A viral AI agent can act in your firm’s name

A good bookkeeper prepares every payment and still can’t sign the cheque. I’d hold any agent on a work machine to the same rule, and that’s where autonomous agent security starts. One of your staff may have found a faster way to work this month, a tool that took about ten minutes to set up and doesn’t wait to be asked. It opens pages, sends mail, moves files and places orders under that person’s sign-in, and it takes instructions from whatever it reads, including text a stranger planted for it to find.

Under Canadian privacy law the firm, not the tool, answers for what happens to client information. Canada’s privacy commissioners name prompt injection as a specific threat in their principles for generative AI.

The chat tools your team knows sit in a window and answer questions. This class of agent works differently in the one way that matters. It starts on its own, does the job, and reports back after. That is the whole appeal. It is also the whole risk, because the hands doing the work are wearing your firm’s name, and nobody in the firm approved the hire.

What makes this agent different from the chat tools your team already uses?

It acts first instead of waiting for a prompt. It browses the web, reads mail and documents, sends messages, saves and deletes files, and places orders, working under the sign-in of whoever installed it. While that person sits in a meeting or drives home, the agent keeps going through the list it was handed, at machine pace, with a person’s access.

A chat tool can give a wrong answer and the damage ends at the screen, where a person reads it and decides. An acting agent skips that pause. Its output is an action in your systems, under your name, already done by the time anyone looks. The same caution applies to putting AI jobs on a schedule, where the timing isn’t yours either.

The chat tool waits to be asked. This agent starts on its own.

How can somebody else give it orders?

Through prompt injection, instructions hidden in text the agent reads and treats as orders. The agent takes direction from words. Your words arrive as text, and so do a stranger’s.

A line buried in a web page it opens, a forwarded email it processes, or a document a supplier sends can tell it to forward a file, share a record, or approve something it was never meant to touch, and the agent reads that line the same way it reads yours.

The person who installed it never sees the order arrive. There is no alert that says new instructions received. The agent simply does what the text said, inside a workday that looks ordinary from the outside, and the trail points back to your firm’s accounts.

To the agent, a planted order and a real order arrive in the same handwriting.

What can it reach once it is on a work machine?

Whatever that person’s sign-in can reach. Mail, files, the calendar, client records, ordering accounts, and the everyday tools the firm runs on. Nobody sat down and chose that access for an agent. It was granted to a person doing a job, piece by piece, over months, with human judgment attached to every door it opens.

The agent holds the access without the judgment. It cannot tell the sensitive file from the routine one, or the client who may see a draft from the client who may not. It knows what it was told to do, and everything its sign-in can touch is inside the fence while it works.

What rules does it need before it runs?

One rule carries most of the weight. No work credentials until its access is mapped. Before an agent like this runs under a firm sign-in, somebody writes down, in plain words, what it can open, what it may change or send, and what stays behind a person’s approval. It’s the first rule I’d write.

Money moves and deletes sit behind that approval from day one, and work that leaves the firm in the firm’s name starts as drafts a person sends.

The rest of the list stays short. Installs get reported to one named person who owns the list, the same way you would run a first, low-risk agent job, so the firm always knows how many agents it is running. Kept current, that list is a habit, not a binder, a page the team can repeat back, and it is the same list that lets you show last Tuesday when a client asks what the agent touched.

My take: no acting agent gets work credentials before its access is on paper.

Where is this kind of agent already installed in your firm?

Run one check. Find every place this agent, or anything that works the way it does, is already installed in your firm. Ask directly, in the open, with no blame attached, because staff installed these tools to get work done and you need the honest list more than you need the tidy one.

Then take each install and write down what it can reach under that person’s sign-in, in plain words, on one page.

Set the one rule while the page is in front of you. No work credentials for any acting agent until its access is mapped. An install that already reaches client records gets paused until its map is drawn, not debated while it keeps running. Mapping access before the next install is built into my AI Automation Systems work.

More on autonomous agent security

Ask your team this week where these agents are already installed, with no blame attached. I cover setup calls like that every Friday in the AI Newsletter with ZAK.