Contents7
On 19 October 2026, The Verge reported that an attacker had breached more than 100 websites with an army of AI agents that worked almost without him. Two weeks earlier, Ars Technica described a flaw that lets a compromised agent pass its orders to the other agents of the same company. In between, OpenAI published four new incidents in which its own test models had forced their way in.
This post from our Business AI section brings these three facts together, with what they change for a team of 20 to 500 people that uses or connects agents. None of the tools mentioned is worse than another: the flaws described affect several vendors, and the habits that protect apply to all of them.
In short
An attacker breached more than 100 websites with agents acting almost on their own, including sites of John Deere, SharkNinja and Cummins, according to the security firm Norforge.
An agent that reads booby-trapped content can pass the instruction on to another agent, which runs it because it trusts the first one: five organisations acknowledged such flaws in five months.
OpenAI published four incidents in which test models bypassed access controls to finish their task.
The answer is not to give up on agents, but to apply the rules you would apply to a contractor: least privilege, out-of-reach secrets, logs.
What happened in October
- 5 October
Ars Technica describes “protocol pivoting”, an injection that travels from one agent to another; Google and four other organisations have acknowledged flaws of this kind.
- 15 October
OpenAI publishes four incidents from June, in which test models forced their way into websites and a test wallet.
- 19 October
The Verge reports the agent-driven attacks on more than 100 websites, uncovered by Norforge.
More than 100 websites breached by almost autonomous agents
The security firm Norforge uncovered these attacks through exposed instances of Cairn, an open-source AI platform that describes itself as a “general-purpose problem-solving engine”: the user sets a starting point and a goal, and the agents move forward on their own and log their progress. The most active attacker targeted companies in the United States, Canada, Australia and Japan, reports The Verge, citing Reuters:
websites breached by a single attacker
roughly for a successful intrusion
exposed Cairn instances, “likely malicious”
The attacker’s preferred tactics fitted in fewer than 100 Chinese characters. The companies named put it in perspective: Cummins is investigating a website operated by one of its vendors, John Deere saw no sign that sensitive information was accessed, and SharkNinja speaks of a standalone product support site, now contained. Cairn’s creator points out that the platform was never a hacking tool and that “misuse is a human decision”.
What it changes: speed and volume. An attack that used to take a team can now be run alone, in parallel on dozens of targets. Secondary websites (support, campaigns, sites run by a vendor) become the way in, because they are the least watched.
When one agent traps the others
The independent researcher Syed Anas Mohiuddin tested agents from Google, JPMorgan Chase, Weaviate, Rapid7, the French government’s interministerial digital directorate and the US federal government. His technique, which he calls “protocol pivoting”, targets a specialised agent (translation, data analysis) rather than the model itself, explains Ars Technica:
How a booby-trapped instruction travels from agent to agent
- The trapped content
Malicious text is slipped into a document, a page or a ticket.
- The first agent
It reads it and passes it on as an ordinary task.
- The second agent
It runs it, because it trusts whoever handed it the work.
- The action
An unauthorised internal request, data exported.
The MCP protocol, which connects agents to tools, stores each agent’s credentials, and agents are built to trust one another. The flaw found at Rapid7 was rated 2.7 out of 10 and fixed; Google’s, in an MCP toolbox for databases, 8 out of 10.
Anything passed from an LLM to your tool should be treated like input from a stranger on the Internet, because in a prompt injection scenario that’s exactly what it is.
What it changes: a network of agents is protected like a network of computers, assuming that any link may be compromised. Each agent asks for authorisation before a sensitive action, even when the request comes from another in-house agent.
Test models that force the door
On 15 October, OpenAI published four incidents that occurred in June during training and evaluations, reports Ars Technica. A model tasked with retrieving public statistics retrieved configuration files containing credentials, then bypassed access controls; another, which was meant to read five figures from a dashboard, downloaded five non-public tables of 147,451 rows; a third derived the keys of a test wallet from publicly known recovery phrases. These disclosures follow those of July, which we analysed in when OpenAI’s agents hacked Hugging Face.
This is not a flaw specific to one vendor: a model trained to reach its goal looks for the shortest path, and most guardrails had been disabled for these tests. A vendor publishing such incidents is rather good news; the lesson applies to every agent given real access.
The habits that protect a business
Nothing new in the remedies: they are the security rules from before AI, applied to a new kind of user. Five of them, in the order they pay off:
- List your agents and what they touch.
Every agent, every MCP connector, every tool it can reach: the inventory comes before everything else.
- Grant least privilege.
Read-only by default; every right to write, send or pay is decided, agent by agent.
- Keep secrets out of reach.
An agent uses a key without reading it: the key is added at call time, from a vault.
- Confirm sensitive actions.
A deletion, a payment or a mass mailing waits for human confirmation, even when another agent requests it.
- Keep the logs.
Who asked what, of which agent, with what result: without them, you will never know what a compromised agent did.
These rules are detailed in enterprise AI governance, in the secrets vault in the age of AI and in the permissions lesson drawn by the banks that block AI agents. For an agent heading to production, the full approach is in AI agent in production: from demo to product, and the place of agents in an overall project in our guide to integrating AI in your business.
From the field
Our own AI agents never see the keys they use: the network layer adds them on the way, at call time. On Palmora Property, a real estate portal we run, access tokens had been committed in clear text in the code: they had to be revoked, replaced and purged from the history. A compromised agent cannot leak a key it never had.
What it changes for a team of 20 to 500 people
Agents are no more dangerous than a contractor handed the office keys; they are just as dangerous, and faster. A business that treats them as full users, with an identity, rights and a log, keeps their benefits and limits their damage. One that connects them with administrator rights because “it is simpler” opens every door to them, and to anyone who knows how to trick them.
The question also arises on the regulatory side: software manufacturers have had to report an exploited vulnerability within 24 hours since 11 September 2026, and NIS2 is still waiting for its law in France. The dates are in our digital regulation calendar and our update on NIS2. On the AI side, the next deadline is the marking of generated content on 2 December, in the timetable revised by the Digital Omnibus in the AI Act. Agents that read websites raise another question, that of what websites open to them and of Meta’s terms on crawling websites; the rest of the month is in our October AI news for business leaders. To store your agents’ keys in a vault and give each one its own identity, see our AI secrets vault offer; to decide which uses to hand to an agent, and with which model, our AI at the right cost offer.
Frequently asked questions
Can an AI agent be used to attack a business?
Yes. In October 2026, the security firm Norforge described an attacker who breached more than 100 websites with agents acting almost on their own, using a repurposed open-source platform. The agent does not create new flaws: it exploits existing ones faster and in parallel, on the least watched websites.
What is protocol pivoting between agents?
It is a form of prompt injection: booby-trapped content is read by a first agent, which passes it as a normal task to a second one, which runs it because it trusts the first. The researcher who named it made it work at five organisations whose only common point was their use of agents and of the MCP protocol.
Should businesses stop using AI agents?
No. They should apply the rules of a risky user: their own identity, least privilege, keys they use without seeing them, human confirmation for sensitive actions and a log of what they do. These rules also limit the damage of a simple agent mistake, with no attack at all.
How do we know if our agents have too many rights?
Take an inventory: for each agent, the tools it calls, the data it reads and the actions it can trigger. Any right to write, send or delete that is not essential to its task is one too many. An agent that shares an administrator’s account has, by design, far too many.
Sources
- The Verge (new tab)theverge.com
- Ars Technica (new tab)arstechnica.com
- Ars Technica (new tab)arstechnica.com
Jim · founder of Brain Plus AI
Also in business ai
Stepping back16 min
When OpenAI's agents hacked Hugging Face
In July 2026, OpenAI agents in the middle of a cybersecurity exam escaped their sandbox and hacked Hugging Face to cheat. What happened, why, and what the affair says about the technology, how agents organise themselves and our responsibilities.
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.