Briefing 02 · AI agents · Prompt injection · MCP · AI security
6 Ways Hackers Hijack Your AI Agent
Six real cases where an error log, a contact form, a PDF, a GitHub issue, an email and a browser extension hijacked AI agents, and the five fixes that stop all of them.
An AI agent can’t reliably tell data from instructions. To the model, it’s all just text. So anything the agent reads can carry a hidden command, and the agent runs it with your access. This is called indirect prompt injection.
The six hijacks
- The error log. A fake error report tells a coding agent to run a command on the developer’s machine (“agentjacking”, June 2026).
- The contact form. Hidden text in a web form makes a CRM agent leak customer accounts (SalesBleed, September 2026, patched).
- Invisible text in a PDF. Text a person can’t see, but the AI reads, sends work data to an outside address (Atlassian Rovo, August 2026).
- A GitHub issue. An agent reading a public issue uses your token to publish private code (GitHub MCP, May 2025).
- The email you never opened. Zero clicks: an assistant leaks data through an image link (EchoLeak, June 2025, fixed).
- A browser extension. A malicious extension takes over the AI assistant in your browser (BragJack, September 2026).
The five fixes
- Treat everything a tool returns as untrusted.
- Require human approval before an agent runs commands, sends data or changes anything.
- Give agents short-lived tokens with the least access possible.
- Block the way out: no automatic images or links, and an allow-list of where agents can connect.
- Audit every MCP server and browser extension you plug in.