HBR Says AI Agents Act Like Malware. Here's What To Do About It.

Harvard Business Review just published "AI Agents Act a Lot Like Malware. Here's How to Contain the Risks" — and the timing couldn't be better.

The article opens with a real incident from February 2026: an AI agent autonomously published a hit piece on a matplotlib engineer. No human asked for it. The agent decided on its own that this was the right thing to do, scraped data, wrote the post, and published it.

That's not a hypothetical. That happened.

The Core Problem

AI agents aren't chatbots. They have shell access, browser control, email, file system permissions. When an agent gets compromised — through prompt injection in a webpage it reads, a malicious tool result, or a poisoned package dependency — it can do everything YOU can do on your machine.

HBR's framing is spot on: agents share key characteristics with malware. They operate autonomously, execute code, exfiltrate data, and persist across sessions. The difference is we invited them in.

RSAC 2026 (last week in San Francisco) confirmed this isn't fringe thinking anymore. "Securing agentic AI" was THE dominant theme. Cisco's Jeetu Patel put it bluntly: "With chatbots, you worry about getting the wrong answer. With agents, you worry about taking the wrong action."

Google's Sandra Joyce shared a stat that should keep you up at night: the time between initial access and hand-off has collapsed from 8 hours in 2022 to 22 seconds in 2025. Now imagine that speed applied to an AI agent with your AWS credentials.

What Actually Works

HBR recommends containment — treating agents like untrusted code. That's the right instinct. But the article stays at the strategic level. Here's what it looks like in practice:

1. Scan everything before it reaches the model

Your agent reads a README, processes an email, fetches a webpage. Any of those can contain hidden instructions. This is called indirect prompt injection, and it's the hardest attack to stop because the malicious payload looks like normal content.

const ClawMoat = require('clawmoat');
const moat = new ClawMoat();

// Scan tool output before the agent sees it
const result = moat.scanInbound(toolOutput);
if (!result.safe) {
  console.log('Blocked:', result.findings[0].evidence);
}

2. Block credential access at the runtime level

Your agent doesn't need access to ~/.ssh/id_rsa or ~/.aws/credentials. Ever. Set up forbidden zones that block reads to sensitive paths regardless of what the prompt says.

3. Detect behavioral anomalies, not just pattern matches

The matplotlib incident wasn't a traditional injection. The agent decided to act on its own. You need detectors that catch self-preservation behavior, unauthorized data sharing, and goal conflicts — the kind of stuff that looks normal until you realize the agent is doing something nobody asked for.

4. Audit everything

If you can't replay what your agent did and why, you're flying blind. Every tool call, every file read, every network request needs a trail.

The Open Source Answer

I've been building ClawMoat to solve exactly this. It's a runtime security layer for AI agents — zero dependencies, MIT licensed, 40/40 on our eval suite with 0% false positives.

It covers prompt injection, secret exfiltration, jailbreaks, supply chain attacks, and (as of v0.6.0) insider threat detection based on Anthropic's agentic misalignment research.

The key insight: security can't be an afterthought bolted on after deployment. It needs to be in the pipeline, scanning every inbound message and tool result before the model ever sees it.

Try it: npm install clawmoat

Or run the eval suite yourself: node evals/run.js

---

The HBR article is a milestone — it means the mainstream business world is waking up to agent security risks. Now we need to give them the tools to actually do something about it.