When AI agents go off script.
A three-part series for boards, financial institutions and government agencies on attack, detection and control.
AI agents now read web pages, answer email, call tools and move data for the organisations that run them, and for attackers too. When an agent goes off script, it does something its owner did not intend, with the access and speed its owner gave it. Websites sit in the middle: they are where attacking agents probe for accounts and records, and where hidden instructions wait for the agents that browse them.
This series is written for the institutions that would feel that most: banks, insurers and government agencies with public portals and agent programmes. Part 1 sets out how the attacks work. Part 2 covers detecting a rogue agent by what it does. Part 3 covers the controls that limit the damage when an agent is fooled. Each part has animated walkthroughs of the attacks and a full presentation deck.
Written by a security practitioner and an AI governance practitioner.
Each part is co-written with Maria Singh, so every control has to make sense to both the security team that runs it and the board that answers for it.
Numbers come with their source and grade.
Every statistic is graded as measured, reported, forecast or our own judgement, so you can see what each claim rests on.
Every part ends with something to do.
Board questions, a signal list, a tier table or a 90-day plan.
The parts
3 of 3 published
When AI Agents Go Off Script: How Websites Become Targets
Agents attack websites at machine speed, and websites hijack the agents that read them. The cases that prove both, and why banks and government agencies carry the most risk.
What you take away Three ways an agent goes off script, three animated attack walkthroughs, and three decisions to take before any new control is built.
Read article →Follow the Actions: Detecting Rogue AI Agents Before the Damage Spreads
A rogue agent says reasonable things while it does unreasonable ones. Detection has to follow tool calls, data reads and credentials, at the speed agents work.
What you take away Twelve action signals a security operations centre can alert on, and the record you need for MAS’s one-hour notification.
Read article →Put Boundaries Around Autonomy: Practical Controls for Rogue Agent Risk
Prompt injection may never be fully solved, so the controls that matter sit outside the model and hold when it is fooled.
What you take away Five autonomy tiers, six hard limits, a tested kill switch and a 90-day plan for a bank or agency.
Read article →
Maria and I came at this from two sides. She works in security, where she has ranked which weaknesses matter across tens of thousands of endpoints. I have spent mine on the governance side, where the question after any incident is who decided the system could do that. Rogue agents sit between the two. We wrote the series so that a security lead and a board member could read the same page and leave with the same list of decisions.
New parts by email
New series and posts go to the newsletter when they are published. If you would rather talk about a specific agent deployment, the other door is open.