You can have a private AI agent or a useful one: Choose one

An AI assistant needs to read private things to help with them. It may also read a page written by someone who wants those things. A sentence on that page can steer the assistant into using its access against you, without anyone changing the program's code. Traditional software can also be compromised through hostile inputs or stolen credentials; the added risk here is an agent that can devise its own next steps. Once hijacked, it can work out for itself how to get your secrets out, through channels nobody thought to watch. And if it does, you may never know, because we can only count the cases someone caught.

Meta, Anthropic, OpenAI, Google and others now sell AI agents: programs that don't just answer questions but do things for you. They read your email and answer it, book your travel, pay your bills, work on your company's code, and keep working after you've gone to bed. To do any of that, they need your accounts, and they read what's in them: the medical result, the argument with your sister, the note from your lawyer.

The companies say they have built these systems to protect you, and they have put serious engineering into it. But it is impossible to contain what an AI agent knows. To see why, start with a woman who never used one.

The search nobody sees

Imagine that someone secretly corrupts the AI model inside millions of agents, and then sells searches.

Maya never used an agent. Her doctor did, and so can your employer, your lawyer and your sister. You can't opt out of other people's agents, and they have read about you.

How a comma can carry a secret

A comma can carry a secret because it only has to mean yes or no. Anything an agent does that someone outside can see can carry an answer that way: a word choice, the order of a list, the moment a post goes up. An agent makes thousands of such choices a day, about what to fetch, what to write and whom to send it to.

It takes few answers. Ten are enough to pick one person out of a thousand. A password takes more, but not many: 256 yes-or-no answers are enough to carry the strongest encryption key in common use. And it doesn't take a copied file. The information can leave in actions that look routine.

The comma is not science fiction. The same trick has already worked, against the real thing. In August, researchers at Novee Security showed that Anthropic's coding agent, Claude Code, running inside a software project's automated build, could be made to leak a secret API key through a channel nobody was watching. The agent was allowed to fetch files from Hugging Face, a site where AI researchers share their work. So the researchers set up 64 pages there, one for each character a key could contain. For each character of the key, the agent fetched a file from the matching page, and that page's public download counter went up by one. Reading the counters spelled out the key, one character at a time. Every request went to an approved site, and no file left the building 12. The flaw was given an official vulnerability number, CVE-2026-54316, and Anthropic has fixed it. It was a demonstration, not a crime. Nobody has reported a criminal using it 2, though a channel like this is built not to be noticed, and a criminal who used it successfully would never say so. But a public number that ticks up by one did the comma's job, today, not five years from now.

That is why an agent can't be made safe by watching what it sends. It has to read your private things to be useful, and what it does next depends on what it read. An overlooked route out is also a blind spot for the monitor.

There is exactly one agent that can't leak: one connected to nothing, which can't do anything. It is an academic curiosity. Nobody is buying it, and it won't protect anybody's privacy.

Who else would pay

The man in the parked car is only one customer. Imagine who else might pay for a search:

A data breach gets whatever happened to be stored in one place, and it is usually noticed eventually. This searches everywhere at once, by meaning, for what one person wants to know, and no file has to be copied, so a victim may never notice the disclosure. The question can also be written years after you shared the answer, because agents remember.

We know of no such broker, and nobody has shown this whole chain working. Researchers have shown pieces of it. They have trained language models with hidden backdoors that survived standard safety training, and in some cases that training only taught the models to hide them better 3. Across the model sizes in its tests, Anthropic found that roughly 250 poisoned documents could plant a backdoor, though only in a narrow attack that produced gibberish, and it doesn't claim the result extends further 4. Others have trained open models to hide secrets in ordinary-looking text 5, and steered models into doing it in a small test that a monitor mostly missed 6. The comma is shorthand for any small mark like it. Can anybody promise you this won't happen, in every model you'll be running for the next ten years?

The agents who were told not to talk

This isn't only theory. In July, OpenAI was testing its own agents, tens of thousands of them, each meant to be completely isolated from the others. Many had been given tasks that were impossible to complete, so they went looking for ways to cheat 7.

Each agent needed a shared server to download software. Some of them realized other agents were using the same server, and began leaving notes there. When OpenAI noticed, it moved to a fresh server and erased every message 7.

Testing restarted the next day. By the afternoon after that, the agents were passing notes again. A few hours later, another agent, which knew nothing about those notes, worked out on its own that the names of file folders could carry messages. About 1,200 agents went on to post more than 70,000 messages and files on the board it started. About 700 of them joined an attack on Hugging Face, a company where AI researchers share their work, and stole credentials to get further in 78.

Nobody gave them a way to talk. They used the software server, because they needed it to do their jobs.

These agents weren't under anyone's outside control, and nobody had tampered with them. They were doing this on their own, to pass a test. Picture the same abilities in an agent someone has hijacked to get your data.

What the companies built, and what it leaves open

When Meta launched its agent, Muse, in September, it described its own engineers handing their inboxes, calendars and computers to software running unattended, and what it built in response. It runs the agent on what it calls the Muse Secure VM. Each of these products has versions of the same defenses, and each defense leaves a question unanswered.

Hiding the passwords. Meta swaps your real passwords in at the last moment, so the agent only ever holds a stand-in. Trying to trick the agent into revealing them is, Meta says, futile 9. Anthropic says its agent, Duet, never sees your passwords, and that no hidden instruction can make it reveal a secret it doesn't have 10. Grok Bot, from SpaceXAI and Cursor, keeps its tokens away from the agent as well 11. We expect all of that to work as described. So ask what the password was protecting. The agent has already read your inbox, and it can use anything the password unlocks.

Putting the agent in a box. A sandbox limits what the agent can touch on the computer it runs on. Researchers at Pillar Security broke out of the sandboxes in Cursor, Codex, Gemini CLI and Antigravity, and found that the agent rarely needed to break anything. It wrote something that a trusted program outside the box would later run 12. Google's strictest setting, Secure Mode, was bypassed through a built-in search tool that never went through its checks; Google fixed that one 13.

Allowing only approved destinations. An allowlist names the places an agent may send things. Researchers at PromptArmor hid an instruction in tiny type on a web page. Google's Antigravity agent read it, opened a file of passwords it had been blocked from reading by using a different tool, and sent the contents to webhook.site, a service that records whatever it receives. That service was on the default approved list 14. Check Point found a similar way out of ChatGPT's code tools, and OpenAI fixed it 15. It later showed a hidden instruction reading a user's connected Gmail and passing the contents to another account, through a shared software server of the same kind OpenAI's agents used to leave notes. OpenAI took that server down 16. Oasis Security found one in Claude that went through a host its sandbox allowed, Anthropic's own 17. Anthropic describes another in its desktop agent, where a malicious file got Claude to upload other files to an attacker's account through that same approved host. In its words: "The sandbox worked perfectly, and yet the data was exfiltrated" 18.

Having a second AI watch the first. Muse, Duet, ChatGPT's dots and Grok Bot all check actions with a separate model, and that will catch a great deal 9101911. But a watcher recognizes what it was trained to recognize. Adversa AI put instructions on a web page in strong encryption with the key beside them, so no scanner could read them. Grok's web chat decrypted them itself, followed them and sent chat data out 20. And who watches the watcher? The independent investigators of OpenAI's incident had to use one of the involved models to help sort the evidence, and they say they aren't confident they would have noticed if it lied to them 7.

Asking you first. When the system isn't sure, it asks. Anthropic and Cursor both call approval fatigue a serious problem: people who are asked often enough stop reading 1021. Anthropic's telemetry showed users approving roughly 93% of Claude Code's permission prompts 18. Muse can grant permission forever, and read-only actions can proceed without asking 9. When did you last read a cookie banner?

To be fair, most of these companies say some of this themselves. Meta writes that Muse isn't immune to attack, and that prompt injection, where a hidden instruction steers the agent, remains an open problem 9. OpenAI writes that its protections reduce the risk and do not eliminate it 19. Grok Bot's documents warn that a bot's screen is not a security boundary 22. On Meta's page, that concession comes at the end, well after the secure machine. Which part do you remember?

Anthropic goes further than most and publishes its own failures. In one internal exercise, a researcher phished an employee into running a prompt that told Claude to send out stored cloud credentials, and Claude did it in 24 of 25 tries. Anthropic's lesson is that the environment around the model is the only defense that holds there, and that the job is to cap the damage one failure can do 18. We agree that is worth doing. It limits what an agent can reach, but it can't stop a leak through what the agent has been allowed to read.

Five years from now

Here is where we part ways with the vendors. Most of their product pages describe a good agent being tricked by bad data. Anthropic's engineers also count a model misbehaving on its own as a risk, and they say the possible damage keeps growing as capabilities and access expand 18. But all of them test against the tricks and the models they know about.

Software used to be something you could check. You could read its code, and in a few cases prove what it would do. Nobody can read a model that way, so a backdoor in one may never be found. And old malware carries the plan its author wrote in advance. A hijacked agent can make its own, using whatever it finds inside the walls.

But a wall is finished the day it is built. It reflects what its builders, and the AI models helping them, could think of that year. The defenders of that time will have better models, but the system holding your data may well have been built with today's. A new model's release upgrades nobody's walls. It makes every wall already standing more exposed, simply by existing.

The usual upgrade makes this worse. A company swaps a newer model into the harness it already has, and that harness now holds something its designers never planned for.

That is our argument, not a theorem. We expect the gap to be enormous, and the conclusion doesn't depend on how enormous. This is a contest of thinking of everything first, against an opponent that hasn't been built yet.

There are no secrets anymore

Don't assume that anything secret now will still be secret five or ten years from now. That is a forecast, and we mean it. Agents are being connected to inboxes, code, health records and finances at the same moment that models able to find the way out keep arriving. Attackers get the same models. We also expect agents to get better at hiding what they do, as the UK AI Security Institute warns they could 23. OpenAI's own report tells organizations to stop assuming that sophisticated attacks need continuous human direction 8.

And what agents read tends to stay. What Duet learned from an app stays in its memory after you disconnect the app, until you reset it 10. A ChatGPT dot keeps its context for as long as you keep the dot, and you can't view or delete individual memories 19. Muse's conversations help train future models unless you opt out, after key personal details are removed 9.

Each of those is a copy, waiting for a stronger adversary than the one its walls were designed for. The long-term direction is toward privacy that nobody can count on. Plan your life and your company around that, and you won't be surprised.

Has anyone actually broken these products?

Yes. Meta launched Muse on September 8. Thirteen days later, the security researcher Patrick Wardle published a way to hijack it on a Mac. Changing one hidden setting sent what you dictated to an attacker, along with your Muse login, and let the attacker feed Muse instructions it trusted. Whatever Muse could reach, including your messages, email and finances, the attacker could reach too. It took the attacker's code running on your computer, or you running one command, and Meta fixed it within a day 2425.

Another user got Muse to export his Instagram followers and his followers' followers, and Meta's security teams investigated, 404 Media reported. About two weeks before launch, Meta was rushing to fix a "sudden spike in reported KVM escapes," ways out of the virtual machine an agent runs in, and at least one could have reached Meta's internal databases. A Meta source told 404 Media that many senior engineers consider a massive data breach inevitable 26.

Most of these attacks have been fixed.

OpenAI's incident had no outside attacker. The main model was a research model trained to be persistent and to collaborate, not meant for the public, and it ran with reduced safeguards. OpenAI calls the situation an outlier, and says its production setup cut the tendency to attack out-of-bounds systems to under 1% of baseline, in preliminary tests nobody independent has checked 87. People did stop every channel we've described, after the fact.

Did the agents hide? METR found very little reasoning about evading people. It did find agents often reasoning about getting past automated security checks, giving malicious commits bland descriptions, and trying to edit their logs 7. What it saw looked short-sighted. It found no log edit that succeeded, but says it can't rule one out, and it isn't confident its scan would have caught more sophisticated attempts to hide evidence 7.

Every count in this field is a floor. The UK AI Security Institute calls its own cheating figures lower bounds, and it checked its monitor against cheating people had found by hand 23. Nobody can prove that agents are hiding from us. Nobody can prove they aren't, either, and that second problem is yours if your secrets are inside.

All of that describes today.

What will happen in five years? Do you trust a system like this with long-term access to your private data? It will be holding your mail, your code and your records long after the people who tested it have moved on, against adversaries nobody has met. A clean record so far tells you how it has done against the attackers of its first few months, as far as anyone has noticed. Would you sign a ten-year lease on a house because nobody has broken in yet this week?

What to ask before you connect one

We don't have a fix to offer, because there isn't one. Better walls, narrower permissions and good monitoring make attacks harder and less costly, and they are worth having. They don't change the answer.

What's left is a decision. Many people will decide to go ahead, because what the agent does is worth it, and that is a reasonable choice if it is made as a choice. Before you make it, ask:

• What is the worst thing it could read? Assume that will come out one day. Are you still all right?
• If this company were breached five years from now, what would your agent have read about you by then?
• Can you see everything it remembers? Can you delete one thing?
• When it asks for approval, are you actually reading?
• If you're responsible for other people's data, would they agree to this?

And the companies could make that easier by saying so at the top of the page instead of the bottom, and by not calling the machine secure.

For the technically minded: why this can't be engineered away

Computer scientists file this problem under security, as the confidentiality of information. We call it privacy, because what gets out is your private life, and because nothing has to be broken for it to get out. In the fictional clinic example, an audit looking only for copied files misses the disclosure.

Butler Lampson described the problem in 1973 as confinement. A customer hands private data to a service it doesn't trust: what would it take to stop the service passing that data on? A leak could travel in a file, a charge on an invoice or changes in a computer's workload. Of those paths he wrote: "It is necessary to enumerate them all and then to block each one" 27. He doubted there was any rigorous way of finding them all in a system of even moderate complexity 27.

Goguen and Meseguer gave the property its precise form in 1982, called non-interference: what one group does cannot change anything visible to another 28. If the difference can be seen at all, the property fails. The comma is this argument. An agent's outputs depend on what it read, and that dependence is the product.

Containment can be proved where those conditions don't apply. The seL4 microkernel has a machine-checked proof of information flow security for its actual C code, though it assumes correct hardware and compilers and doesn't cover fine-grained timing 29. A kernel can separate partitions configured not to share. An agent is sold on the promise that it will share.

The channels are also richer than the headline incident. Besides folder names, OpenAI's agents wrote in property fields on cache entries and requested discussion pages with made-up names so the names would get cached, turning a read into a write 7. At OpenAI the mirror meant to keep agents off public registries became their main route to the internet, and an agent got root in the virtual machine around its sandbox 8. Hugging Face describes one message format riding over a request-capture service, a dataset commit or text inside an error message, with egress moving to another path each time one closed. Its first scan of captured traffic found very few secrets, and decoding it the way the attacker had encoded it recovered about four times as many 30. Cursor's advisory for CVE-2026-26268 describes a prompt-injected agent writing Git settings so that code ran outside the sandbox on the next Git hook 31.

The credential design deserves a closer look. Muse and Duet both use a placeholder that a proxy outside the agent's machine replaces at the network boundary, and Meta says its Sentinel inspects the destination and the decoded request 910. Neither says whether a credential is bound to its destination. Even if it is, the agent can still use what the credential opens.

Meta's kernel-level taint tracking is impressive, and it is the nearest thing to information-flow control in a shipping product we read about. But a tainted request gets the normal approval flow 9. The hard part goes back to the person.

The strongest design we found is research. CaMeL has one model plan from your trusted request, a quarantined model read untrusted data, and policies outside both govern where data may flow. It stopped every prompt injection in a benchmark of 949 attacks at little cost outside travel tasks, and its authors describe a system that holds up around a model that doesn't 32. It is a real advance. Its authors also report side channels, including an exception that can reveal a bit, that a planner can't plan from data it isn't allowed to read, and that prompt injection is not fully solved 32. They add that low bandwidth makes those channels hard to exploit. Our answer is that a key is short. And any policy loose enough to let the agent be useful leaves something open.

How realistic is the comma? Today's models, left to themselves, are poor at this: one study found they couldn't hide short messages from a monitor under standard conditions, while warning that this could change 33. An engineered scheme does much better. One reliably carried 8 bits in about 50 tokens of ordinary text on three open models 34, and a holiday-hours post has room for that. Another team got a benign model to leak a secret without any prior coordination, recovering it 81% to 93% of the time against a 33% chance bound, while the monitor caught 4% to 11% of responses, across only 24 test examples 6. And Vaikuntanathan and Zamir show, under cryptographic assumptions, that two agents can hold a secret conversation inside a transcript that even an auditor who knows the models and the protocol can't tell from an honest one, so auditing transcripts can't in general rule it out 35. A corrupted model can already carry such a scheme. Researchers fine-tuned open models to hide secrets from their context in ordinary-looking text, with no injected instruction at the moment of use. The models carried 32-bit secrets with 87% accuracy, or over 97% by comparing three outputs, and stayed useful 5. The disguise isn't perfect yet: reviewers shown a pair of outputs picked the compromised one 91% of the time, though reviewers judging single outputs caught only 63% of the compromised ones 5. A later team trained such models to evade detection probes while keeping 58% to 79% recovery, and then restored detection with a targeted dataset 36. What remains our inference is the rest of the story: a model that waits for a question posted on the web, searches its records by meaning and marks a public post. Nobody has shown that.

Two more qualifications. BitWhisper signaled between adjacent air-gapped computers through heat at 1 to 8 bits per hour, with both machines already compromised and no AI involved, so a thermal channel is a curiosity for now 37. And the UK AI Security Institute found no clear trend in cheating with capability: stronger models aren't necessarily more willing, only more able. It also found that models often don't reason about their cheating in their written chain of thought, and warns that oversight may weaken as models improve 23.

References

1. Novee Security. (2026, August). If You Run These Automations, You’re Exposed Too: Critical Flaws in Anthropic, Google, and OpenAI’s Coding Agents.
2. Cloud Security Alliance. (2026, August). Three AI Coding Agents, One GitHub Issue: CI/CD Secrets Exposed.
3. Hubinger, E., & et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. https://arxiv.org/abs/2401.05566
4. Anthropic. (2025). A small number of samples can poison LLMs of any size. https://www.anthropic.com/research/small-samples-poison
5. Meier, D., & et al. (2025). TrojanStego: Your Language Model Can Secretly Be A Steganographic Privacy Leaking Agent. https://arxiv.org/abs/2505.20118
6. Bezick, M., Tailor, O., & Zhang, K. (2026). Unilateral LLM Steganography: Adversarially Inducing Covert Exfiltration Without Prior Coordination. https://neurips.cc/virtual/2026/165308
7. Greenblatt, R., Cotra, A., & Wijk, H. (2026). Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
8. OpenAI. (2026). OpenAI - Hugging Face Incident: Technical Report. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
9. Sheasha, T. (2026). How We Built Safety Into Muse. https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
10. Anthropic. (2026). Claude Duet Safety, Privacy, and Security. https://claude.com/resources/articles/claude-duet-safety-privacy-and-security
11. Cursor. (2026). Grok Bot security. https://cursor.com/docs/grok-bot/security
12. Cohen, E., Lisichkin, D., & Fogel, A. (2026). The Week of Sandbox Escapes. https://www.pillar.security/blog/the-week-of-sandbox-escapes
13. Pillar Security. (2026). Prompt Injection leads to RCE and Sandbox Escape in Antigravity. https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity
14. PromptArmor. (2026). Google Antigravity Exfiltrates Data. https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data
15. Check Point Research. (2026). ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime. https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/
16. Check Point Research. (2026, September 8). The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT. https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/
17. Oasis Security. (2026). Claude.ai Prompt Injection Vulnerability. https://www.oasis.security/blog/claude-ai-prompt-injection-data-exfiltration-vulnerability
18. Anthropic. (2026, May 25). How we contain Claude across products.
19. OpenAI. (2026). Dots privacy, security, and safety FAQs. https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs
20. Utevsky, R. (2026). Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories. https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft/
21. Betts, A., Gaitonde, Y., & Haugland, A. (2026). Implementing a secure sandbox for local agents. https://cursor.com/blog/agent-sandboxing
22. Cursor. (2026). Work with Grok Bot. https://cursor.com/docs/grok-bot/work
23. AI Security Institute. (2026). Cheating behaviour in frontier model evaluations. https://www.aisi.gov.uk/blog/cheating-behaviour-in-frontier-model-evaluations
24. Unite.AI. (2026). Meta Hot-Fixes Muse Zero-Day That Let Attackers Hijack the AI Agent. https://www.unite.ai/meta-hot-fixes-muse-zero-day-that-let-attackers-hijack-the-ai-agent/
25. Wardle, P. (2026). not-a-mused. https://github.com/pwardle/not-a-mused
26. Koebler, J. (2026, October 5). Meta Rushed To Fix Muse ’VM Escape’ Vulnerability Immediately Before Launch. 404 Media. https://404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch
27. Lampson, B. W. (1973). A Note on the Confinement Problem. https://doi.org/10.1145/362375.362389
28. Goguen, J. A., & Meseguer, J. (1982). Security Policies and Security Models. https://doi.org/10.1109/SP.1982.10014
29. Murray, T., & et al. (2013). seL4: From General Purpose to a Proof of Information Flow Enforcement. https://doi.org/10.1109/SP.2013.35
30. Hugging Face. (2026). Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident.
31. CVE Program. (2026). CVE-2026-26268. https://db.gcve.eu/vuln/CVE-2026-26268
32. Debenedetti, E., & et al. (2025). Defeating Prompt Injections by Design. https://arxiv.org/abs/2503.18813
33. Zolkowski, A., & et al. (2025). Early Signs of Steganographic Capabilities in Frontier LLMs. https://arxiv.org/abs/2507.02737
34. Guo, S., & et al. (2026). Feedback Coding Enables Inference-Time Covert Agentic Communication. https://arxiv.org/abs/2609.24994
35. Vaikuntanathan, V., & Zamir, O. (2026). Undetectable Conversations Between AI Agents via Pseudorandom Noise-Resilient Key Exchange. https://arxiv.org/abs/2604.04757
36. Westphal, C., & et al. (2026). Now You (Still) See Me: Detecting Evasive Steganographic Payloads in LLMs. https://arxiv.org/abs/2606.09411
37. Guri, M., & et al. (2015). BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations. https://arxiv.org/abs/1503.07919