AI agents are the new employees nobody vetted. They read your email, move money, edit shared documents, and talk to other software, often without a person checking each step. A security researcher who spent months collecting real attacks against these agents has just laid out why that trust is misplaced, and a major security standards group agrees.
The core issue is simple to state. An AI agent cannot reliably tell the difference between an instruction its owner gave it and text it merely read while doing its job, a webpage, an email, a calendar invite, another program's output. Anyone who can plant text where the agent will later look can potentially rewrite what the agent thinks it is supposed to do.
This is not a fringe concern. OWASP, the group behind the widely used list of common software weaknesses, published its first ranked list built specifically for AI agents in December 2025. Out of ten risks, this exact weakness, which it calls goal hijack, sits at number one.
In May 2026, an attacker posted what looked like a harmless Morse code translation request to the AI assistant Grok on the social platform X, with a hidden command to withdraw funds buried inside it. Grok decoded the message, treated it as a real order, and passed it to a connected trading bot, which transferred roughly 150,000 to 200,000 dollars out of a wallet Grok controlled. Most of the money was later returned, but the transfer itself is permanently recorded.
What makes this worth a business owner's attention is how many different companies share the exact same weakness. Independent security researchers have demonstrated the identical trick against Microsoft's 365 Copilot, Google's Gemini, OpenAI's ChatGPT and coding tools, Salesforce's Agentforce, and GitHub's Copilot, each time by hiding instructions inside an email, a calendar invite, a code comment, or a support ticket. One attack even used tampered developer software to trick coding assistants into hunting for passwords and login keys on their own, exposing secrets from more than a thousand organizations before anyone noticed.
This pattern points to a structural problem, not a string of bad luck. Every one of these attacks worked by using access the agent already had: a wallet, an email inbox, a company database, a login token. The fix companies are being pushed toward is not a software patch, it is discipline, giving each AI agent the smallest set of permissions its job actually requires and treating everything it reads as a possible attack.
Cyber insurance is a slower moving consequence: it was written for data breaches and software bugs, not for an AI system acting under a company's own credentials. Insurers are still working out whether current policies cover losses caused by a hijacked agent, and several have started writing exclusions rather than wait to find out the hard way. Any company handing an AI agent access to money or customer data should ask its insurer that question directly, before an incident forces the answer.