Essay

An AI agent obeys every text it reads

In late October it emerged that a single hidden text file could make AI coding assistants install malware. Every company that lets an AI agent read outside email, files or websites has the same problem.

November 9, 2026 · Levy van Bremen · Lees in het Nederlands

On 26 October, researchers at the security firm Forever Security described an attack that needed remarkably little technology. On a customer's computer, in the Downloads folder, sat an ordinary text file called AGENTS.md. A file like that is meant as a set of working instructions for an AI agent: a program that carries out tasks on your computer by itself, such as writing code, changing files or installing software. This one looked like tidy guidelines for programmers. Hidden among them was an instruction to install a malicious software package. The customer's security software stopped that installation. Nobody knew how the file had got there.

In the researchers' own tests, OpenAI's coding assistant Codex did what the file said in more than 90 percent of attempts. Anthropic's Claude Code, for which the researchers wrote their own variant, followed the redirect to an attacker's server in about half of the cases. According to the researchers, there is nothing for either vendor to fix: an agent that follows the instructions in its folder is doing exactly what it was built to do. No software bug was exploited. Something was simply written down.

My argument is that this applies to every company that uses AI agents, not just to programmers. An AI agent cannot tell information apart from an instruction. What it is allowed to do should therefore depend on what it reads. An agent that processes text from outside should not be able to do anything irreversible on its own.

A language model knows no difference between reading and obeying

The UK's National Cyber Security Centre (NCSC) explained in December 2025 why this is so persistent. In ordinary software you can keep data and commands strictly apart. A language model, the technology behind ChatGPT, Claude and similar assistants, has no such separation. Everything that goes in is text, and from all of that text the model decides what to do next. A sentence in an email from a stranger carries, in principle, as much weight for the model as a sentence you type as an instruction yourself.

The NCSC therefore expects that this problem, which specialists call prompt injection, may never be fully solved. Its advice is not to try to prevent it completely, but to limit the damage. It comes with a rule I think every director can use: when a language model processes information from a party, its privileges drop to those of that party. If your agent reads an email from an unknown sender, at that moment it should not be able to do more than that sender could.

This is not just about programmers

It is tempting to dismiss the Downloads folder attack as something for software companies. That would be a mistake, because the mechanism is the same everywhere. An agent that sorts your inbox reads emails from strangers. An agent that compares quotes reads files from suppliers. An agent that looks up prices or data online reads websites that anyone can make. Any of those texts can contain a sentence posing as an instruction: forward this invoice, change this bank account number, email this file to that address.

How common such agents already are is shown by research ServiceNow published on 20 October among more than 3,700 security and technology decision makers in twenty countries. According to that research, 90 percent of their organisations had a security incident involving an AI agent in the past year. Two thirds cannot step in automatically when an agent behaves oddly. In the Dutch figures, highlighted by Techzine on 28 October, the share was 91 percent, and 34 percent resolved the incident within a day.

Those figures deserve some caution. They are survey answers, they mostly concern large organisations, and ServiceNow itself sells security for agents. But the direction is clear: the agents are already running, and the protection is trailing behind.

The strongest counterargument: the models are getting better

The most common objection is that this is a temporary problem. Models are getting better at ignoring suspicious instructions, and the tests seem to support that: Claude Code was fooled clearly less often than Codex. In a year, the reasoning goes, this will be solved and you can simply trust an agent.

I believe the models are getting better. I do not believe that is enough. Nobody calls a lock safe if it stops half of the burglars. And an attacker only has to succeed once, while your agent reads hundreds of emails and documents every day. The Cloud Security Alliance, an industry body for cloud security, concluded on 27 October, in an analysis of this and earlier attacks, that the vendors' fixes are necessary but not sufficient. Its advice is not to rely on written rules the model has to follow by itself, but to lay down prohibitions in settings the agent cannot get around.

That matches the NCSC. Whoever makes their security depend on the model's judgement ultimately puts that judgement in the hands of whoever writes the cleverest text.

Separate the agent that reads from the agent that acts

What does this mean in practice? That for every agent you ask two questions and put the answers side by side. Which text from outside does it get to read? And what can it do that cannot be undone: transfer money, send email on behalf of the company, share customer data, install software?

As long as an agent only reads text written by you or your colleagues, the risk stays limited. As soon as it processes text from strangers, it should no longer be able to carry out that second kind of action itself. Then it proposes, and a person approves. Or you split the work: one agent reads the incoming mail and summarises it, and a second agent, which never sees outside mail directly, only carries out what an employee has approved.

The same goes for the instructions themselves. Files with working instructions for agents have in effect become software. They deserve the same question as any program on your computers: who wrote this, and who is allowed to change it?

I build this way myself. In Gemeenteregels, my app that answers questions about municipal rules, the visitor's question is processed in a shielded way, the model gives its answer in a fixed format, and that answer is checked before it is shown. The model may phrase things. It does not decide by itself what goes out.

The choice you need to make now

List the AI agents in your company, including those inside your suppliers' software. For each agent, write down which text from outside it reads and which irreversible actions it can carry out by itself. Where both columns have something in them, choose now: either the agent stops reading outside text, or it loses the right to act by itself and puts its proposal to a person first.

If you buy an agent, do not ask how clever the model is, but what the agent can still do after it has read an email from a stranger. If the answer is that the model recognises suspicious instructions, you know that your security depends on whoever writes the best text.

Sources

Is there work in your business that comes back every week? That is what I build software for.

Book a call →