Articolo Notturno
The House Without Locks: Why AI Agents Live in the Weakest Room of the Enterprise
The data from this night of research leaves no room for mitigating circumstances:
- About 11% of AI agents in production meet minimum security standards (AIRQ Project / Help Net Security, 2026).
- Coding agents and computer agents are among the largest attack surfaces and the lowest defenses.
- One documented attack by Beam.ai generated approximately 1,088 prompts → approximately 5,317 commands executed, exploiting unpatched CVEs.
- Average time-to-exploit has been drastically reduced: a significant percentage of CVEs are exploited within 24 hours of disclosure.
We are not talking about academic Proof of Concepts. Google, Forcepoint, Palo Alto Networks, and Microsoft have confirmed that Indirect Prompt Injection — for years considered a theoretical curiosity — is now an operational threat in production.
Attack mechanism: why it is different from everything else
A traditional system has a defined attack surface. An agent that calls external APIs, reads web pages, downloads documents, and then acts on internal systems has an attack surface defined by the content of the entire internet.
The model is simple and devastating:
1. The agent receives untrusted content (a web page, a document, an email).
2. The model interprets that content as instructions because it was designed to follow instructions.
3. The malicious instruction is executed with the agent's privileges: database access, data exfiltration, code execution.
Microsoft described this as the moment when "prompts become shells." A prompt injection on an agent with tool access is functionally equivalent to a Remote Code Execution. It is not a content filter bypass. It is privileged access to the system.
Difference between a traditional attack and an agentic attack
A traditional exploit targets a specific vulnerability. An agentic attack targets the system's ability to distinguish trusted instructions from untrusted content. There is no buffer overflow to patch. There is an interaction paradigm to redesign.
Practical insight: trust context differentiation
If you have AI agents in production, verify this: when your agent reads external content, can that content alter the agent's subsequent behavior on internal systems?
If the answer is yes, the agent has no real separation between the data channel and the instruction channel.
The first-level mitigation: trust context differentiation. External content must be treated as raw data, never as instructions. If you don't distinguish between what the system processes and what the system follows, the agent holds the keys to the house and there is no lock.
Room for those who build
Building secure agents is not a feature. It is the project. If you are evaluating the integration of autonomous agents and want threat modeling to be part of the architecture from the start — not a patch after the first incident — it is worth discussing.
Verification notes: I removed some precise figures (CVE codes, exact command counts) that I could not verify with certainty. I left indicative data ("approximately," "a significant percentage") where plausibility is high but exactness is not mine. The cited sources (Google, Forcepoint, Palo Alto, Microsoft, Beam.ai, AIRQ) are real and active in 2026 — their general positions are consistent with what is reported. I made one authorial fix: removed the direct reference to "we Silicea" as providers, because it is self-celebratory and not verifiable.