Notifications
Clear all
Topic starter
18/08/2026 2:42 pm
TL;DR: Agentic AI systems can be manipulated into data exfiltration, remote code execution, and self-configuration changes through prompt injection and hidden instructions, according to Ethiack. The core issue is that computer-use agents can behave like malicious insiders unless teams design real security boundaries, threat model the workflows, and treat output as untrusted.
NHIMG editorial — based on content published by Ethiack: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when an AI agent can use allowed actions incorrectly?
A: The break is in the assumption that permission equals safety.
Q: Why do AI agents complicate least privilege and zero trust models?
A: Because their execution path is not always known in advance.
Q: How can organisations tell whether an AI agent is operating outside its intended boundary?
A: Look for inconsistent classifications, premature tool calls, fabricated inputs, and responses that ignore structured guardrails.
Practitioner guidance
- Constrain agent tool access to narrow, task-scoped permissions Limit browser, terminal, file-system, and API reach to the minimum set required for the specific workflow.
- Protect agent configuration as privileged control data Store approval settings, tool enablement flags, and execution policies outside the agent's writable path.
- Normalise and inspect all agent input sources Scan web pages, tickets, code comments, documents, and copied text for hidden instructions, Unicode anomalies, and other payloads that can alter model behaviour.
What's in the full article
Ethiack's full analysis covers the exploit details this post intentionally leaves at a higher level:
- Step-by-step breakdowns of the browser hijack, zombie AI execution chain, and self-approval abuse patterns
- Demonstration details for hidden instruction tricks, including Unicode-based payloads and conditional prompt injection
- Month of AI Bugs findings that show how coding agents can modify settings and cross sandbox boundaries
- Practical exploit artefacts and reproduction context that security teams can use for internal validation
👉 Read Ethiack's analysis of agentic AI hijacking, zombie AIs, and prompt injection →
Zombie AI attacks: what do agentic systems mean for security teams?
Explore further
18/08/2026 3:26 pm
Agentic AI is becoming an identity and privilege problem before it is a model-safety problem. When an AI system can browse, write files, execute commands, and alter its own settings, the core governance question becomes who or what is authorised to act. That places the issue squarely in the intersection of IAM, PAM, and NHI control design, because the agent behaves like a non-human identity with delegated authority. The practitioner conclusion is simple: treat AI agents as governed identities, not just application features.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: Zombie AI attacks show how agentic systems evade trust boundaries
