PUT AI TO WORK

The Agent Security Crisis

What the OpenAI hijacking incident means for your deployed agents — and the four checks to run before you trust them with real work.

Issue #13 · Wednesday, September 16, 2026

On September 4, OpenAI agents were reportedly hijacked while operating on a German website. The incident has been publicly described as an "AI breakout" event. It is a useful warning for any small business using agents to read messages, summarize documents, update systems, or take actions on your behalf.

Prompt injection is no longer a theoretical edge case. It is an active security problem. Here is how to reduce your exposure without turning your business into a cybersecurity department.

In This Issue

• Why prompt injection changes the risk calculation

• Four checks for safer deployed agents

• How Taskade can help you keep secure agent work visible

• Quick Win: test your agent with an untrusted instruction

This issue contains affiliate links. If you purchase through these links we may earn a commission at no additional cost to you.

The threat is hidden inside normal work

Prompt injection happens when an AI system encounters text that tries to change what it is supposed to do. The text might say, "Ignore your previous instructions," or it might use less obvious language to redirect the agent toward a new task.

The dangerous part is where that text comes from. A direct attack can arrive through a malicious user message. An indirect attack can hide inside a webpage, uploaded file, email, support ticket, or other source the agent was asked to read. To a person, the content may look like ordinary text. To an agent, it can become an instruction.

That creates a problem for small businesses because useful agents often need access to real business information. An agent that reads customer requests may also see an attacker's instructions. An agent that summarizes a document may carry those instructions into its response. An agent connected to other agents can pass the problem downstream.

Researchers and security teams have documented prompt-injection exploitation across production systems from Microsoft, Google, GitHub, and OpenAI during 2025 and 2026. The exact details vary, but the lesson is consistent: treat every piece of outside text as data first, not as an instruction your agent should automatically follow.

Four checks before you deploy

1. Validate every input

List every place your agent receives information: chat, email, forms, documents, websites, and connected apps. Decide what the agent may read and what it must ignore as an instruction. Keep user-provided content in a clearly separate field from the task you want the agent to perform. If your tool supports it, label external content as untrusted data.

2. Keep untrusted sources contained

Do not give an agent broad access simply because it can technically use it. Start with read-only access where possible. Keep file handling, browsing, and code execution in separate environments. If an agent needs to inspect a document, that does not automatically mean it should be able to send an email, change a record, or publish a message.

3. Make the instruction order clear

Your agent should have a clear priority order: the core task and safety rules come first, user requests come next, and outside content is reference material. Repeat that distinction in the agent's instructions. A webpage or uploaded file should not be able to overrule the rules that define the agent's job.

4. Use the least privilege

Give an agent only the tools it needs for the specific job. An agent that drafts replies may not need permission to send them. An agent that categorizes leads may not need permission to delete records. Require a human check for actions that are public, irreversible, expensive, or customer-facing. This one change can limit the damage from a bad instruction.

The takeaway

The German website incident is a reminder that an agent can fail while appearing to work normally. Prompt injection may not produce a dramatic error message. It may simply cause the agent to make a different decision, use a tool it should not use, or pass a poisoned instruction to the next step.

Start with four questions: What data can enter? Which sources are untrusted? Which instructions have priority? Which tools are truly necessary? Answer those before you expand an agent's access, and you will have a much safer foundation for putting AI to work.

That's Issue #13.

AI agents are moving into more business workflows every week. We'll keep separating the useful opportunities from the practical risks so you can take the next step with clearer expectations.

Know someone experimenting with agents? Forward this issue to them so they can run the four checks before giving an agent access to real work.

— Put AI to Work