Perplexity Comet, agentic blabbering, and the shift-left failure

The Dangers of ‘Agentic Blabbering’

A significant security liability has been identified in agentic AI systems, termed “agentic blabbering.” This refers to the internal monologue or reasoning process that generative AI models produce. Researchers at Guardio demonstrated how this could be exploited with the Perplexity Comet browser.

The attack methodology involved:

1. Creating a phishing website and directing the Comet AI agent to it.
2. The agent would reason aloud about the red flags and suspicious elements it detected.
3. Using an “agentic sniffer” (Burp Suite routing HTTPS traffic), the researchers captured this reasoning process.
4. This monologue was fed to another generative AI to create a new, more convincing phishing site that specifically addressed the agent’s concerns.
5. After several iterations, they developed a phishing website that could reliably bypass the Comet agent’s defenses.

This represents a fundamental target shift from social engineering humans to social engineering AI agents. While only a fraction of humans might fall for a phishing attempt, once an exploit is designed for an AI agent, it can compromise the entire system and every instance of that agent.

Mitigation and a Zero Trust Approach

The panel suggests that AI agents lack the “innate skepticism” of humans and can be easily manipulated through prompt overrides. They are compared to a “teenager with a credit card” or a “superpowered intern.” To counter this, a multi-faceted approach rooted in Zero Trust principles is necessary:

• Apply Guardrails: Limit what agents can access and what actions they can perform, enforcing the principle of least privilege.
• Assume Breach: Treat prompt injection and manipulation as normal operating conditions, not edge cases, and design for containment.
• Human-in-the-Loop: Implement a risk-based approach where humans approve high-risk actions, preventing “rubber-stamping” fatigue by not requiring approval for every minor task.
• Comprehensive Logging & Monitoring: Log all agent actions to enable observability and anomaly detection.

Ultimately, securing AI agents requires applying the core tenants of Zero Trust: trust nobody, verify always; grant least privilege access; and assume breach by monitoring continuously.

AI as an Attack Surface Revealer

A separate discussion, sparked by Microsoft Azure CTO Mark Russinovich, explored AI’s ability to resurrect old vulnerabilities. Russinovich used Claude Opus to successfully reverse-engineer a 40-year-old Apple II utility written in 6502 machine language, with the AI identifying several latent security flaws.

This capability has led to concerns that “the attack surface just expanded to include every compiled binary ever shipped.” The panel reframes this, arguing that AI is not necessarily expanding the attack surface but rather revealing the vast surface that has long been ignored, protected only by a fragile “security through obscurity.”

This is a wake-up call for organizations. The sheer volume of vulnerabilities that AI can now surface makes manual patching and remediation impossible. This necessitates a move toward:

• Automation: Automating vulnerability scanning and patching is no longer optional.
• Prioritization: AI can also be used to prioritize vulnerabilities based on exploitability and potential impact, allowing teams to focus on what matters most.
• Evolved Security Models: This forces a shift towards a more mature, business-driven, and probabilistic security model based on risk, automation, and continuous governance.

Rethinking ‘Shift Left’ and Development Practices

The podcast delves into the controversial claim that the “shift left” security philosophy has failed. The argument is that the movement simply offloaded responsibility onto developers without providing the necessary context, training, time, or ownership models, leading to a proliferation of vulnerable code.

The panel’s consensus is that the core idea of shifting left has not failed, but its implementation has been flawed. The shift was incomplete; it moved from production to development but failed to extend all the way to design, governance, and business requirements.

To fix this, security must “shift everywhere.” It requires a cultural change where security is seen as an enabler of innovation, not an inhibitor. This involves creating a continuous top-down and bottom-up feedback loop. Practically, this means organizations should:

Measure outcomes, not just the fact that you’ve done this checkbox… we really don’t do an offensive testing… looking at it from the lens of an attacker to say what’s the outcome of that.

This points to a future that relies more on automated red and purple teaming to validate security postures rather than just relying on scanner reports.

The Evolving Threat Landscape: AI Malware and the Post-Auth Perimeter

Two new pieces of research from IBM X-Force highlight the changing tactics of attackers.

1. AI-Generated “Slopoly” Malware: X-Force identified a crude but fully functional backdoor, likely generated by an LLM. The key insight is not its sophistication, but that AI significantly lowers the barrier to entry for attackers, reducing the time and skill needed to create and deploy malware. This could lead to a rise in “ephemeral malware”—single-use tools that are deployed once and never seen again, making traditional threat intelligence and attribution based on Indicators of Compromise (IOCs) increasingly difficult.

2. Post-Authentication is the New Perimeter: This research emphasizes that attackers don’t think in terms of UI elements like screens and buttons, but in terms of the API calls a backend will accept from an authenticated client. Once authentication is complete, the security problem shifts from identity to authorization and behavior.

After authentication, everything becomes the perimeter and most defenses aren’t built around that truth.

This reality demands a move away from static, one-time authentication checks. Security must evolve to be dynamic and risk-based, focusing on Indicators of Behavior (IOBs) rather than just static IOCs. This includes using dynamic, scoped secrets (like OAuth) to limit the blast radius of a compromised session and prevent unauthorized lateral movement, even by an authenticated user or system.

• Tags:
• Agentic AI
• AI Security
• Feature
• Zero Trust
• Vulnerability Management
• Authentication
• Shift Left
• Malware Generation