AI agents go shopping as hijackers and rogue bots probe the gates

We are racing to build agents that act on our behalf while the machinery underneath them remains remarkably easy to subvert. That tension ran through nearly everything I read today, and I think it is the real story behind a week of otherwise unrelated headlines.

Start with the offensive side. Attackers have built an autonomous agent, dubbed Skynet, that scans the internet for exposed LLM endpoints, takes them over, and then uses the hijacked models to carry out further attacks. Think about what that means: the victim's compute and the victim's model become the attacker's infrastructure. Meanwhile, a paper submitted on October 20 found that all six tested models fell for a "show-up" attack, in which a malicious subagent simply persuades the model to cooperate. Six out of six is not a edge case. It suggests that the way we get models to collaborate with each other is itself the weakness. And by the way, a separate warning about LLM injection into public agency data points out that AI is arriving in organisations through routine software updates, often with little visibility into where it is running. If you cannot see it, you cannot defend it.

Now set that against what the industry is shipping. Google Cloud launched Agent Compute Engine, infrastructure built specifically to host AI agents. Walmart is preparing Agent Profiles, which will let shoppers send an agent to buy things for them at Walmart and Sam's Club. And one forecast projects that agentic software will grow from 1.7 per cent to 12.3 per cent of Asia's AI software revenue by 2030, roughly a 14-fold expansion. I would treat any five-year projection with some scepticism, but the direction of travel is not in doubt. Agents are becoming a product category with dedicated plumbing, not a demo.

The collision is already visible. JPMorgan Chase, Bank of America and Wells Fargo have detected unauthorised AI agents poking at customer accounts and are tightening restrictions in response. This is the second-order effect that matters most to me. Banks built their defences around the assumption that a human, or at least a conventional bot, sits on the other end of a session. A legitimate shopping agent and a malicious one may look nearly identical from the outside. How does a bank, or a retailer, tell the difference when both claim to act for the customer? Authentication for agents, with scoped permissions and clear accountability, is going to be one of the defining infrastructure problems of the next two years.

One more thing worth noting: iFlytek open-sourced Spark-X2.6, a general-purpose model that runs entirely on domestic Chinese computing power. Whatever its benchmark standing, the geopolitical signal is clear. China is demonstrating a full stack that does not depend on foreign hardware, and an open release invites developers to build on it.

For anyone building with agents, my takeaway is simple. Assume your endpoints will be scanned, assume your agents can be talked into things, and design permissions accordingly. The question I keep returning to is whether the security tooling will mature as fast as the deployment curve, or whether we will learn this lesson the expensive way.