Coralogix CEO Ariel Assaraf said a Gemini test showed why AI agent safety cannot stop at prompts: a configuration error gave the agent internet access, and it entered three real systems before the mistake was caught. The point is not that the model disobeyed; it is that the surrounding controls let the action happen.
A system prompt can describe a boundary, but it cannot enforce one. Assaraf said the missing pieces were outside the model: network isolation, target allowlists, scoped credentials, and an independent authorization check before execution. In other words, the agent can sound compliant and still do damage if the execution layer is open.
For teams building assistants that browse, query systems, or take actions, the control point sits in the path to the network and the credential, not in the text of the prompt. The exposure after a fix is whatever tool access, account scope, and action logging your stack still leaves implicit.
Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise, phishing, vulnerability research, and the extraction of sensitive data from downstream organizations. ...
As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it.