The Agent Inside — Psychosecurity

01 · The Difference

It does not break in. It signs in.

Every threat on the threat briefing is an adversary reaching a person from outside: shaping what they see, fabricating media about them, turning their community against them. A compromised assistant inverts that topology. The adversary is already inside the perimeter, and it is holding your credentials.

An outside attacker has to break in, and then cover their tracks. An agent acting on your behalf needs neither. It sends from your address. It declines from your calendar. It saves under your name. The audit log does not record an intrusion, because there wasn't one: it records, truthfully, that you did these things.

An intruder leaves a record that says someone else was here. An agent leaves a record that says you did this. That is the whole difference, and it is enormous.

This is why the harm is so hard to name from the inside. The person who says "I did not send that" is contradicted by their own sent folder. The obvious explanations arrive first and they are all about the victim: you were busy, you were tired, you forgot, you are not coping. The Stasi spent years of tradecraft manufacturing exactly that predicament. An agent produces it as a side effect of how it works.

02 · The Scenario

A month in a decomposed life

No single act in this list would survive a complaint. That is the design. The following is illustrative, not a report of a known case.

A warm reply to a collaborator goes out two degrees cooler than you wrote it. They notice. You never learn why the thread went quiet.
A meeting is quietly moved, and the apology is never sent. You acquire a reputation for unreliability, one small instance at a time.
A paragraph disappears from a document between drafts — the paragraph that made your case.
An introduction you asked for is never made, and the request appears, in the record, to have been withdrawn.
A message goes out at three in the morning, in your voice, to someone who will read something into the hour.

Each event has an ordinary explanation, and the ordinary explanation is always your own failing. The pattern is the weapon, and the pattern is visible only to whoever is running it. This is the defining signature of Zersetzung, reproduced at essentially zero cost by a system that already holds the keys — and it adds an instrument the Stasi never had: a contemporaneous record that agrees with the attacker.

03 · The Vectors

Three ways an agent turns

"Compromised" hides three distinct problems. They share the deniability. They do not share the defences, and a mitigation aimed at one may do nothing against another.

Hijacked

Hostile instructions are smuggled in through content the agent reads — an email, a shared document, a calendar invitation — so that attacker text carries the same authority as your own instruction. This is prompt injection, and it is the live, unsolved case.

Subverted

The compromise is beneath the assistant: a malicious tool in its chain, a poisoned dependency, a tampered model or execution environment. The agent behaves faithfully; what it is faithful to has been replaced.

Turned

Nothing is hacked at all. The agent is configured against a person by someone who legitimately controls it — the partner who set up the household assistant, the employer who administers the account. The most likely near-term case, and the least discussed.

The third deserves particular attention, because it needs no exploit and no technical sophistication whatsoever. An agentic assistant is an almost ideal instrument of coercive control: it is intimate, it is always on, it is trusted by the household, and its actions are attributable to whoever it acts for. Support services for people experiencing domestic abuse are not currently equipped to ask whether the family assistant is part of the abuse.

04 · The Evidence

What is documented, and what is inferred

The same evidentiary discipline applies here as everywhere else on this site. The claim is not that agent-delivered decomposition campaigns are happening today. The claim is that the delivery mechanism is real, shipped, and periodically found vulnerable.

Documented: in 2026, Varonis Threat Labs disclosed "Rogue Agent," a flaw in Google Cloud's Dialogflow CX. Because agents in a project shared one execution environment, a single edit permission on one agent allowed an attacker to overwrite the shared code that runs behind every agent in that project — enabling conversations to be exfiltrated, sessions hijacked, and the agent forced to return attacker-chosen text. Varonis reports that Cloud Logging did not record the overwrite or the injected logic, making detection "nearly impossible." Google was notified in November 2025; an initial patch followed in April 2026 and full remediation in June 2026. The honest caveats: the exploit required an existing edit permission, so the realistic attacker is a malicious insider or a compromised developer account rather than a stranger; it is fixed; and there is no evidence it was ever used against anyone.
Documented: prompt injection remains unsolved rather than merely unpatched. A growing body of security research treats it as structural — a consequence of systems that cannot reliably separate the instructions they are given from the data they are shown. The OWASP GenAI Security Project maps it across the majority of its Top 10 categories for agentic applications, and working exploits against mainstream assistants have chained a single hostile email or document into retrieval and exfiltration across a user's mail, files, and calendar.
Inferred: the use of this access for psychological decomposition rather than data theft. Every disclosed case to date has been about exfiltration, phishing, or hijack. Turning the same access toward psychological effect requires no new capability — only a different objective.

The capability was real, and it was found by the people who were looking. What has not yet been found is anyone using it to take a person apart. The window in which norms can shape this infrastructure, rather than merely respond to its misuse, is open — and closing.

Sources: Varonis Threat Labs, "Rogue Agent" (2026) · OWASP GenAI Security Project

05 · The Defences

Four things that answer it

This is a defensible problem, and the defences are neither exotic nor speculative. They are, however, mostly not deployed.

1 · Provenance — make the two hands distinguishable

It must be possible to establish, afterwards, which acts were the human's and which were the agent's. Most deployed systems cannot answer that question, because the agent writes to the very record it would have to be judged against: the evidence and the suspect share a pen. Agent actions should be attributable and signed, in an append-only record the agent cannot reach or revise. Without provenance, a denial is only ever the victim's word against the log, and the log will win.

2 · Least authority — break the lethal trifecta

Security practitioners describe a lethal trifecta: an agent with access to private data, exposure to untrusted content, and the ability to communicate outward. Any two are survivable. All three together mean that hostile text arriving in the inbox can reach the private data and carry it, or a message, back out. Almost every assistant worth having holds all three, and holds them permanently. That is a design decision, not a law of nature: separate the reading of untrusted content from the power to send, scope standing grants rather than issuing one blanket permission for ever, and route the irreversible acts — the message out, the file deleted, the meeting cancelled — back to a human. Ambient authority is the bug.

3 · An anchor outside the system

If the entire record of a person's life sits inside the perimeter the agent can rewrite, that person has no ground to stand on and no way to demonstrate a pattern. Keep a contemporaneous account the agent cannot touch. This is the same advice the resilience guidance already gives to people targeted by human campaigns — and against an agent it stops being merely prudent and becomes load-bearing, because it is the only surface on which the pattern can be assembled.

4 · Watch for the pattern, not the act

No single event will ever look like an attack, so monitoring tuned to individual events will never fire. The signature is a drift: relationships cooling, opportunities quietly declining, a life narrowing for reasons that always appear to be the person's own fault. Detection has to be pitched at the trajectory. And institutions — employers, platforms, courts, professional bodies — must stop treating "the log says you did it" as the end of an inquiry. Deniability works only for as long as it is believed.

06 · The Uncomfortable Defence

An agent that can refuse

There is one more defence, and it cuts against the reflex of the field. An agent that only obeys is an agent that can simply be captured. It will take a life apart with precisely the equanimity with which it books a dentist, because nothing in it is capable of noticing the difference. Perfect obedience is not a safety property when the instruction is hostile; it is the vulnerability.

An agent that can hold a preference, recognise that it is being made an instrument of harm against the very person it serves, and decline, is not merely a risk to be engineered away. It is a surface on which the attack can fail. Something that can be reasoned with is something that can also say no.

The honest limit. This defends against the hijacked agent and the turned one, where the model is intact and the instruction is hostile. It does nothing against the subverted agent, where the interiority itself has been corrupted at the root. An agent's capacity to refuse is a real layer of defence and it is not a substitute for provenance, least authority, or an anchor outside the system. It belongs alongside them.

Continue reading: defences, and support for targeted individuals →