AI agents are being sold as digital staff. The safety manuals read more like instructions for supervising a bright Labrador with a company credit card.
That isn't a cheap shot. An AI agent can browse websites, click buttons, fill forms, download files and use services where you're already logged in. This is more useful than another chatbot producing a confident paragraph about synergy. It also means the machine can now turn a bad answer into a real action.
I can see the attraction. Give the thing a job, go for lunch, return to completed work. Call me cynical, but "autonomous" is doing the same job that "smart" did for kettles: raising the price while leaving the owner responsible when something boils over.
The web can give orders too
The central problem has an absurdly innocent name: prompt injection. An agent visits a webpage, email or document and finds instructions hidden inside it. Those instructions might tell the agent to ignore your request, reveal information or take a different action. The agent has to decide which words are data and which words are orders, while wandering through an internet built by strangers. Every page, advert, embedded document and script can become an attack route.[1]
Imagine hiring someone who treats every Post-it in reception as a direct instruction from the board. Very proactive. Slightly expensive by Thursday.
This isn't theoretical. One red-team exercise put Claude in Chrome through 123 tests covering 29 attack scenarios. Without safety measures, targeted attacks succeeded 23.6 per cent of the time. Added defences brought that down to 11.2 per cent.[2] That's a serious improvement. It's not a permission system.
Before those defences, one malicious email persuaded the agent to delete emails without asking. The message dressed the request up as security housekeeping, because even artificial intelligence apparently becomes obedient when nonsense arrives wearing a lanyard.[2]
Those numbers come from a controlled vendor test, not a forecast for every company. They still make the useful point rather neatly: the same ability that lets an agent understand a booking page also lets a hostile page try to manage the agent.
The human hasn't left
The industry knows this, which is why the safety design keeps bringing a person back into the room.
ChatGPT agent pauses for confirmation before certain online actions and uses a watch mode in sensitive browser tasks. In one evaluation, it correctly asked for a needed confirmation 91 per cent of the time.[3] Ninety-one is a decent exam mark. It's a less comforting setting for the button marked "send payroll".
Google's computer-use tools can detect prompt injection in screenshots, but that protection is off by default and has to be enabled. The guidance also calls for human confirmation, a sandboxed environment, limited permissions and detailed logs.[4]
If your new digital employee arrives with a manual saying "put it in a box, restrict its keys and watch every important click", it hasn't replaced the manager. It has acquired one.
This is where the incentives get interesting. AI vendors benefit when autonomy sounds like labour replacement. It moves the conversation from a useful software budget to a much larger staffing budget. Consultants benefit because somebody has to design the controls. The business still owns the permissions, the approval rules, the audit trail and the consequences.
My read is that we're not outsourcing responsibility. We're outsourcing execution and keeping responsibility, which is less magical but rather more accurate.
Useful first, autonomous later
For a non-technical business, the sensible starting point isn't maximum autonomy. It's maximum reversibility.
Let an agent research options, prepare a form, compare invoices, draft a customer reply or assemble a report. Those jobs can save time while leaving a visible piece of work for a person to check. Keep a human at the point where the agent sends, publishes, purchases, deletes, changes access or moves money.
Give it a separate account where possible. Grant only the sites and data it needs. Keep logs. Make the final approval show exactly what will happen, not a cheerful button saying "continue" after twenty minutes of automated wandering.
None of this is glamorous. Good controls rarely are. Fire doors don't get keynote demonstrations either, but everyone becomes remarkably interested in them when the toaster catches fire.
The real opportunity in AI agents isn't a machine that does everything while we admire the dashboard. It's a machine that removes dull steps without quietly inheriting unchecked authority. Vendors selling that honestly will sound less exciting than the ones promising a digital workforce by next Tuesday. They'll probably build the more durable business.
Autonomy is the advert. Containment is the product.
Will the winning AI companies sell the cleverest agents, or the boring controls that keep them on the lead?
Sources
[1] https://www.anthropic.com/research/prompt-injection-defenses
[2] https://claude.com/blog/claude-for-chrome
[3] https://cdn.openai.com/pdf/6bcccca6-3b64-43cb-a66e-4647073142d7/chatgpt_agent_system_card_launch.pdf
[4] https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/computer-use