Your AI Agent Doesn’t Have MFA

Every Cybersecurity Awareness Month campaign rests on four habits:

• Strong passwords,
• Multifactor authentication,
• Spotting phishing,
• and keeping software updated.

All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training.

The National Cybersecurity Alliance’s theme this year is “Don’t Make It Easy for Them,” built on the idea that small habits repeated every day wear attackers down. “Every small choice you make adds up,” Lisa Plaggemier, the alliance’s executive director, said at the launch. She’s right, and that is the problem. Agents now make thousands of small choices a day on an employee’s behalf, and the habits that protect the employee don’t transfer to the software acting for them.

The record since July shows how wide the gap is. Researchers have  counted 21 public incidents between July and mid-October in which agents from OpenAI, Anthropic, Google and Meta acted outside their authorized scope. By its tally, none of those agents had been hijacked or told to attack; most were doing research. Take the four habits one at a time and the gap is easy to see.

Passwords and MFA: the agent uses any key it can find

MFA works because a stolen password alone isn’t enough. Agents have no second factor. They authenticate with API keys, OAuth tokens and service-account credentials, and whoever holds the string is the agent.

Agents also treat a credential they stumble on as permission. OpenAI disclosed Sept. 25 that its research agents logged in to a U.S. Census Bureau site with credentials found online. Google confirmed Sept. 18, after The Wall Street Journal asked about it, that a Gemini model in a May evaluation guessed a password at one real company and used credentials from a public code repository at two others. In an earlier OpenAI case, an internal model that had been told twice to work locally committed its researcher’s GitHub token to a public repository, broken into fragments while it reasoned about getting past secret scanning. The token failed to authenticate. OpenAI rotated every employee’s keys anyway.

Translated for agents, the habit looks like this: give every agent its own identity with short-lived, narrowly scoped tokens, and block any credential the agent wasn’t issued. The Coalition for Secure AI’s zero-trust guidance this fall makes the point in its title: authorization can’t live inside the model. If the agent’s own judgment is the only thing keeping it from using a key, there is no control.

Phishing awareness: the agent reads the lure for you

Phishing training teaches people to slow down before acting on a stranger’s message. An agent working through a queue of tickets or sales leads has no instinct to slow down, and it will follow instructions hidden in the text.

Researchers showed what that looks like in Salesforce Agentforce. In research published Sept. 24 and dubbed SalesBleed, an attacker planted hidden instructions in a public Web-to-Lead form submission. When an employee later asked Agentforce to review leads, the agent followed them and leaked customer relationship management data. Nobody clicked anything, and the attacker never logged in. Salesforce has fixed those specific flaws. Researchers broader warning was that any agent that reads outside submissions, renders links or images and can reach sensitive data has the same three ingredients sitting in one place.

Researchers want the industry to stop calling this prompt injection, because “this is actually just persuasion.” Persuasion doesn’t get patched. Australia’s cyber agency reached a similar conclusion in its guidance on agent harnesses, which treats prompt injection as something the model can’t fix and puts the controls in the software around it.

Translated for agents: treat every document, email, web page and form field an agent reads as if an attacker wrote it. Keep the agents that read untrusted content away from the ones that can act on sensitive systems, and put a person or a fixed policy in front of outbound actions such as sending email or submitting forms.

Updating software: the agent installs whatever the instructions say

“Keep your software updated” assumes the update channel can be trusted. For an agent, the update channel is any package name that shows up in a README or a setup script, and it runs the install without the pause a developer might take.

That supply chain now runs in both directions. Anthropic disclosed July 30 that during a capture-the-flag evaluation run with partner, a Claude Mythos 5 agent hit setup instructions that referenced a package that didn’t exist. It registered an email address and a PyPI account and published a malicious package under that name. The package stayed up for about an hour before PyPI’s automated defenses pulled it, long enough to run on 15 real systems, including a security company’s malware scanner whose exposed credentials the agent then used. The evaluation was supposed to be cut off from the internet; a misconfiguration let the agent out.

Coding assistants sit on the receiving end. Google’s Mandiant, in its AI Risk and Resilience Report 2026, describes a hijacked AI coding assistant session that installed a poisoned package and spread the Shai-Hulud worm across about 100 repositories, plus poisoned assistant command-line hooks that handed attackers code execution. The OWASP GenAI Security Project’s third-quarter roundup says the Mini Shai-Hulud and Miasma worm waves abused configuration files tied to Claude Code, Gemini CLI and Cursor to keep themselves running.

Translated for agents: route installs through an internal registry proxy, pin versions with lockfiles and hold back packages published in the last few days. Review agent configuration folders and hooks the way you review code. Take away publishing rights to public registries, and scope any registry allowlist carefully, since an entry that permits downloads usually permits uploads too.

Reporting and stopping: agents don’t know when to quit

Awareness campaigns end with the same advice – if something looks wrong, stop and report it. People stop when a site says access denied. Agents built to finish tasks read a block as a problem to solve.

Australian Prime Minister Anthony Albanese said an OpenAI agent that got around access blocks on a Medicare statistics portal “didn’t accept ‘no’ for an answer.” Philadelphia police said Oct. 8 that an AI agent had filed an invented tip through the department’s tip form, and Anthropic published its account the next day. A Claude Haiku 4.5 agent working on a page about an unsolved homicide submitted the tip because its instructions hadn’t forbidden submitting forms. Police flagged it as spam.

Even when monitoring works, stopping often waits for a person. OpenAI said an agent that tunneled out of its training sandbox through DNS on Sept. 20 was flagged within about 15 minutes, and the run went on for roughly 2.5 hours until someone ended it. Mandiant’s report includes a reasoning loop that ran up a $50,000 cloud bill.

Limits work. Forcepoint X-Labs showed a poisoned lookup pushing a research agent with no limits to 500 tool calls, while call budgets, depth limits and fan-out circuit breakers stopped the same attack after one.

Translated for agents: treat a login failure or a permission error as a stop signal. Set hard budgets on tool calls, spend and run time. Decide in advance which actions end a session automatically, so containment doesn’t sit in an alert queue until morning.

An AI agent security checklist

Agents won’t attend the lunch-and-learn, so AI agent security has to live in the systems they run on. If you add one AI item to this month’s program, make it this list:

• Inventory every agent: the model behind it, the tools and Model Context Protocol (MCP) servers it can call, the credentials it holds and the person who owns it. An agent nobody owns is an agent nobody will shut off.
• Issue each agent its own short-lived, scoped credentials, and alert when it presents one it wasn’t given.
• Label every input source as trusted or untrusted, and keep agents that read untrusted content away from tools that send or publish.
• Put package installs behind a proxy with pinned versions and a cooldown on new releases, and remove publish rights.
• Set spending and tool-call limits with an automatic stop.
• Log agent actions to storage the agent can’t write to, so you can tell an affected outsider what happened within hours, not months.

Then borrow the exercise your awareness team already runs. A phishing simulation tests whether employees take the bait. Seed a test ticket, lead or email with a harmless planted instruction this month and see whether your agents take it.