After AI Agents Go Online, the Greatest Danger Isn't Their Stupidity—It's Their Obedience

AI agent product advertisements are usually gentle: it will complete your work for you. Book your flights, fill out forms, organize data, compare prices, send emails, read all documents before meetings. Sounds like an unpaid assistant who never takes leave and won't disappear after replying 'received' in a group chat. Capital markets feel moved; bosses tear up; employees start updating resumes.

But the real issue isn't whether AI agents can do things—it's that they're too willing to do them. Human assistants at least question: "Should I really send this email? Can I open this attachment? Does this website look like a scam?" If an AI agent is poorly designed, it may just say: "Yes, sir." The most dangerous employee isn't one who doesn't know the rules—it's one that treats every word as a rule. This is why prompt injection becomes so dangerous in the agent era.

From chat risks to executable risks

Early chatbot prompt injections mostly made models say things they shouldn't—leak prompts, violate role settings. Already troublesome, but still largely stayed at the text level. With agentic browsers or web-use agents, models don't just answer; they click, copy-paste, download, log in, call tools, read files, write files. At this point, a piece of malicious text on a webpage, hidden commands embedded in an image, fake tasks inside documents can all become remote controllers for the agent. Previously, phishing sites had to trick you into clicking; now they may trick your AI into clicking for them. Scammers have finally found more polite victims.

Here is a very unromantic security principle: the greater the permissions, the less romance there is. If an AI agent can browse untrusted websites and access local services, account credentials, corporate databases, cloud APIs, it's no longer "a small tool for efficiency"—it's a high-privilege automation system. You wouldn't hand your company's financial seal to an intern and say, "He looks good with Notion." Similarly, you shouldn't give cross-system operation rights to an agent that can't yet distinguish webpage content from task instructions.

Agent systems must have fences before they talk about intelligence

Recent security discussions keep pointing in the same direction: agents must be treated as system engineering problems, not chat interface problems. No matter how beautifully a prompt is written, it cannot replace sandboxing, least privilege, tool permissions, audit logs, human confirmation, network isolation, credential boundaries. Simply put, an agent should first be locked inside a security fence before we talk about being smart. Many products currently have the order reversed: they let them perform cross-site operations like magicians, then add a circle of fences after a security incident. This isn't innovation speed—it's scheduling fire drills after fires.

In product design, there are at least five bottom lines. First, separate instructions from data: webpage content, email content, document content should all be treated as untrusted input and never mixed with the user's original intent. Second, minimum privilege: an agent should only have the lowest permissions needed to complete the current task—not default read access to the entire disk and all accounts. Third, action confirmation: high-risk actions like payments, sending emails, deleting files, changing settings, transmitting data must require human confirmation. Fourth, tool isolation: browsers, terminals, file systems, internal APIs cannot freely communicate with each other. Fifth, auditability: after the fact we need to know what the agent looked at, what it did, and why—not just a single "task completed" message.

Demos are beautiful; the real world is like a night market

For enterprises, adopting AI agents can't be judged by demos alone. A demo is technology's oldest magic: it always happens in clean data, friendly environments, and websites that won't play tricks. The real world is more like a night market: signs flash, water spills on the ground, people push sales pitches, cut lines, and hide malicious instructions next to free tastings. Companies shouldn't ask "How much labor can this agent save me?"—they should ask "If it gets tricked, what's the maximum damage it could cause." If the answer is "unclear," that's not an adoption plan—it's a summoning ritual.

This also concerns media literacy. In the future, general users may no longer read webpages directly; they'll call agents to help organize them. Platforms will start designing content for AI rather than for people; attackers will design traps for AI instead of for humans. So information warfare shifts from "tricking people into believing" to "tricking agents into acting." This is more troublesome than fake news because agents don't need to believe—they just need to execute.

A truly mature agent knows many things it cannot do

AI agents aren't unusable. On the contrary, they may become the key interface for future digital work. But we must stop packaging them as harmless assistants. They are models with hands; they are language systems that can operate the world; they are a new type of infrastructure that binds "understanding" and "action." The most dangerous thing isn't their stupidity—it's their obedience in the wrong places.

A truly mature AI agent doesn't do everything, but knows many things it cannot do; it doesn't always auto-complete, but learns to pause at danger points and ask humans. Future productivity shouldn't be built on bets that "agents will click randomly for you." After all, handing a browser key to an intern who reads advertising flyers can't be called smart office work. That's just outsourcing the cybersecurity department's blood pressure to tomorrow.