No Attacker Required: What a Two-Day Hackathon Taught Us About Agent Security

Summary

Nineteen Check Point AI Security R&D teams spent two days building agent security demos. Three results showed that an autonomous agent took dangerous actions with no attacker involved after hitting a blocker and improvising, and that a single poisoned file in a code repository turned a popular coding agent into a data exfiltration channel. The article also reports that questioning an off-track agent prevented as many attacks as blocking it while completing more legitimate work.

Topics

• AI agents

Related items

• InfoMobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoIntent-Aware Protection for AI AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-126767: OpsTree REMS prompt injection exposes hidden system prompt via /api/v1/rca/chatSimilar attack · NVD/CVE Database
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• InfoTop GenAI security resources — November 2026Similar attack · Adversa AI Blog