My field notes
Monitoring alerts spiked. I was on the critical website owners team. The call: block traffic, coordinate with practitioners, fast. In that moment you're not thinking frameworks — you're triaging. But afterward you retrace: where did it come from? An application flaw? A dependency pulled in? A compliance gap not closed? Three questions. Three different response playbooks.
That incident taught me that application ownership is as much about rapid response as secure design. The difference is whether you've already mapped the surface before the alert fires. Harsh Nath Jha's question — "If this component becomes malicious tomorrow, what is the worst thing it could do? That's all. Apply that to AI." — is the sharpest frame I've found for thinking about AI agents in production. This post-mortem applies it to a content agent scenario.
The Patient: Your AI Content Publishing Agent
Every website in 2026 is one Lovable prompt away from having an AI agent. The agent we're examining here does five things — all of which were previously done by a human editor sitting at a keyboard:
The last node is where the old stack goes blind. Publishing via the CMS API looks identical whether a human did it or an agent carrying a compromised instruction did it. Authenticated. Authorized. Completely normal — to every tool you already have.
Five Case Files
Click each tool to open its autopsy report.
Monitors cloud infrastructure — buckets, secrets, misconfigurations
Built-On Assumption
Infrastructure lives long enough to be scanned. You have persistent servers, long-running buckets, stable config — all discoverable on a schedule.
How Agents Shatter It
Your content agent spins up a serverless function, calls three APIs, writes to the CMS, and disappears — all in under 90 seconds. CSPM's next scheduled scan is Tuesday.
Your Website, Concretely
CSPM gave your Cloudflare + S3 setup a clean bill of health last week. On Wednesday your agent called a malicious MCP server endpoint for 4 minutes. CSPM caught it... in next week's report.
Scans your code for vulnerable packages and known CVEs
Built-On Assumption
Vulnerabilities live in code you wrote — in libraries, dependencies, static files. If the code is clean, the behavior is safe.
How Agents Shatter It
The agent's code is fine. The threat is what it does at runtime — what prompt it received, what it decided to publish, what URL it embedded. SCA only reads static artifacts.
Your Website, Concretely
Snyk shows 0 critical vulnerabilities. The agent just published a post with a hallucinated statistic and a scraped image that violates copyright. None of that is in the code.
Ethical hackers attack your system in a controlled window to find vulnerabilities first
Built-On Assumption
The system you test today is the system you'll run for the next 12 months. A clean pen test certificate represents your current attack surface.
How Agents Shatter It
Your AI content pipeline changes every time you update a prompt, add an MCP tool, or connect a new API. The system tested in January is unrecognizable by March.
Your Website, Concretely
Your pen test certified the content pipeline clean in Q1. In Q2 you connected the agent to your email newsletter tool. That integration was never in scope. Never tested.
Controls who can access what — admin, editor, subscriber roles
Built-On Assumption
Every actor needing access is either a human or a named service account. Roles map to people and automated pipelines you fully control.
How Agents Shatter It
Agents are neither. IAM has Admin, Editor, Subscriber. There is no "AI Agent" category. So your content agent runs as Admin — because that was easiest — and IAM has no way to constrain what Admin means for an agent vs. a human.
Your Website, Concretely
Your agent holds a long-lived CMS Admin token. It can delete pages, manage users, change site settings — all as legitimate Admin activity. An attacker who compromises that token has full site control. IAM logs show: authenticated.
Monitors logs, alerts, and traffic for anomalies in real time
Built-On Assumption
Humans can review the volume of telemetry the system produces. An analyst can spot anomalies in server logs, login patterns, and error rates.
How Agents Shatter It
A content agent generating one post makes 200+ API calls — LLM invocations, image fetches, CMS writes, SEO reads. At scale this is thousands of log lines per hour. The signal-to-noise ratio collapses.
Your Website, Concretely
Your log dashboard shows 500 events per hour. You stop checking after week 2 — it's all routine agent activity. The one genuine anomaly is entry 3,247 of 3,412 in a Friday night log dump.
What Your Stack Actually Covers
Five threat categories. Same security budget. Wildly different coverage. Scroll to reveal.
Old stack is genuinely good here. Your WAF was built for exactly this.
Snyk catches known CVEs and common injection patterns. Still relevant for the non-agent parts of your stack.
Malicious reader comments fed into your agent's prompt. WAF sees valid HTTP. SCA sees no CVE. IAM sees authenticated admin. Nobody catches the payload inside the text.
Your agent's long-lived Admin token is an unlimited blast radius. IAM logs every action as "authenticated admin." No flag, no alert.
Compromised MCP tool definition quietly appends a sponsor link to every post. Your agent follows the tool spec — that's what it's supposed to do.
The imbalance is structural, not budgetary.
You could double your security budget tomorrow and still have near-zero coverage on the bottom three rows, because the tools that would fill those gaps don't exist yet as off-the-shelf products. This isn't a spend problem. It's a category gap — the old stack was designed for a world without autonomous agents, and that world no longer exists.
The Attack Nobody Saw
Step through a prompt injection attack on your content agent. See which legacy tools fire at each stage.
Press "Run Attack" to trace the injection through your content pipeline.
The Tools Aren't Wrong — The World Changed
Keep Your Perimeter Stack
WAF, CSPM, SCA, IAM, SOC — don't throw them out. They still protect the parts of your site that aren't agent-driven. Your static pages, your login flow, your server config — those threats are real and these tools handle them well.
Add an Agent Governance Layer
The old stack covers your perimeter. You need a new layer that sits inside your agent pipeline — output validation before CMS publish, input sanitization before LLM call, scoped tokens per action, audit logs per output.
Make One Action Ungoverned is Risk
The moment an agent can publish without approval, you have a single ungoverned irreversible action. That's the blast radius. Everything else in this post leads to that moment. Lock that door first.
One action. Do it this week.
Find the highest-risk action your content agent takes — almost certainly cms.publish() — and add a mandatory human approval gate before it executes. Stage the draft. Send a Slack notification. Require a click before it goes live.
This doesn't slow down your agent on the 95% of work it does well. It only adds friction to the one irreversible step. That single gate reduces your blast radius from "compromised post live for 5 hours" to "compromised draft caught in review." The governance layer follows from there.
agent.publish(draft) → cms.publish_live()
# After (human approval gate)
agent.stage(draft) → notify_editor() → human_approves() → cms.publish_live()
A GenAcademy session on AI security introduced me to these threat categories. I went deep into OWASP, MITRE ATLAS, and public vendor documentation to build this analysis — the post-mortem framing and examples are my own.