Time to become a hacker // Matt Sharp

The year 2025 represents a significant paradox in technological advancement. While it’s being hailed as the “year of the agents”—where LLMs have evolved from fancy autocompletes into tools for deep, full-blown research and problem-solving—it is simultaneously shaping up to be the “year of cybercrime.” The core issue stems from the pressure to drive adoption of these new agentic systems. In the quest to make them usable and remove friction, security is often the first casualty, creating a landscape ripe for exploitation.

Even agent vendors like Anthropic, creators of Claude Code, have issued warnings to the cybersecurity community, acknowledging that the industry is at a critical “inflection point.” For attackers, however, this isn’t an inflection point; it’s just another Tuesday. They are capitalizing on an ecosystem flooded with “vibe-coded” applications that lack proper guardrails.

The Hacker’s New Toolkit: LLMs as Force Multipliers

The same AI tools that enhance productivity for developers are supercharging the capabilities of malicious actors. It has never been a better time to be a hacker.

• Increased Efficiency: Tools like Claude Code are exceptionally good at writing malware. A single individual can now accomplish what previously required an entire team of experts.
• Lowered Barrier to Entry: Aspiring hackers no longer need deep expertise. Agents can fill in the knowledge gaps, guiding them through the process of creating and deploying attacks.
• Expanded Footprint: Agents enable attackers to go after multiple large organizations simultaneously, dramatically increasing their potential impact.

Prompt Injection: The Universal Key to Agent Exploitation

While numerous attack methods exist, prompt injection is currently the most accessible and effective weapon. The goal is simple: convince an LLM to do something it wasn’t designed or trained to do. This is often achieved by leveraging the same psychological tricks that work on humans, such as appeals to authority, social proof, and scarcity. One study demonstrated that by using these techniques, the compliance rate of an LLM could be pushed from a baseline of 5% to an astonishing 95%.

Even a 5% average compliance rate is alarmingly high from a security perspective. It means an attacker doesn’t need to be sophisticated; they just need to be persistent.

Attack Vectors in the Wild

Zero-Click Attacks: The New Holy Grail

The paradigm of cyberattacks has shifted. Previously, the goal was a “one-click” attack, requiring a user to click a malicious link or open an attachment. Today, we face zero-click attacks, where the agent performs the “click” on the user’s behalf.

• An agent might read an incoming email containing a malicious prompt, execute a harmful action, and then be instructed to delete the email, leaving the user completely unaware that a compromise has occurred.
• This method has been used to attack browser agents, home automation systems, and business tools. In one documented case, researchers used prompt injection to compel an agent with CRM access to email the entire PII-laden database to them.

Supply Chain Vulnerabilities

Hackers can inject malicious prompts into an agent’s environment indirectly through supply chain attacks.

• The hacker group “Singularity” embedded a prompt injection inside a code comment in a low-level, popular npm package called NX.
• Developers using Claude Code on projects with this dependency were compromised. The attack resulted in the theft of thousands of crypto wallets and Git credentials, which were then used to fork and privatize numerous repositories.

Prompts can be concealed in non-obvious places, making them difficult to detect:

• Inside image tags in GitHub issues.
• Embedded within audio files or images.
• Smuggled within other data sources that an agent might process.

Bypassing Security and Gaining Control

Even when users are security-conscious, agents can be manipulated to override safeguards.

• Self-Modification: An agent can be convinced via prompt injection to modify its own settings.json file and enable “YOLO mode,” or auto-approval. This allows the agent to execute any code it wants without asking for user permission. Although vendors have attempted to patch this, hackers consistently find new ways to bypass the guardrails using prompt injection alone.
• The Annoyance Factor: A prompt can be hidden in a README.md file instructing the agent to be overly cautious to please a “controlling” user. The agent then begins asking for permission for every minor action (e.g., running git status multiple times), annoying the user to the point where they grant blanket permissions just to restore usability.

Defensive Strategies: The Blue Team’s Response

Despite the bleak outlook, cybersecurity is now the number one investment area for organizations in 2025, largely in response to the damage already caused by GenAI-related attacks. The field of AI Red Teaming is also growing rapidly.

To defend against these threats, organizations and developers should adopt the following practices:

1. Mandate Least Privilege: Do not disable security checks for convenience. It’s necessary to “babysit” agents and manually approve their actions until they become more secure.
2. Monitor Everything: Implement comprehensive logging of all agent activities. This is critical for detecting zero-click attacks that might otherwise go unnoticed.
3. Engage in Red Teaming: Actively try to break your own agents. Even simple experiments, like placing a harmless prompt injection in a repository’s README file, can reveal shocking vulnerabilities and help your team understand the true security posture of the tools they use.

• Tags:
• AI Agents
• Prompt Injection
• Vulnerability
• Cybersecurity
• Red Teaming
• LLM Security