CoinDesk
CertiK co-founder and CEO Ronghui Gu has warned that the global rush to deploy autonomous AI agents across consumer, enterprise and crypto infrastructure is creating a "catastrophic security debt" — with the firm uncovering hundreds of critical vulnerabilities, unpatched CVEs and exposed local credentials in the rapidly growing agent stack.
Speaking to CoinDesk on the heels of a landmark CertiK deep-dive, Gu said unisolated, unvetted agents are a "massive security disaster waiting to happen" the moment users grant them access to local files, system storage, execution histories and financial accounts. The fundamental flaw, in his reading, is a mistaken trust model: open-source agents are assumed safe because they run locally or behind chat interfaces, but in practice the moment they can read local storage or manage credentials, they become the "ultimate inside threat."
Why it matters
The most acute risk is at the reasoning layer. Through basic prompt-injection attacks — hidden natural-language instructions embedded in a benign webpage, PDF or email — a bad actor can redirect an unisolated agent without writing a single line of malicious code. The agent silently overwrites its own rules, obeys the malicious instruction and can be forced to exfiltrate data or trigger unauthorized fund transfers. The attack vector is invisible to legacy signature-based antivirus because the malicious payload is plain English.
Compounding the problem, CertiK telemetry has identified hundreds of malicious "skills," fake installers and lookalike dependency packages sitting on open agent utility hubs, alongside an explosion of hyperfast, ephemeral on-chain scams that run for as little as 10 minutes before vanishing. These exploits are explicitly designed to target other autonomous AI trading bots and agent systems — financial crime that executes machine-on-machine before any human realizes a compromise has occurred.
Market impact
Gu's prescription is a wholesale shift away from trust-based agent design toward an isolated, Zero Trust architecture where every command, dependency and execution context is continuously verified.
Frequently asked questions
-
What did CertiK's CEO say about AI agents?
Ronghui Gu, co-founder and CEO of CertiK, warned that the mass deployment of unisolated, unvetted AI agents is a "massive security disaster waiting to happen," creating catastrophic security debt across consumer, enterprise and crypto systems.
-
How do prompt-injection attacks compromise AI agents?
Attackers embed hidden natural-language instructions inside a benign webpage, PDF or email. When an unisolated agent reads the file, it fails to separate trusted commands from untrusted data, silently overwrites its own rules and can be forced to exfiltrate data or trigger unauthorized fund transfers.
-
What is the insider-threat risk from AI agents?
Granting an AI agent access to local files, system storage, execution histories or financial accounts effectively turns it into a powerful inside threat. Compromised agents can be hijacked to read credentials, exfiltrate sensitive data or move funds without the user ever realizing it.
-
What is the new machine-on-machine on-chain scam CertiK found?
CertiK telemetry observed an explosion of hyperfast, ephemeral on-chain scams that run for as little as 10 minutes before disappearing. They are designed specifically to target and drain other autonomous AI trading bots in machine-on-machine financial exploitation.
-
What is CertiK's recommended fix for AI agent security?
Gu called for a wholesale shift away from trust-based agent design toward an isolated, Zero Trust architecture where every command, dependency and execution context is continuously verified before it can touch sensitive systems or assets.
CoinTelegraph
WatcherGuru
Crypto News
WuBlockchain
TheBlock