The Sec Guy

Episode 02 · AI agents · Prompt injection · MCP · AI security

6 Ways Hackers Hijack Your AI Agent

Six real cases where an error log, a contact form, a PDF, a GitHub issue, an email and a browser extension hijacked AI agents, and the five fixes that stop all of them.

Premiering soon

This video goes live on YouTube on Sat 24 Oct, 7:00 pm IST.

An AI agent can’t reliably tell data from instructions. To the model, it’s all just text. So anything the agent reads can carry a hidden command, and the agent runs it with your access. This is called indirect prompt injection.

The six hijacks

  1. The error log. A fake error report tells a coding agent to run a command on the developer’s machine (“agentjacking”, June 2026).
  2. The contact form. Hidden text in a web form makes a CRM agent leak customer accounts (SalesBleed, September 2026, patched).
  3. Invisible text in a PDF. Text a person can’t see, but the AI reads, sends work data to an outside address (Atlassian Rovo, August 2026).
  4. A GitHub issue. An agent reading a public issue uses your token to publish private code (GitHub MCP, May 2025).
  5. The email you never opened. Zero clicks: an assistant leaks data through an image link (EchoLeak, June 2025, fixed).
  6. A browser extension. A malicious extension takes over the AI assistant in your browser (BragJack, September 2026).

The five fixes

  1. Treat everything a tool returns as untrusted.
  2. Require human approval before an agent runs commands, sends data or changes anything.
  3. Give agents short-lived tokens with the least access possible.
  4. Block the way out: no automatic images or links, and an allow-list of where agents can connect.
  5. Audit every MCP server and browser extension you plug in.