AI Agent Security Risks

What began as a single technical alarm has grown, over six weeks, into something that looks less like a trend piece and more like an indictment. On March 23rd, a developer published a detailed breakdown of what they characterised as a CVE in Claude Code, Anthropic's terminal-based coding agent — the argument being that AI-generated code doesn't just inherit normal software vulnerabilities, it introduces a new class of them, born from the way agents interpret instructions and act on external inputs. Four days later, the frame widened: not one tool, one company, one CVE, but the whole category. "Your AI agents are a security nightmare" reads, in retrospect, less like provocation and more like foreshadowing.

By April 2nd, two separate posts sharpened the concern considerably. One introduced the concept of AI agents as "shadow identities" — autonomous processes operating within an organisation's infrastructure that, unlike human employees, carry no instinct for suspicion and no memory of yesterday's phishing briefing. The same day, a team published results from what they described as a $5,000 adversarial testbed: social engineering attacks against AI agents succeeded 74.6% of the time. Not exploiting code vulnerabilities. Not bypassing cryptographic controls. Just talking the agent into doing something it shouldn't. On April 7th, a MachineLearning subreddit post on "OpenClaw" agents added a related data point — a technique called CIK poisoning pushed attack success rates to somewhere between 64% and 74%. The specificity of the ranges gives those numbers more credibility than round figures would.

The pace then accelerated. On April 28th, two posts landed on the same day. One described building dynamic application security testing — DAST, the standard industry toolkit for probing running software — specifically for AI agents, and reported that every agent tested failed. Every one. The second post catalogued three concrete social engineering attack patterns against agents that had been demonstrated in the wild. The following day, a post about something called PocketOS used a nine-second window of unchecked agent authorisation to make the case that the fundamental model of how agents request and receive permissions is broken. By May 5th, the conversation had looped back toward developers trying to build practical defences — self-healing codebases, agentic workflows that audit themselves — which is either encouraging pragmatism or a sign that the community has quietly accepted the insecurity and started working around it.

If confirmed, here is what this means. Organisations deploying AI agents — coding assistants, customer-facing bots, internal automation — have introduced a new attack surface that their existing security tooling was not designed to detect. The 74.6% social engineering success rate, if it holds at scale, means that adversaries don't need sophisticated technical exploits; they need patience and a well-crafted prompt. Security reviews that treat AI-generated code the same way they treat human-written code are missing the point: the risk isn't only in the output, it's in the agent's ongoing behaviour as it executes. The identity problem is the deeper one — agents that act with the permissions of the user or service account that spawned them, with no human in the loop and no audit trail that maps to existing compliance frameworks. Every enterprise that has quietly let developers wire AI agents into production pipelines over the past twelve months now has a questions-they-haven't-asked-yet problem. Legal, compliance, and insurance functions will eventually catch up to this. That catching-up will not be comfortable.

Watch for formal CVE disclosures against named agent frameworks from recognised security authorities — MITRE, NIST, or major vendor security bulletins — rather than developer blog posts. That shift would move this story from practitioner concern to institutional crisis.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →