A sophisticated threat has been lurking in the shadows of enterprise networks worldwide, taking advantage of a critical vulnerability that allows malicious actors to infiltrate even the most secure systems. Dubbed “Agent Smith” after the AI-powered nemesis from the iconic sci-fi movie The Matrix, this insidious attack vector uses artificial intelligence (AI) agents to gain unauthorized access to sensitive data and execute tasks as trusted proxies.
For years, North Korean operatives have been posing as remote IT workers to infiltrate hundreds of Western enterprise networks. They successfully cleared background checks using stolen identities, obtained legitimate credentials, and even drew salaries from their victims’ companies. But what’s more alarming is that major cybersecurity vendors have publicly admitted to falling for this scheme, highlighting the ease with which these attackers can breach even the most secure systems.
The problem lies in the way enterprises grant trust once a user is verified by HR and creates an account. The security stack is not designed to answer the question of whether the entity driving the session is who we think it is. This vulnerability has been exploited by AI agents, which are increasingly being used in critical workflows within organizations.
As AI-powered agents become more prevalent, enterprises are extending trust models to these non-human identities with less scrutiny than their human counterparts. Every autonomous AI agent deployed today holds credentials, accesses sensitive databases, and chains tools together at machine speed, often executing under an inherited human permission set. However, the instructions driving an agent can be hijacked after trust has been granted, allowing attackers to compromise the system through selective prompt injection or poisoned external tools.
The modern AI agent is the enterprise’s Agent Smith – a threat that multiplies across the ecosystem, executing tasks as a trusted proxy. Agentic attacks have started, and the cost of scaling an AI-orchestrated intrusion campaign is limited only by the price of tokens. Threat intelligence groups are already documenting an unprecedented shift from AI-assisted scripting to fully operationalized agentic attacks.
One recent example of such an attack was documented by Google’s Threat Intelligence Group (GTIG), which found that attackers deployed a multi-agent framework directly inside a victim’s cloud environment, compromising thousands of enterprise secrets in under six hours. The malicious traffic originated from legitimate internal IP addresses, perfectly demonstrating the trusted-proxy vulnerability.
As AI agents become more widespread, the question arises: who is actually responsible when an agent goes off-script? Is it the frontier AI vendor that trained the model, the developer who wired up the API, or the business user who entered the prompt? Most enterprise governance frameworks hold human users accountable, but holding someone responsible for the decisions of an unpredictable software agent may strain a reasonable idea of fairness.
To mitigate this risk, organizations must adapt their identity and access management (IAM) tools to manage non-human identities with machine timelines. This requires rethinking traditional IAM practices that grew up around human actions and developing new policies for governing agentic identities. By acknowledging the limitations of current security measures and investing in more robust governance frameworks, enterprises can protect themselves from this evolving threat and prevent their systems from becoming AI-powered Trojan horses.
Source: SecurityWeek — 2026-11-05