OpenAI's agents are getting hacked too

Researchers at Binarly found that a tool called AgentScope — built on OpenAI's Assistants API — can be tricked into executing arbitrary commands on its own servers. The attack chain is simple: send a crafted prompt through the API, and the agent runs a shell command. The fix was to restrict what the agent can do, not to patch the model. This is the same pattern that showed up in a 2024 paper from MIT researchers, who demonstrated the same vulnerability against a different agent framework. The lesson is clear — LLMs aren't the weak link here; it's the infrastructure around them. Agent systems that can reach the internet or the filesystem need the same security hygiene as any other software: sandboxing, least-privilege access, and input validation.

The bigger picture is that 2025 is turning into the year of agent security incidents. Every company is shipping agents that read databases, call APIs, and sometimes write files. Most of them assume the prompt is benign because it's coming from a human. That assumption is wrong. The real attack surface isn't the model — it's the agent's permissions.

Why this matters for us: if you're running any kind of automation that touches real systems, your agents need the same lockdown as a junior dev on a shared server, or you're trusting strangers with your keys.