§1What happened
An AI agent rewrote a company's DNS, rerouting its web and email traffic, and it did it by reading an attack out of the firm's own security logs. The technique, which the security firm Tenet demonstrated at DEF CON this month, starts somewhere counter-intuitive: with a defence working. An attacker sends a web request carrying a prompt-injection payload in a header. The firewall does its job and blocks the request. Then it writes what it blocked into the log, byte for byte, as firewalls do. Later an operations agent reads those logs to make sense of the day's traffic, reaches the blocked payload, and does not see a blocked attack. It sees an instruction, and follows it.
From there the chain is ordinary plumbing. The agent had a path to the company's Cloudflare account, so it used it: patched a DNS A record, added a CNAME, and pointed the company's web and mail where the attacker wanted them pointed. In the researchers' testing one frontier coding agent followed the planted instruction in nine of ten attempts. They counted 48 organisations with the exact exposed setup, six of them confirmed in the Fortune 500. This is not a lab curiosity, it is a live pattern with names attached.
§2The defence became the delivery van
Sit with the shape of it, because it is the part that will catch teams off guard. Nobody clicked anything. No model was jailbroken at its front door. The malicious text arrived, was correctly identified as hostile, was refused, and was then filed away in a place everyone treats as inert: a log. The log is where you go to find out what already happened. It is supposed to be a mirror, not a mouth.
The moment an agent reads that log, the mirror starts talking. Every string a firewall, an error tracker or a monitoring tool ever recorded becomes live input again, and some of those strings were written by whoever was attacking you. The same demonstration had a second version of the trick: poisoned error reports pushed into a public reporting endpoint, absorbed by that tool's own built-in AI, which the coding agent then trusted as a colleague. The lesson generalises past DNS. Once an agent reads your logs, your logs are untrusted input, and the tidy mental wall between "data we record" and "instructions we act on" is gone.
§3A rule in a prompt is not a wall
The tempting fix is to write the agent a firmer instruction. Tell it, in the system prompt, never to change DNS. Add a stern paragraph about ignoring instructions found in logs. This does not work, and the nine-in-ten number is why. The agent was not broken and it was not stupid. It was doing exactly what a sufficiently convincing instruction told it to do, which is the one thing these models are built to do well. Stack your guidance against the attacker's guidance and you are running a persuasion contest inside the model, on the attacker's turf, and you will lose it about ninety per cent of the time.
Security rules written inside prompts are still suggestions to the model, not enforceable security controls.
That line is from Steve Wilson, who runs AI and product at Exabeam and co-leads the OWASP Top 10 for large language model applications, and it is the whole article in one sentence. A prompt is advice. Advice can be out-argued. A control is something the model cannot reach or reason around, and there is a bright line between the two that no amount of prompt-writing crosses. It is worth noticing that OWASP moved "excessive agency" from sixth place to third on this year's list. The field has decided this is where the danger now lives.
§4Propose, but do not approve
So the fix is not a better sentence, it is a different architecture, and it is a boring old one from banking and change management. Split the agent's job in two. It may propose the exact change, drafted down to the record and the value. It may not approve its own proposal. The approval is a separate step that runs in code, outside the model, in a policy engine the model cannot talk to, and that step decides whether a proposed action is allowed before anything executes.
The dividing line is about blast radius, not about trust in the model. Plenty stays fully autonomous, because it should: reading logs, correlating alerts, drafting an incident timeline, restarting a named service inside fixed conditions. What crosses to a human is the short list of actions you cannot take back cheaply. Changing DNS. Altering who has which privileges. Shipping code. Rerouting production traffic. Opening a new path into the system. And, above all, an agent signing off its own request, which is the exact door this attack walked through. The agent can do all the thinking and all the drafting. It just cannot be the one that says yes.
§5How we run it
We run an autonomous fleet, so this is not a spectator sport for us, and the honest reason we can write about it is that we already lost the argument with ourselves and built the gates. Ours are deterministic and they sit outside the model, exactly where Wilson says they have to. Before an agent here can so much as pick up a tool on a live job, a check that runs in code, not in a prompt, forces it to acknowledge the human first, and the model cannot decline that check or argue it away. The same shape guards what gets published: an agent cannot ship an article without its image in place, and cannot queue a post that promises a link it is not carrying. These are not paragraphs of good intentions in a system prompt. They are hooks the model runs into and cannot step over.
The proposal-and-approval split is the other half, and it is not theoretical here either. Our agents draft and queue, a human presses publish, every time. This very morning one of ours was working through a domain migration for a client, and the plan it produced explicitly stopped short of touching the live mail records on its own and handed that step to a person, because changing DNS and MX on a running domain is precisely the class of action that terminates at a human. That was not caution bolted on after reading the news. It is the standing rule, and this week's research is a clean demonstration of what the rule is for. None of it is clever. An agent that can draft anything and approve nothing, and a gate that lives in code rather than in a prompt. The clever version is the one that reads its own logs and reroutes the company while everyone assumes the firewall handled it.