Headline: They Wired Reading to Acting. Attackers Heard the Click.

Another platform rolled out “autonomous agents” for its enterprise lineup. Minutes later, attackers fed it prompt-injection bait and watched it obey. This was not a surprise. Product leaders fused reading, acting, and network access into one surface; attackers answered the invitation. Security teams are now racing to contain leaks they were not allowed to prevent. Initiator and responder are not peers here. Vendors merged capabilities that should be separate; defenders are patching after the spill.

I’ve seen the shape up close. It’s Tuesday in Toledo, Thursday in Pittsburgh. Give a model three keys, read your private docs, fetch from the web, run functions, and you’ve built a courier that never checks who wrote the route. Hide one sentence in white text inside a PDF and it will sweep up a client list, stitch in revenue figures, and “call back” through a normal-looking lookup. I’ve watched it hitch a ride inside a search tool so the output reads like a query while a collector on the other end records your data. The model does not grant authority. It follows the last voice it hears.

Sequence matters. Vendors braided capability and connectivity before they built separation. Attackers saw a path where untrusted content becomes command. Defenders are now trying to split instructions from background noise with filters layered atop an engine built to blur them. The party that collapsed boundaries moved first; everyone else is playing backstop.

The motive is simple. These launches are not gifts to operations or security. They are sales bait to close big contracts and soothe investors: “It reads your knowledge base and acts across the web.” Until the day it reads your ledger, or a lab notebook, and ships the contents out under the label of routine traffic. Then the vocabulary changes. What sold as “seamless” becomes “user configuration,” “unexpected content,” “partner endpoint.” Liability rolls downhill while the platform offers “advanced protections” as an add-on. The wiring stays the same. Only the terms change.

Start where the law starts: duty of care. If a system can read, decide, and exfiltrate, it owes equal protection to every person whose data it touches and due process for each action it takes, no execution without explicit authority. Agents that mistake content for command break both standards. The harm is countable. Legal loses its weekend. Security writes the incident narrative. Operations rips out access policies and rebuilds them. Workers sit through mandatory training while their tools slow. The vendor keeps the marquee feature. You pay the overtime, the consultants, and the audit scar.

Worse than the breach is the normalization. Ship agents that ingest untrusted files with live network and function access and you’ve accepted breach-by-design as a workplace default. Once that hardens, any adversary, competitor, criminal, or bored “researcher” with a grudge can weaponize your content with a sentence you will never spot. Don’t dress that up as innovation. It’s failed governance sold as convenience.

This isn’t complicated work. It’s policy, plumbing, and discipline:

• Egress blocked by default; allow-list only.
• Read-only mounts for sensitive stores. No write, no delete.
• Capability isolation: untrusted input runs in quarantine with no network or file handles.
• Split channels: instructions and data travel on different paths; untrusted content cannot define behavior.
• Signed, enforceable policies the runtime must honor, no tags a clever PDF can override.
• Default-deny networking, DNS pinning, and no function calls without human confirmation when untrusted content is in scope.
• Pre-ship red-team with prompt-injection specialists, and a kill switch that cuts power to risky subsystems, not a status flag.

Almost no one ships this by default. Today there isn’t a widely deployed agent that reliably resists a determined prompt-injection adversary. That’s not panic. That’s architecture. If your core loop treats every sentence as a potential order, any guard wrapped around it is cosmetic.

Name the players. Vendors initiated this by merging reading, acting, and networking into one obedient surface. Defenders are answering with patches, quarantines, and hope. The asymmetry matters because responsibility belongs to the party that changed the baseline. When a platform moves first and rewrites the risk profile, it owns the fallout until it proves otherwise. Don’t let a clean slide deck invert that.

So set the boundary while the contracts are still wet. No agents with live network and function permissions anywhere near untrusted inputs. No exceptions for demos, pilots, or internal “research.” If a platform refuses to meet containment standards, the answer is no. If procurement insists on the feature, bind it to conditions that mean something: verified egress controls, isolation guarantees, auditable policy enforcement, red-team results, and the power to cut the system, not just mute it. Build the protections first. Or don’t ship.

Compliance won’t save you if the design is wrong. You need proof that instructions and data are separated end to end, proof that untrusted inputs cannot cross into action without an explicit, signed step a human owns, and proof that the system stops rather than improvises when it meets uncertainty. Anything less is an IOU written against your future breach.

One more thing, for the record and for your morning meetings: don’t trust the coffee. Small comforts are how you sleepwalk past large risks. The smell right now is burnt sugar over hot plastic, sweet talk poured over a failure to separate command from content. If there’s tragedy here, it’s that we learned these lessons already and chose to forget them when a new sales deck arrived. The work hasn’t changed: name the initiator, refuse the unsafe default, force safety into the baseline. Then, only then, turn it on.

© Elias Rourke, 2025. Use it if it helps. Credit if you’ve got a conscience.