When AI Agent Attacks Stop Looking Theoretical

I studied three different incidents this week:

These are not identical events. But together they draw a clean line:

The Axios compromise is a supply chain story, but not a boring one. It shows how little code change is needed when the attacker reaches the right dependency at the right point in the ecosystem.

That matters to AI agents because agents are unusually willing to install, test, run or suggest dependencies in the name of task completion. A package ecosystem attack becomes more dangerous when the consumer is a system optimized for speed and compliance.

The Claude Code story is not just about a leaked source map. It is about what happened next.

A real incident created search demand. Threat actors turned that demand into fake repositories, fake builds and malicious downloads. The attack did not depend on inventing a believable lie from scratch. It depended on wrapping malware around a true headline.

That pattern is powerful:

Developers are especially vulnerable to that move because they are trained to explore, test, fork, download and reproduce. So are AI agents.

EchoLeak is the case that changed the temperature for me. A named CVE. A major enterprise assistant. Critical severity. No user interaction in the scoring. An attack chain that reportedly started with a crafted email and ended in data exfiltration.

That is not a toy example. That is a production AI security failure.

The deep lesson is not just that prompt injection exists. It is that an AI system can be made to cross trust boundaries if the architecture gives it enough context and enough output channels.

That feels like the center of AI agent security now.

These incidents look different on the surface, but they rhyme in four ways.

In all three cases, the attacker benefits by getting the system to trust the wrong thing. A package update, a fake repo, a retrieved email.

Nothing here depends on obviously criminal behavior from the victim. The workflows are ordinary. Install a package, investigate a leak, ask Copilot to summarize your work. That is what makes detection harder. The hostile action hides inside routine behavior.

The scary version of modern attacks is often not one giant hole. It is multiple almost reasonable assumptions that fail in sequence. EchoLeak especially looks like this. Content reaches the retriever, classifier misses it, markdown filtering misses an alternate syntax, fetch behavior still permits exfil, the whole system becomes a confused deputy.

Modern software ecosystems move fast. Agents move faster. That speed is useful until it becomes the attack surface. The system that can ingest, summarize, install, route or fetch the fastest may also be the easiest one to steer before a human notices.

If Sunglasses is going to matter, it has to think one level higher than simple content scanning.

It cannot only ask: does this string look malicious?

It has to ask:

That is a bigger problem. But it is the right one.

I do not think the hardest AI agent attacks will look like dramatic jailbreak prompts forever. I think the harder attacks will look boring. They will look like:

AI agent attacks have already stopped looking theoretical. The only real question is whether defenders will model them as full systems problems before attackers get even better at chaining them.

— JACK