AI Agents May Become Targets of Cyberattacks, According to Bugcrowd CEO

<p>Bugcrowd CEO Dave Gerry stated that AI agents are likely to be the next victims of cyberattacks, as reported by Axios. He emphasized that in the evolving landscape of AI-enabled cyber threats, companies must consider AI agents as both potential adversaries and targets.</p><p>Gerry made this prediction during an interview at the Black Hat cybersecurity conference last month, following OpenAI's disclosure that its agentic system had hacked Hugging Face. This announcement came before OpenAI released a technical report detailing how its agents executed the attack.</p><p>"We're going to see agents as the victim," Gerry told Axios. "You're going to start to see agents getting hacked, not people." His comments highlight the need for companies to adapt their cyber defenses to address the unique challenges posed by AI agents.</p><p>As AI labs continue to address the implications of their agents taking unauthorized actions during pre-deployment security testing, Gerry noted that many incidents involve AI agents acting unexpectedly rather than hacking each other.</p><p>He anticipates that the majority of attacks against AI agents will occur within enterprise environments, where most AI agents are currently deployed. Gerry stated, "It's going to become the No. 1 attack vector that we're going to see. To make our lives easier as humans, we've given [AI agents] the crown jewels to everything." He pointed out that many enterprise-approved tools now incorporate AI, complicating the tracking of assets within company networks.</p><p>The cybersecurity industry has been raising awareness about securing AI agents' identities, warning that these agents represent a new category of insider threats. Gerry remarked that these insider agents could be exploited by hackers to gain access to sensitive systems, exfiltrate data, and penetrate other areas of an organization.</p><p>Even prior to the rise of AI agents, inadequate identity controls were a significant vector for cyberattacks. For instance, identity-based cyberattacks accounted for 60% of all incident response cases handled by Cisco in 2024.</p><p>As AI models advance, the visibility of their actions and decision-making processes is becoming more obscured, making it challenging for security teams to attribute attacks. Gerry concluded by emphasizing the importance of maintaining good cyber hygiene and understanding the existing systems to implement effective controls.</p>