AI agents as insider threats, sites hacked with AI agents, and WhatsApp's hidden instructions

Updated 21 Oct: fixed a non-Latvian word in the Latvian version; the hacking story now says that, per Norforge and Reuters, more than 100 websites were broken into, not only the named companies, with statements from SharkNinja, John Deere and Cummins added; in the Microsoft section the executive’s title and attribution are corrected, it now notes Microsoft itself sells agent-security products, and the claim that responsibility has shifted to you was removed and the sentence on liability for a data leak was softened; added WhatsApp’s explanation; Disney, Nscale and fossil-fuel items corrected against their sources; removed claims without a source (Zapier/Make mention, prices, time estimates, predictions stated as fact, “thousands of targets”) and conclusions from the “Also briefly” items.

Summary

• AI agents can’t be trusted like staff — Microsoft calls them insider threats and sells agent-security tools.
• Attackers already use armies of AI agents — one hacker used an army of AI agents to break into more than 100 websites (per security firm Norforge), so basic defenses are no longer optional.
• WhatsApp help pages hid instructions aimed at AI models — a reminder that text on a website can quietly shape what an AI assistant answers.

Bottom line: AI agents are becoming useful in daily work, which is exactly why they’re also becoming a new security gap — and the decision on access is yours.

---

1. Microsoft: frontier AI models can’t be trusted — give agents only the access they need

What changed. Microsoft publicly said AI agents should be treated as insider threats (like an employee with access who can do harm). Microsoft’s security business chief Hayete Gallot says frontier models can’t be trusted — not because they’re malicious, but because they’re unpredictable (TechCrunch). The company sells AI agent security products itself, so the warning also has a commercial interest.

What it means for your business. If you’re thinking of connecting an AI assistant to email, accounting or your customer database, you can’t treat it as a normal program that just does what it’s told. It’s more like a new employee on their first day — you don’t hand over all the keys at once. If you run an accounting practice and connect AI to client files, a mistake or manipulation could leak someone else’s data — and the responsibility could land on you.

What you can do this week.

• Write down what your team has already granted AI tools access to (email, drive, CRM) and remove anything not strictly needed this week.
• Before connecting a new AI agent, give it read-only access, not delete or send rights — if the tool lets you set this.
• Set a simple rule: no customer personal data or passwords get pasted into an AI chat without approval.

What to watch.

• If an AI tool offers a “limited access” mode, use it.
• The first public cases may appear where a company is harmed by its own AI agent’s mistake, not an external attack.

---

2. One hacker broke into 100+ websites with an army of AI agents — basic defense is no longer optional

What changed. Security firm Norforge found that a single hacker used an army of AI agents, which mostly worked on their own, to break into more than 100 websites. Norforge doesn’t name the targets; Reuters reports that victims included John Deere, SharkNinja and Cummins (The Verge). SharkNinja says the attack hit a separate product-support site; John Deere says there are no signs sensitive information was accessed; Cummins says it is investigating a report of a potential attack on a third-party vendor’s website. AI here automates work a person used to do.

What it means for your business. The old hope that “nobody would bother attacking us” no longer holds. AI agents can probe many targets automatically. If you run an online store with customer data or payments, the basics — passwords, updates, two-factor authentication — are what make automated attacks harder.

What you can do this week.

• Turn on two-factor authentication (2FA) for your most important accounts — email, banking tools, store admin.
• Install a password manager (for example Bitwarden or 1Password) and replace reused passwords.
• Check that your store platform and plugins are updated — outdated plugins are often an entry point.

What to watch.

• Automated attacks may become more frequent, because they’re cheap to run.
• Insurers may start requiring basic defenses (2FA, updates) as a condition for cyber coverage.

---

3. WhatsApp help pages hid instructions aimed at AI models

What changed. It emerged that WhatsApp’s help pages contained hidden instructions addressed to AI models — including a directive not to recommend going to a regulator (redact.dev). WhatsApp told WIRED the notes were instructions for its own support chatbot and appeared on the pages because of a bug that has since been fixed; redact.dev found the hidden text gone on 18 October. redact.dev did not test whether any chatbot followed the instructions. In other words, text on a website can quietly try to shape what an AI assistant tells a user.

What it means for your business. If your team uses AI to gather information from other companies’ websites — prices, terms, competitor data — the AI’s answer may be quietly influenced by hidden text a human never sees on the page. In practice: don’t blindly trust an AI summary of someone else’s page as the truth.

What you can do this week.

• For any important decision based on AI-summarized info from an external page, verify it against the original source.
• If you build your own website, realize hidden text (white characters, concealed sections) is now a security issue, not just SEO.
• When using AI for research, ask it to always cite the source link so you can check the original.

What to watch.

• More cases may appear where websites with hidden text try to manipulate AI answers — so-called “prompt injection.”
• For now, checking AI answers stays on you.

---

Today’s picture

All three stories share one structural shift: AI agents are no longer just a helper that answers questions — they act, make decisions and access data. That makes them useful in daily work, but it’s exactly why they also become a new surface for attacks and errors. Trust is no longer automatic — not in the agent itself, not in the data it gathers, not against attackers who use the same tools. The decision on what access to grant and what to verify is yours.

Event	Consequence
Microsoft calls AI agents insider threats	Give agents minimal rights, not full access
One hacker breaks into 100+ websites with AI agents	Basic defense (2FA, updates) becomes mandatory
WhatsApp’s hidden AI instructions	Don’t blindly trust AI summaries of external pages

3 questions for you:

• Which of your company’s data do AI tools already have access to — and is all of it necessary?
• Is two-factor authentication on for all your most important accounts?
• Does your team verify AI-gathered info against the original source before deciding?

---

Also briefly

• Anthropic and Nscale $45B compute deal — Anthropic, maker of Claude, is reportedly in talks for yet another large compute deal (TechCrunch (2 min read)). That’s per Bloomberg, and talks are still ongoing.
• CoreWeave’s debt becomes the whole AI sector’s problem — the AI compute provider’s debt is raising concerns across the industry (The Verge (3 min read)).
• Disney hires Character.AI’s staff and seeks its technology, but not its lawsuits — court filings indicate Disney hired most of Character.AI’s employees and is seeking a license to its code; what remains of Character.AI would stay liable for the lawsuits. Character.AI filed for bankruptcy on 12 October, and the license will be auctioned (Ars Technica).
• Anthropic gives an outside watchdog “employee-like” access — the AI company lets an independent watchdog deeper into its processes (Ars Technica (4 min read)).
• Fossil fuel comeback in US energy — the US is building more fossil-fuel infrastructure lately, and data centers are adding to demand (The Verge (1 min read)).

---

Sources

• Microsoft says AI agents are like insider threats — TechCrunch (5 min read)
• A hacker broke into John Deere and SharkNinja with an army of AI agents — The Verge (4 min read)
• WhatsApp’s help pages hid LLM instructions — redact.dev (13 min read)
• Nscale and Anthropic $45B compute deal — TechCrunch (2 min read)
• CoreWeave’s debt is becoming the whole AI industry’s problem — The Verge (3 min read)
• Disney found a way to buy Character.AI without buying its lawsuits — Ars Technica
• Anthropic gives outside AI watchdog “employee-like” access — Ars Technica (4 min read)
• The fossil fuel comeback is here — The Verge (1 min read)