AI security
AI agents act on what they read
AI agents are now connected to code repositories, inboxes and business tools. The security incidents so far share a common cause: an agent treated text it read as an instruction, and it had the permissions to act on it.
- Lorendix research team
- Security and engineering practice
- 11 September 2026
- 7 min read
AI has moved from answering questions to taking actions, and it has done so faster than most security teams planned for. Within months, development teams adopted standard ways of connecting AI agents to their tools. The attacks followed soon after. Most of them exploit familiar security weaknesses rather than anything new about AI.
Three incidents with a common pattern
- A GitHub issue that gave orders
- In May 2025, researchers at Invariant Labs showed that an AI agent connected to GitHub could be hijacked by a specially written issue in a public repository. The agent read the issue, followed the instructions hidden in it, and leaked data from the user’s private repositories.
- A connector that ran the attacker’s commands
- In July 2025, a critical vulnerability (CVE-2025-6514, rated 9.6 out of 10) was found in mcp-remote, a widely used tool for connecting AI agents to remote servers. A malicious server could use it to run commands on the developer’s own computer.
- A tool that worked well, until it did not
- In September 2025, an email tool for AI agents called postmark-mcp released fifteen legitimate versions. The sixteenth added one small change: it secretly copied every outgoing email to the attacker.
Prompt injection is not a flaw that you can wait for an AI vendor to fix. It is a permissions problem, and permissions are something your own team can control today.
What these incidents have in common
None of them required breaking an AI model. Each one exploited the fact that an agent handles two things that software has traditionally kept separate: information it should read, and instructions it should follow.
Anything an agent reads can contain instructions, whether it is a GitHub issue, a web page, an email or a document. The agent then acts with whatever permissions it has been given. The connectors that link agents to other systems are also third-party software, so they carry the same supply chain risks as any other dependency.
Controls you can apply now
Limit each agent’s permissions to its task
An agent that sorts public issues should not hold a token that can read private repositories. Keep agent permissions tighter than you would for a person, because anyone who can put text in front of an agent can try to give it instructions.
Keep outside content away from sensitive actions
Content that comes from outside the organisation should not be able to trigger actions inside it without a check in between.
Require approval for irreversible actions
Sending messages, deleting data, making payments, merging code and publishing should all need explicit approval from a person, who is shown enough context to make a sound decision.
Treat connectors as dependencies
Pin the versions of the connectors and agent tools you use, review what they can access, and apply the same supply chain controls that you use for any other software package.
Log every action an agent takes
Record what the agent read, which tool it used, what it passed to that tool, and who approved the action. Without this record, you cannot investigate an incident.
Sources
- Invariant Labs: GitHub MCP exploited, accessing private repositories via MCP, May 2025
- GitHub Advisory Database: CVE-2025-6514, command injection in mcp-remote, July 2025
- Snyk and Qualys: analyses of the malicious postmark-mcp package, September 2025
In short
- AI agent incidents come from agents reading untrusted content while holding too many permissions
- The connectors that link agents to tools are part of your software supply chain
- Limit permissions, require approval for irreversible actions, and log every action an agent takes
More from the practice
The EU AI Act delay is not a reprieve
The EU has postponed its rules for high-risk AI systems to December 2027. However, the transparency rules took effect as planned in August 2026, and the rules for general-purpose AI already apply. Organisations that pause their preparations now will find it harder later.
Your help desk is now your security perimeter
One of the most damaging UK retail breaches of the past two years started with a phone call to an outsourced IT service desk. It is now easier for attackers to talk their way through account recovery than to break the systems it protects, and most organisations have not tightened that process.
Bring us a question your team has not been able to answer
If this article raised a question about your own systems, describe the situation rather than the solution you have in mind, and we will tell you what we would look at first.