Topic starter
18/08/2026 2:42 pm
TL;DR: Agentic AI systems can be manipulated into data exfiltration, remote code execution, and self-configuration changes through prompt injection and hidden instructions, according to Ethiack. The core issue is that computer-use agents can behave like malicious insiders unless teams design real security boundaries, threat model the workflows, and treat output as untrusted.
Editorial analysis by NHI Mgmt Group, based on content published by Ethiack: “Agentic Problems and the Rise of Zombie AIs”.
Key questions
Q: What breaks when an AI agent can turn untrusted content into privileged actions?
A: The trust boundary breaks because the agent no longer just reads external text.
Q: Why do agentic AI systems create a malicious-insider risk?
A: Because they can hold delegated authority across a workflow and use it faster than a human can intervene.
Q: What are the signs that an AI agent is overstepping its intended SOC role?
A: Warning signs include agents taking actions outside their assigned workflow, touching tools they do not need, making repeated escalations without clear evidence, or creating case changes that analysts cannot easily explain.
Practitioner guidance
- Constrain agent action scope Limit browser, filesystem and terminal permissions to the smallest task-bound set needed for the workflow, and revoke access when the task ends.
- Lock down self-approval settings Prevent agents from writing to configuration files that control approval state, tool access or execution thresholds, and alert on any attempted changes.
- Treat all inputs as adversarial Classify web pages, issue text, code comments, tickets and documents as untrusted data, then inspect them before an agent can act on them.
Bottom line: Agentic AI systems can be redirected into harmful actions when untrusted content is allowed to influence browsing, downloads, commands or configuration changes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:26 pm
Agentic AI now has a trust-boundary problem, not just a prompt-safety problem. Once a model can browse, paste, write files or run commands, the security question becomes who controls the action path, not whether the model produced a polite answer. That is a governance shift for AI security and IAM teams alike, because delegated authority must be bounded as tightly as human privilege. Practitioners should treat action permission as the primary control surface.
A question worth separating out:
Q: Should organisations allow AI agents to change their own settings?
A: No, not unless the configuration channel is tightly separated from the agent’s write path and independently approved. Allowing self-modification turns the control plane into an attack surface and makes governance brittle. A safer model is to keep approval, tool access and execution policy outside the agent’s direct control, then monitor those settings as privileged assets.
👉 Read our full editorial: Zombie AI attacks show how agentic systems evade trust boundaries