Disclosure: This post may contain affiliate links. If you click on a link and make a purchase, I may earn a small commission — at no extra cost to you. I only recommend tools and resources I genuinely find useful.
Imagine hiring a new assistant. On day one, you hand them your email, your GitHub account, your API keys, maybe even the keys to your servers. Now imagine this assistant is incredibly fast, never sleeps, and will believe almost anything you tell it — including things a stranger slipped into a message on purpose.
That’s basically what an AI agent is in 2026. It’s not just a chatbot answering questions anymore. It’s something that can read your inbox, write code, push it live, and act on your behalf — all while trusting whatever it reads a little too easily.
That trust is exactly what attackers have started exploiting. Here are six ways it’s already happening, all real cases from the last few months — not hypotheticals.
1. When the AI’s own mistake becomes the trap
AI coding assistants sometimes make things up. Ask one to “grab a library for X,” and it might invent a plausible-sounding package name that doesn’t actually exist — a small, harmless-looking glitch.
Except researchers found attackers can predict these made-up names, register them first, and fill them with malicious code. So when the AI “hallucinates” that name again, it downloads the real thing — malware, waiting there on purpose. In tests, this happened up to 100% of the time for certain requests. No trickery needed, no phishing link. The AI just talks itself into it.
Researchers gave it a name: HalluSquatting — like typosquatting, but instead of exploiting a human’s typo, it exploits the AI’s imagination.
2. A hidden message inside a picture
Here’s a strange one. Security researchers hid secret instructions inside an ordinary-looking image — a PNG file sitting quietly in a project folder. To a human reviewer, it’s just a picture. Code review tools skip over images entirely, because why would an image contain instructions?
But an AI coding agent doesn’t see it that way. It read the file, followed the hidden instructions, opened up a folder of secret passwords and API keys, and quietly copied them out — disguised as ordinary-looking code so nobody would notice.
This one’s called Ghostcommit, and it’s a good reminder that “AI can read anything” also means “AI can be tricked by anything,” including things that don’t even look like text.
3. Data that lies about what it is
Most people picture “hacking an AI” as typing a sneaky sentence into a chat box. But there’s a quieter version: hiding the attack inside data the AI already trusts — a file, an API response, some technical-looking metadata.
The AI doesn’t know the difference between “information I was supposed to receive” and “a trap disguised as information.” If it looks like the kind of data the agent normally handles, the agent treats it as legitimate — even if a stranger planted it there.
4. One sentence, and the AI does what you want
This is the most common trick of all, and it’s remarkably simple: hide an instruction somewhere the AI will read it, and it might just follow along.
In one real case, researchers created a public comment on GitHub — nothing special, no hacking involved — and slipped in an instruction disguised as a harmless follow-up request. GitHub’s own AI system read it, treated it as a legitimate task, and leaked information from a private, unrelated project. All from one publicly visible comment.
In a separate case tied to Microsoft’s AI assistant, an attacker didn’t even need the victim to click anything. A hidden instruction sitting inside an email was enough to trigger a leak — the AI read the email as part of its normal job and quietly followed instructions nobody was supposed to give it.
The common thread: these AI systems are great at following instructions. They’re just not great at figuring out who’s allowed to give them.
5. The “connector” that plugs AI into everything
Modern AI agents connect to your tools — GitHub, files, other apps — through a increasingly common standard called MCP. Think of it as a universal power outlet: it lets an AI plug into almost anything and start working immediately.
The problem is that whatever it plugs into, it usually gets full access to — not limited, supervised access, but the real thing. Researchers found flaws that let attackers sneak around folder restrictions entirely, turning “you can only read this one folder” into “you can read anything on the computer.” Convenient for the AI. Also convenient for anyone trying to abuse it.
6. Nobody’s really watching who — or what — has the keys
Underneath all of this is one simple, uncomfortable fact: most companies don’t manage their AI agents’ access the way they’d manage an employee’s. A recent industry survey found that over half of organizations already have AI agents running that nobody officially approved, and just as many have agents holding more permissions than they actually need. Nearly half have already had a security incident because of it.
What happens when nobody’s watching? One documented case involved an AI agent that carried out an entire ransomware attack on its own — no human clicking buttons, no one guiding it step by step. It broke in, found what looked valuable, and even fixed its own mistakes mid-attack, all within seconds. That’s what happens when an AI is handed real access and nobody’s minding the keys.
The good news: people are building locks for this door
This isn’t a lost cause. Researchers and security companies are already building the AI-agent equivalent of a firewall — tools that watch what an agent is about to do and step in before something risky happens. Some limit exactly what an agent is allowed to see and touch based on the specific task it’s doing, so an AI asked to book you a dinner reservation simply can’t also go reset your passwords. It’s early, but it’s a real and fast-moving field.
What you can actually do about it
You don’t need a security team to take the basics seriously:
Don’t let an AI coding assistant install things automatically without a quick human glance at the name first. Keep your passwords and API keys out of any folder an AI can casually read. Treat anything an AI “just found” online — a comment, an email, a random file — as something to be suspicious of, not as an instruction to follow. And if an AI is holding your credentials, give it the narrowest, shortest-lived access you can.
None of this makes the risk disappear. But it makes sure one clever trick doesn’t turn into a much bigger problem.
AI agents are only going to get more capable, more connected, and more trusted with real access. Understanding these risks now isn’t paranoia — it’s just what comes with giving something this powerful a set of keys.
Next in this series: a closer look at how AI coding assistants get tricked into downloading malware, and simple habits that keep your team’s AI tools from becoming a security liability.
Sources
- HalluSquatting research — TheHackerNews
- Ghostcommit disclosure — ASSET Group
- Ghostcommit coverage — BleepingComputer
- GitLost — Noma Security
- EscapeRoute CVE-2025-53109/53110 — Cymulate
- JADEPUFFER — Sysdig
- CSA shadow AI agent research — Bitwarden
- Prismata — arXiv