When agents act: the new attack surface

The piece everyone handing an agent tools should read. Willison’s "lethal trifecta": access to private data + exposure to untrusted content + the ability to communicate externally — together, one poisoned input is enough for an agent to exfiltrate data, with no classic software flaw involved. The core: an LLM cannot reliably separate an operator’s instruction from an injected one, and guardrails alone do not fix it. Which is exactly why the Hugging Face incident was structural, not a one-off.

When a discipline gets a Top 10, it has grown up. Over 100 experts sorted the agent-specific risks — from goal hijack (the agent pursuing the wrong objective) through tool misuse, identity and supply chain to rogue agents. Not an academic paper, a build checklist for anyone putting agents into production. For regulated industry, this is the list you audit a pilot against before it goes near real equipment.

The most concrete supply-chain attack of the year: when a developer deletes their Hugging Face account, the namespace frees up — and an attacker uploads a poisoned model under the trusted name. Pipelines that pull models by name alone (including on Azure AI Foundry and Vertex AI) then auto-import code execution; thousands of repos are exposed. The real lesson for me: "which model, from whom, verified how" is procurement and governance, not IT hygiene. Open source does not mean unchecked.

Finally the constructive side: Zero Trust applied to agents — cryptographic agent identity, permissions scoped per task rather than per role, sandboxing, deny-by-default. OWASP calls the extension "least agency": not just constraining what an agent can access, but what each tool may do, how often, and where. What stands out: none of it is newly invented — it is OT security discipline (segmentation, least privilege) applied to agents. That the principles come from a model vendor does not make them any less vendor-neutral.

The deepest point last, from the security authority: no AI system today has the integrity controls to be genuinely trustworthy. Schneier’s proposal — decouple the personal data stores from the model, so security can advance independently of model performance. Underneath sits the uncomfortable truth of the whole week: we are asking a probabilistic model to enforce deterministic access boundaries. That is the frontier — and exactly why trust is the real work, not the model.