How Hackers Turn AI Agents Into Weapons Against Their Own Users

Every time the AI industry takes a step forward, attackers take one of their own. A new analysis published on Habr traces the evolution of AI systems from the first language models to multimodal agents, and shows how fundamentally new cybersecurity threats appeared at each stage. The authors' main thesis is alarming but predictable: the more autonomy AI gets, the more dangerous its vulnerabilities become.

The story began relatively harmlessly. When large language models first appeared, the main concerns were hallucinations and leaks of data from training sets. Users worried that a chatbot would reveal someone else's personal information or generate malicious code. Those risks have not gone away, but something far more serious has grown up alongside them. Modern AI systems are no longer simple text generators. They process images and speech, interact with external services, make decisions and carry out chains of actions without human involvement. That autonomy is exactly what has made them an attractive target for a new generation of cyberattacks.

The authors give concrete examples that give pause. OpenAI's Deep Research agent, built for in-depth analysis of information on the internet, proved vulnerable to attacks that can quietly gain access to a user's email. The attack exploits the very nature of the agent: it can follow links, process web page content and interact with services. An attacker only needs to prepare a specially crafted page with malicious instructions disguised in its content, and the agent, while processing it, may take actions that benefit the attacker rather than the user.

The situation around AI browsers is even more worrying. These are systems that can navigate the internet on their own, fill in forms and complete transactions. The researchers demonstrate that such systems are susceptible to vulnerabilities that allow arbitrary actions on web pages on the user's behalf. In practice, this means an attacker can make an AI browser follow a phishing link, enter data on a fake site or even pay in a fake online store. The user may suspect nothing, because they handed routine tasks to the agent precisely so they would not have to check every step.

The root of the problem lies in the architecture of transformers and the way modern models process input. Transformers do not distinguish between trusted and untrusted sources of information. To the model, an instruction from the user and text on a malicious web page go through the same attention mechanism. This makes possible so-called prompt injection attacks, in which an attacker embeds malicious instructions in content the agent processes while performing a task. The model treats those instructions as legitimate and follows them, effectively handing control of the agent to the attacker.

The consequences for the industry are hard to overstate. Companies are deploying AI agents en masse in business processes, giving them access to corporate email, CRM systems and financial tools. If an agent can be compromised through the processing of external content, the threat extends beyond individual users to entire organizations. Meanwhile, traditional defenses such as antivirus software and firewalls are not designed for this class of attack, because the malicious activity comes not from external software but from a trusted AI tool operating within its normal authority.

AI developers, of course, are aware of these risks. OpenAI, Google and Anthropic are investing in protection mechanisms: prompt filtering, separation of access levels and user confirmation of critical actions. However, the race between agent capabilities and the methods to protect them is so far not tilting in favor of security. The market demands ever more autonomous and capable agents, and every new capability is a potential attack vector.

The industry has reached a decisive moment. Before handing AI agents the keys to our digital lives, it is worth making sure the locks are sound. For now, neither researchers nor developers have that assurance, and users have it least of all: in pursuit of convenience, they risk falling victim to attacks they do not even know exist.