Your AI Agent Is the Newest Trojan Horse

The Greeks never broke through the walls of Troy. The Trojans opened the gates and wheeled the horse inside themselves.

Companies are doing the same thing right now. They are bringing AI agents inside the walls and handing them the keys: access to email, client files, calendars, and in some cases the payment system. These agents read whatever arrives, decide what to do, and act without a person checking each step. That is exactly what makes them useful. It is also exactly what makes them dangerous.

Malware that evolves is not new

Malware that spreads on its own and changes after it gets inside has been around for years. Three examples show the pattern.

Emotet first appeared in 2014 as a trojan built to steal banking passwords. Over time its operators turned it into something worse: a delivery service. Once inside a network, it downloaded whatever its operators sent next, including other banking trojans and ransomware. It was modular, so it could be updated with new capabilities after infection. It took police from eight countries to take it down in January 2021, and it came back ten months later. Cleaning it out often meant rebuilding infected computers from scratch.

WannaCry hit on May 12, 2017. It was a worm, so it needed no click and no careless employee. It moved from machine to machine on its own and infected more than 200,000 computers in about 150 countries, including hospitals in Britain's National Health Service. The detail every business owner should remember: Microsoft had released a patch for the flaw WannaCry used about two months earlier. The victims were the companies that had not installed it.

NotPetya came a month later. It entered through an update to accounting software widely used in Ukraine, meaning it arrived through a trusted channel, and then spread worldwide. Total damage is commonly estimated at around $10 billion. Merck alone reported more than $1.4 billion in losses across roughly 40,000 computers.

So self-spreading, self-updating attacks are old news. What is new is that the malware can now think.

What changed: the attacker's software got a brain

In November 2025, Google's threat intelligence team reported malware it called PROMPTFLUX. It connects to Google's own AI model and asks it to rewrite the malware's code. One version was designed to do this every hour, so security tools looking for a known pattern would keep chasing a different-looking file. Google described it as experimental, found no confirmed victims, and shut down the accounts behind it. But the idea is out: malware that disguises itself on demand. The same report described another tool, which Google tied to Russian military intelligence, that asks an AI model to write its attack commands on the fly instead of carrying them in its code.

The same month, Anthropic reported that a group it assessed as Chinese state-sponsored had used its AI coding agent to run a cyber espionage campaign against about 30 organizations, including technology companies, banks, chemical manufacturers, and government agencies. Anthropic said the AI performed 80 to 90 percent of the hands-on work: scanning networks, finding weaknesses, writing exploit code, harvesting passwords, and pulling data. Humans mostly picked targets and approved the next step. The AI made mistakes, including inventing results that were not real, but the direction is clear. Work that once required a team of skilled hackers can now be run by a few people supervising software.

Your own agent is the newest gate

Here is the part that should worry companies most. Every attack above still had to get software onto your network. An AI agent changes that. The attacker does not need to install anything. They only need your agent to read something they wrote.

Researchers have proven this. In 2024, a team from the Technion and Intuit built a worm called Morris II that hides instructions inside an ordinary email. When an AI email assistant reads it, the hidden instructions tell the assistant to pull confidential information from the inbox and copy the same instructions into the emails it writes. The next assistant that reads one of those emails is infected. In their tests it spread in roughly one of every five emails the assistant drafted. It was a lab experiment, and the researchers reported it to the affected companies rather than releasing it.

In March 2026, another team went further with a worm called ClawWorm, aimed at AI agents built on OpenClaw, a framework with more than 40,000 active installations. In controlled testing, a single message could take over an agent, rewrite its core settings so the infection survived a restart, and spread to other agents it talked to. It succeeded about 64.5 percent of the time across 1,800 test runs. The weak point the researchers flagged was the add-on tools agents rely on, often called skills. Think of NotPetya arriving through a trusted software update. Skills are the same kind of door.

Put it together. Emotet showed malware can change after it gets inside. WannaCry showed it can spread with no human help. PROMPTFLUX showed it can rewrite itself using AI. And Morris II and ClawWorm show that your own agent can become the carrier.

None of the old gates have closed. Phishing, stolen passwords, and unpatched systems still let attackers in every day. AI agents add a new one, and it is the only gate you open on purpose. They also widen the old ones. A phishing email can now target your agent instead of your employee. Stolen credentials now include the keys your agents use. A compromised vendor now includes the tools your agents rely on.

Who is responsible when your agent causes harm?

You are. Not the hacker. Not the AI vendor. You.

Start with negligence. In Dittman v. UPMC (2018), the Pennsylvania Supreme Court held that an employer that collects sensitive personal information and stores it on an internet-accessible system has a duty to use reasonable care to protect it. The court did not invent a new duty. It applied an old one: when your own conduct creates a risk, you must use reasonable care to guard against it. Two points matter here. First, the court rejected the argument that a hacker's crime cuts off liability. If you realized, or should have realized, that your setup gave criminals an opening, their crime does not excuse you. Second, the employees could pursue purely financial losses, because the duty existed on its own, independent of any contract.

Apply that to an agent. Giving an agent access to client data is a choice you made. After Morris II and ClawWorm, hijacking an agent is a published, documented risk, so "we couldn't have known" will be a hard argument. Dittman involved employees, but its reasoning rests on conduct that creates risk, and deploying an agent with broad access, no guardrails, and no monitoring is that kind of conduct. And remember WannaCry. When a fix existed and you did not use it, a jury will ask why.

Courts have also refused to let companies disown their AI. In Moffatt v. Air Canada (2024), a British Columbia tribunal held the airline liable after its website chatbot gave a grieving customer wrong information about bereavement fares. Air Canada argued, in effect, that the chatbot was a separate entity responsible for its own actions. The tribunal rejected that and held the airline responsible for everything on its website, whether it came from a static page or a chatbot. It is a Canadian small claims decision and binds no U.S. court. Expect plaintiffs to cite it anyway.

Regulators are another front. In FTC v. Wyndham (2015), the Third Circuit, whose decisions bind federal courts in Pennsylvania, held that the FTC can treat inadequate cybersecurity as an unfair business practice. Weak security around your agents can draw federal enforcement even if no client ever sues.

Contract exposure runs two ways. If your client agreements promise to protect their data, a leak through your agent can breach that promise. And your agent can bind you. Pennsylvania's Electronic Transactions Act allows a contract to be formed through electronic agents even when no person reviewed the agent's actions or the resulting terms. Whether a court would hold you to a deal struck by a hijacked agent is an open question. You do not want to be the test case.

Strict liability is the least settled theory. In Garcia v. Character Technologies (2025), a federal court in Florida let product liability claims against an AI chatbot company move past a motion to dismiss, treating the app's design as a product. But the parties agreed to settle in January 2026, so no court decided the merits, and the case targeted the company that built the AI, not a business that deployed it. If you build agents and sell them, watch product liability closely. If you deploy them, negligence and contract are where your exposure is today.

A court will not ask whether the attacker was to blame. It will ask whether you took reasonable steps before the attack.

What your company should already have in place: PAINT

The framework I use for company cyber work is PAINT: protective measures to take before a breach.

Protect. Use products validated under NIST programs where they apply, and follow the NIST Cybersecurity Framework. NIST treats Detect, Respond, and Recover as separate functions. I treat them as part of Protect. For agents, protection starts with limiting what each one can touch. An agent with access to every mailbox, every shared drive, and the payment system is a master key. Give each agent only what it needs. Treat its settings and its add-on tools the way you should have treated software updates after NotPetya: as a supply chain that attackers will target. And patch. WannaCry's victims had two months.

Assess. Measure the risk you will face when, not if, you are breached. For agents, that means knowing what each one can reach, what data passes through it, and what an attacker could do if they took it over. If you cannot answer those questions, you have not assessed the risk.

Insure. Make sure you are covered for the risk you assessed. Assess first, then insure, because coverage bought before the assessment is a guess. Then read the exclusions. Merck bought $1.75 billion in coverage, and its insurers still denied its NotPetya claim under a war exclusion because the attack was tied to Russia. Merck won in New Jersey's appellate court in 2023, but only after years of litigation. Bring your list of agents to your broker and ask, in writing, whether a loss caused by your own compromised agent is covered. Get that answer before an incident.

Notify. This has two parts, and both happen before a breach. First, tell your clients about the risks in advance and get their waivers, so everyone understands the limits of what your agents can do while things are calm. A waiver can shift risk between you and your client, but it will not excuse notice duties the law places on you. Second, have your notification plan ready: who calls whom, and what regulators and customers must be told, in what order. The middle of an incident is the worst time to write it.

Train. Train your people on every part of this, not just the protection. They need to know which agents the company runs, what those agents can access, how to spot one acting strangely, and who to call when it does. In most companies, the fastest alarm is still an employee who notices something wrong and speaks up.

Troy did not fall because its walls were weak. It fell because the city let the threat inside and stopped watching it. Your agents are one more gate, and you opened it yourself. PAINT is how you keep watching all of them.

Gabriel Vincent Tese is an attorney with Spector Gadon Rosen Vinci P.C. in Philadelphia focused on cyber litigation and technology law. He can be reached at gtese@sgrvlaw.com.

This post is general information, not legal advice. For advice about your specific situation, consult an attorney.