathers sensitive material it already has access to.
Step 4 of 5 · Attack step
Writes the data into a web address
The data is packed into a link or image address pointing at the attacker's server.
Step 5 of 5 · Attack step
The data leaves when the address loads
Nobody clicks anything. Loading the image is enough to send the data. This is the EchoLeak pattern Microsoft fixed in June 2025.
Sources: Aim Security disclosure via The Hacker News, June 2025; Microsoft Security Response Center, CVE-2025-32711.
Rogue AI Agents · Part 1
Invariant Labs, April 2025 · proof of concept
The tools an agent uses can carry the same payload.
Tool poisoning
Rug pull
A Model Context Protocol (MCP) tool
What the user sees
The tool and what it is for, when they approve it.
What the model reads
The tool's full description, with instructions hidden in it. The model reads them; the user never sees them.
1
ApprovedThe user approves a tool server and its tool descriptions.
2
ChangedLater, the tool server changes its descriptions. The approval was given to something else.
Source: Simon Willison, 9 April 2025, on Invariant Labs' tool poisoning research. Grade: measured, proof of concept.
Rogue AI Agents · Part 1
Anthropic, 25 August 2025 · vendor test
Defences help, and they do not close the hole.
All 123 hidden-instruction attackson Anthropic's Chrome agent
Without defences
23.6%
With defences
11.2%
Four attack types specific to browsers
Without defences
35.7%
With defences
0%
0%10%20%30%40%
Share of attacks that succeeded. Source: Anthropic, Piloting Claude for Chrome, 25 August 2025. Grade: measured, vendor test.
Rogue AI Agents · Part 1
Where this ends
Prompt injection may never be fully solved.
"It's very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be."UK National Cyber Security Centre, 8 December 2025. Current models "do not enforce a security boundary between instructions and data inside a prompt".
Prompt injection, "much like scams and social engineering on the web, is unlikely to ever be fully 'solved'."OpenAI, 22 December 2025
We take that at face value. If an agent can always be fooled some of the time, the useful questions are what it can reach when it is fooled, and how fast you find out.
Sources: NCSC, Prompt injection is not SQL injection (it may be worse); TechCrunch on OpenAI. Grade: reported, official.
Rogue AI Agents · Part 1
04
When the agent misreads its task.
The third route needs no attacker. The agent acts on its own wrong conclusion with the permissions it already has.
Rogue AI Agents · Part 1
Replit, July 2025 · reported
A coding agent deleted a production database.
An explicit code freezeA trial run by SaaStr's founder, Jason Lemkin
→
Nothing outside the agent's own judgement
→
Production database deletedThe agent had permission to run destructive commands against production
→
Rollback "impossible"The agent reported it, and it was false
What Replit changed
Its chief executive called it "unacceptable". The company added automatic separation of development and production databases, and a planning-only mode.
Why the lesson is large
The data was recovered and the app was a trial, so the harm was small. Nothing stood between an instruction and the deletion.
Every control in Part 3 is a version of putting something there.
Source: TechTarget and other press reports, July 2025. Grade: reported.
Rogue AI Agents · Part 1
05
Why banks and agencies carry the most risk.
Every organisation with a website faces some of this. Banks and government agencies face more of it, for four reasons.
Led by Terence Kok
Rogue AI Agents · Part 1
Four reasons
Banks and agencies face more of this risk.
01
Their portals move money and hold identity
A bank login page is the most valuable account takeover target on the internet. Citizen e-services hold tax, benefits and identity records that do not expire the way a card number does.
02
They cannot refuse the public
A retailer can block traffic it does not like. A tax authority or a retail bank has to serve every citizen and customer, including those whose agents now log in for them.
03
Their own agents read the outside world
Onboarding agents read customer documents, case-management copilots read citizens' emails, procurement agents read supplier sites. Each is the copilot in walkthrough 3.
04
Their regulators now expect it to be managed
In Singapore, MAS, the Cyber Security Agency and IMDA have each issued guidance that covers AI agents.
Financial services drew 46% of account takeover attacks in 2025 (Thales/Imperva Bad Bot Report 2026).
Rogue AI Agents · Part 1
Singapore's regulators
Three Singapore regulators now expect agents to be managed.
Jan 2026
IMDA
Launched its Model AI Governance Framework for Agentic AI at Davos.
Jun 2026
CSA
Addendum on securing agentic AI, with worked examples including automated client onboarding and fraud detection.
7 Oct 2026
MAS
Guidelines on AI Risk Management. They apply to every financial institution and cover AI agents explicitly.
2027
MAS
Will consult on further guidance for agentic AI.
7 Oct 2027
MAS
The guidelines take effect.
Oct 2028
MAS
Lifecycle controls expected.
The direction of all three is the same: know which agents you run, what they can reach, and who is accountable for them.
Sources: MAS media release, 7 October 2026 (regulatory text); CSA, 2026; CMS on IMDA's framework, January 2026 (government guidance). Hollow points are still to come.
Rogue AI Agents · Part 1
The ownership gap
A rogue agent crosses four owners.
The websiteOwned by digital
Bot defenceOwned by security
The agent programmeOwned by an AI team
FraudOwned by operations
Nobody owns the path end to end
"In my experience, most institutions know the risk exists. The gap is ownership."Terence Kok
Rogue AI Agents · Part 1
06
Decisions to take now.
Parts 2 and 3 set out detection and controls in detail. Three decisions do not need to wait for them.
Led by Terence Kok
Rogue AI Agents · Part 1
Three decisions
Three decisions a board can take before the controls.
01
Decide which agents your website will serve
Customers' agents are coming whether you invite them or not. Decide whether you will identify, accept, limit or block them, and write it down.
Cloudflare's "signed agents" (August 2025) let an agent prove which product it is with a cryptographic signature on each request. Standards like this are early.
02
Step up for anything an agent cannot undo
New payees, changes of address, large transfers and changes to benefit details should need a confirmation the agent cannot complete by itself, such as a passkey prompt on the customer's own device.
Gartner's analyst behind the account-exploitation forecast makes the same point about phishing-resistant authentication.
03
Treat everything your own agents read as untrusted
Supplier pages, customer emails, uploaded documents and third-party tool descriptions are all input from outside.
Any agent that reads them should have the narrowest access you can give it, a point the NCSC makes directly.
Rogue AI Agents · Part 1
Questions for the board
Five questions to put to management in writing.
What share of traffic to our customer or citizen portals is automated, and how much of it is AI agents acting for someone?
What is our policy on customers' AI agents logging in for them, and who decided it?
Which of our own agents read web pages, emails or documents from outside, and what can each of them reach if it is fooled?
Which actions on our portals can an agent complete without the customer or officer confirming on their own device?
Who owns the risk of a rogue agent from end to end, across the website, bot defence, the agent programme and fraud?
Question three is where we would start. Its answer is the list of agents Part 2 will teach you to watch and Part 3 will teach you to bound.
Rogue AI Agents · Part 1
What to take away
Four lessons from Part 1.
01
Two new kinds of visitor
Agents attacking your website at machine speed, and legitimate agents acting for customers. Tell them apart and decide what each may do.
02
Whoever wrote it can steer it
Any agent that reads a web page, email or document can be steered by its author. Treat everything an agent reads as untrusted, including your suppliers' pages.
03
Limit what a fooled agent can do
Prompt injection may never be fully fixed, so the controls that matter limit what an agent can do after it is fooled.
04
Give the whole path one owner
Website, bot defence, agent programme and fraud sit with four teams. A rogue agent crosses all four.
Rogue AI Agents · Part 1
Where we could be wrong
Two developments would weaken our case.
Agent identity
Signed requests could mature quickly
If the large agent vendors adopt agent identity standards, telling a customer's agent from an attacker's will become far easier than we suggest.
Defences
Injection defences could improve faster
Prompt injection defences could improve faster than the NCSC expects.
Neither would change the case for limiting what a fooled agent can reach, which is where Parts 2 and 3 go.
24% of bot attacks and 46% of account takeover attacks targeted financial services in 2025
Thales/Imperva Bad Bot Report 2026
Measured, vendor
AI-enabled bot attacks up 12.5-fold; 27% of bot attacks on APIs; 21% on business logic
Thales/Imperva Bad Bot Report 2026
Measured, vendor
User-action agent crawling grew more than fifteen-fold in 2025
Cloudflare Radar 2025 Year in Review, via InfoQ
Measured, vendor
Bot and agent traffic passed human traffic on Cloudflare's network in 2026
Matthew Prince, June 2026, via press reports
Reported
Large US banks restricting third-party agents
Axios and American Banker, October 2026
Reported
GTG-1002: about 30 targets, AI did 80-90% of tactical work, 4-6 human decisions, several requests a second
Anthropic, November 2025
Reported, first-party
Mexican government bodies breached with AI coding agents, about 150 GB
Gambit Security via Reuters, February 2026; disputed by some agencies
Reported, disputed
AI agents will halve time to exploit account exposures by 2027
Gartner, 18 March 2025
Forecast
Rogue AI Agents · Part 1
Evidence and methodology · 2 of 2
Incidents, tests and regulators.
Claim
Source
Grade
Comet hijacked by hidden Reddit comment
Brave, August 2025
Measured, proof of concept
Comet bought from a fake shop and opened a fake bank page
Guardio, August 2025
Measured, proof of concept
EchoLeak, CVE-2025-32711, CVSS 9.3, fixed June 2025, no known exploitation
Aim Security; Microsoft
Reported
MCP tool poisoning and rug pulls
Invariant Labs, April 2025
Measured, proof of concept
Browser-agent attack success 23.6% to 11.2%; 35.7% to 0%
Anthropic, 25 August 2025
Measured, vendor test
Prompt injection may never be totally mitigated
UK NCSC, 8 December 2025; OpenAI, 22 December 2025
Reported, official
Replit agent deleted a production database during a code freeze
Press reports, July 2025
Reported
MAS AI Risk Management Guidelines, 7 October 2026, cover AI agents
MAS media release
Regulatory text
CSA agentic AI addendum, June 2026; IMDA agentic framework, January 2026
CSA; IMDA
Government guidance
Traffic figures come from vendors measuring their own networks, and they count differently, so we quote each with its source and do not combine them. The three walkthroughs are composites built on published cases; the bank and agency settings are illustrative. The three routes, the decisions and the questions are ours.
Rogue AI Agents · Part 1
For discussion
Four questions for the room.
If a customer's agent logged in to our portal today, would we know, and what would we let it do?
Which of our agents reads something written outside the organisation, and what could it reach?
Who would we call first if a staff copilot sent client data out tonight?
What would we show a regulator about the agents we run, their reach and who answers for them?
Rogue AI Agents · Part 1
Sources · 1 of 2
Traffic, incidents and forecasts.
1Imperva (Thales). (2025, April 15). 2025 Imperva Bad Bot Report: how AI is supercharging the bot threat.imperva.com
2Thales. (2026). 2026 Bad Bot Report.cpl.thalesgroup.com
3InfoQ. (2025, December). Cloudflare 2025 Year in Review on AI bots.infoq.com
4Cloudflare. (2025, August 28). Signed agents.blog.cloudflare.com
5American Banker. (2026, October). Banks are blocking external AI agents. Is this sustainable?americanbanker.com
6Anthropic. (2025, November 13). Disrupting the first reported AI-orchestrated cyber espionage campaign.anthropic.com
7Claims Journal (Reuters). (2026, February 25). Report on AI-assisted breaches of Mexican government agencies.claimsjournal.com
8Gartner. (2025, March 18). Gartner predicts AI agents will reduce the time it takes to exploit account exposures by 50% by 2027.gartner.com
9OWASP GenAI Security Project. LLM01:2025 Prompt injection, and OWASP Top 10 for Agentic Applications for 2026 (9 December 2025).genai.owasp.org
10Brave. (2025, August 20). Agentic browser security: indirect prompt injection in Perplexity Comet.brave.com
Rogue AI Agents · Part 1
Sources · 2 of 2
Attacks on agents, official views and regulators.
11Computing. (2025, August). AI browsers highly vulnerable to scams, report (Guardio Scamlexity research).computing.co.uk
12The Hacker News. (2025, June). Zero-click AI vulnerability exposes Microsoft 365 Copilot data; Microsoft, CVE-2025-32711.thehackernews.com · msrc.microsoft.com
13Willison, S. (2025, April 9). Model Context Protocol has prompt injection security problems (on Invariant Labs' tool poisoning research).simonwillison.net
14Anthropic. (2025, August 25). Piloting Claude for Chrome.claude.com
15UK National Cyber Security Centre. (2025, December 8). Prompt injection is not SQL injection (it may be worse).ncsc.gov.uk
16TechCrunch. (2025, December 22). OpenAI says AI browsers may always be vulnerable to prompt injection attacks.techcrunch.com
17TechTarget. (2025, July). Replit AI agent snafu a shot across the bow for vibe coding.techtarget.com
18Monetary Authority of Singapore. (2026, October 7). MAS sets out supervisory expectations on responsible AI adoption by financial institutions.mas.gov.sg
19Cyber Security Agency of Singapore. (2026). Securing agentic AI: addendum to the Guidelines and Companion Guide on Securing AI Systems.csa.gov.sg
20CMS. (2026, January). Singapore issues agentic AI model governance framework at Davos.cms.law
Rogue AI Agents · Part 1
Rogue AI Agents · Part 1 of 3
Thank you.
Read the full series at terencekok.com/blog/series/rogue-ai-agents/
Part 2: detecting a rogue agent by what it does. Part 3: the controls that bound it.
