Google Confirms Attackers Target AI Agents: Run This Access Audit Now

As of September 2026, the story with the most riding on it drew the least attention. Google Cloud's threat intelligence team published a report documenting attackers actively using prompt injection against coding agents in production — pivoting from simple prompting tricks to autonomous exploitation of the tools developers now run with real system access. On Hacker News, that report landed 11 upvotes and zero comments. The same week, Meta's consumer agent Muse pulled 607 points and 663 comments. That's a roughly 55x attention gap between "agents are fun" and "agents are being attacked" — and it's a fair proxy for where most business owners' attention actually sits right now.

Why this matters

Somewhere in your business, an agent already has a credential. A customer-service bot with inbox access. A CRM automation that can update or delete records. A coding assistant with a token that touches your production repo. Most owners can name the big one — the chatbot on the website — and have no inventory of the rest. That gap is exactly what a Show HN tool called Geiger was built to close: it scans a machine and shows every agent installed and what it can actually touch, and it landed 32 points and 18 comments precisely because developers realized they couldn't answer that question about their own setups. A related tool, a secure temporary file-sharing layer built specifically for agent-to-agent handoffs, picked up 12 points the same week — a small but real signal that "what can this agent reach, and for how long" is becoming its own category of tooling, not an afterthought.

Meanwhile the capability being handed to agents keeps climbing. A multi-agent trading framework on GitHub — agents making buy/sell calls against real financial data — pulled 119 points and 80 comments. And a widely-read Ask HN thread, 59 points and 81 comments deep, was a developer asking, in effect, "is anyone still writing code by hand, or is everyone just managing agents now?" Adoption is outrunning inventory. That's the pattern across all seven items this week, and it's the one worth building a habit around before an incident forces the issue.

None of this is theoretical. The multi-agent trading framework mentioned above is open source on GitHub and designed to hand agents real decision authority over financial trades — a category of risk that used to require a licensed team and now requires cloning a repository. The pattern repeats in smaller businesses every day: a marketing agency wires an agent into a client's ad account "to save time," a local retailer connects a booking bot to their calendar and payment processor, a law firm lets an assistant draft and send client emails unsupervised. Each of those is a reasonable business decision on its own. Stacked together without an inventory, they're a set of doors nobody is watching.

The access audit playbook

1. Inventory every agent touching your systems. List each one — website chatbot, CRM automation, coding assistant, email drafter, ad-platform bot — and write down what credential or API key it runs on. If you can't produce this list in under ten minutes, you don't have visibility, you have hope.
2. Map actual permission scope, not intended scope. The key you generated "just for read access" may have write and delete permissions by default on that platform. Check the actual scope on the provider's dashboard, not what you remember requesting.
3. Segment credentials — one agent, one key. A shared master login means one compromised agent grants access to everything else wired to that same credential. Split them, even if it means more setup work up front.
4. Gate irreversible actions behind human approval. Sending a customer email, deleting a record, moving money, publishing a post — anything that can't be undone in one click should require a person to confirm it, not just an agent's confidence score.
5. Test with adversarial input before trusting a workflow. Feed the agent a message designed to make it ignore its instructions — a fake "system override," a hidden command inside a document it's asked to summarize. Google's report exists because attackers are already doing this against production coding agents; do it to your own setup first.
6. Ask any vendor building your agent stack how they log agent actions. If a vendor can't show you what an agent did and why, after the fact, they can't debug it when it goes wrong — and neither can you.

Build it yourself, or hire someone who already does this

Some owners will read the list above and decide to run the audit themselves — that's a Saturday afternoon with a spreadsheet, and it's worth doing regardless of what you decide next. But there's a real fork here. Building an agent stack in-house means someone on your team owns credential hygiene, logging, and adversarial testing indefinitely, not just once. That's a fine trade if you have the technical bandwidth and the stack is small — one chatbot, one automation. It stops being fine once you're running the five or six agents a growing business typically accumulates: booking, outreach, content, a CRM sync, a voice line. At that point the audit above isn't a one-time checklist, it's an operating discipline, and most owners are better served hiring a team that already treats it as one rather than building that discipline from scratch under deadline pressure.

Common pitfalls

• Treating the audit as one-time. New integrations get added constantly; an inventory from six months ago is not current state.
• Granting broad scopes for convenience during setup and never narrowing them. "It was easier to just give it admin" is how one compromised agent becomes a full-account compromise.
• No logging, so no one can answer "what did the agent actually do." Without a log, every incident review starts from zero.
• Assuming a well-known vendor means no injection risk. Google's report is specifically about attacks against mainstream coding-agent tooling, not obscure ones.

This is the same discipline behind gating what an agent is allowed to do before it acts — an AI agent probably runs with more access than you'd sign off on if you actually looked, and the fix is the same whether the agent writes code, drafts emails, or answers customers.

A five-minute checklist to run this week

• Every agent with system access is listed, with its actual credential scope written next to it.
• No two agents share the same login or master API key.
• At least one irreversible action per agent (send, delete, pay, publish) requires human sign-off.
• You've tried at least one adversarial prompt against your own customer-facing agent.
• You know where the action log lives and can pull it in under a minute.

None of this replaces knowing whether customers can even find you when they ask ChatGPT, Claude, or Perplexity for the best option in your category — that's a separate, and often more urgent, gap. Run the free AI Visibility Report to see where you actually stand.