A threat actor out of Zhuhai just wired DeepSeek into the open-source Hermes Agent framework and ran it through Telegram like a remote control. The agent found targets on its own, pulled public exploits, and hit over 460 internet-facing systems. Confirmed compromises included Citrix NetScaler systems.
That's not a hypothetical. That's this week.
If you're building with AI agents, whether it's client intake, lead follow-up, or internal automation, this is the story to sit with. Agentic frameworks are powerful because they act without waiting on you to approve every step. That same feature is the risk. An agent with too much reach and not enough guardrails doesn't need to be hacked to cause damage. It just needs the wrong instruction.
A few things I build into every agent system now:
Scope the permissions tight. An agent doing client intake follow-up does not need access to your entire CRM. Give it exactly what the task requires and nothing else.
Log everything the agent touches. If you can't see what actions it took and why, you can't catch it going sideways until it's already a problem.
Keep a human checkpoint on anything irreversible. Sending an email draft for review is fine to automate end to end. Deleting records or making external system calls should have a pause point.
Treat the trigger layer as a security boundary, not just a workflow step. Whatever kicks off your agent (a form submission, a calendar event, a Telegram message) is also the door someone else could walk through if it's not locked down.
AI systems work when they're built with the same discipline as any other piece of infrastructure you'd trust with your business. Speed without containment isn't a system. It's exposure with better branding.
If you're building agent workflows right now, what's your permission model looking like?
Top comments (0)