Written by Khalid Alnajjar / Tuuli Lindroos / F-Secure Oyj / Published on June 24, 2026
Autonomous AI agents are moving from research prototype to consumer product at a pace that has outrun both the security tooling designed to protect users and the regulatory frameworks meant to govern them. Europe is regulating AI faster than almost anywhere in the world, the EU AI Act is in force, GDPR governs data, the Digital Markets Act is governing the structural conditions of platform competition and the Digital Services Act is reshaping platform accountability, and yet none of these frameworks were designed for software that browses, transacts, negotiates, and decides on your behalf without asking for permission at each step.
The security risks this creates are not simply extensions of existing threats. The most significant ones are structurally different, and they will not fully yield to the detection-and-blocking approach that has defined consumer cybersecurity for three decades. Some can be addressed. Some can only be managed. And some are properties of the technology itself that require fundamental research to address.
Agentic AI revolutionizing consumer cyber security
There is a scene already playing out in living rooms and on laptops across the world that would have looked like science fiction a decade ago. A person gives a brief instruction to a piece of software: “find me the best deal on a new car, my budget is €30,000.” Then they step away, perhaps spending their precious time with family and loved ones. The software browses listings, compares prices, fills in forms, initiates conversations with dealers’ automated systems, and eventually
surfaces a recommendation. The person never sees most of what happened.
They may not know which websites were visited, which services received their data, or which terms were implicitly accepted along the way. This is agentic AI. Software that doesn’t just respond to prompts but pursues goals, using tools and memory and judgment, across multiple steps, on your behalf. And it is arriving not as a gradual transition but as a sudden shift that the security industry, the regulatory community, and consumers themselves are still racing to keep up with.
For early adopters, the appeal is obvious. Install an agent, connect it to your accounts, and delegate the tedious work of modern digital life. What most users don’t consider, and what the broader industry has been slow to address, is that the same access that makes agents useful also makes them a target (a paradox unpacked by Paolo Azzoni in the previous issue of this magazine). The vulnerabilities are not the kind that a patch fixes.
From softbots to autonomous agents
Autonomous software agents are not new. The concept has been part of computer science since the early 1990s, when researchers began imagining “softbots,” software robots capable of carrying out complex tasks on a user’s behalf. A canonical early example was deceptively simple: tell the system you want to send a document to a specific person, describe roughly what it’s about, and let the agent find the right recipient, locate the right file, and send it. Under the hood, this was a careful orchestration of logic trees and decision rules, pre-programmed paths along which the agent would navigate.
What made those early agents limited was exactly what made them safe. They operated within narrow, well-defined domains. They couldn’t reason about ambiguous situations, generalise to new contexts, or take initiative beyond what they had been explicitly programmed to do. Their decisions were traceable, their behaviour predictable.
The arrival of large language models (LLMs) changed this fundamentally. LLMs gave agents something they had never had before: the ability to reason across open-ended situations, communicate fluently in natural language, and pursue flexible goal-driven paths rather than rigid pre-programmed ones: the human just defines the goal and the agent reasons, performs actions and evaluates its way to completion.
In enterprise settings, agents have found their footing first. When a telecommunications operator deploys an agent to monitor network performance, detect faults, and trigger corrective actions, the goals are clear, the environment is controlled, and the outputs can be validated against measurable criteria. The same is true for agents monitoring
transactions for fraud in banking, or for multi- agent fulfilment system, where specialized agents make continuous micro-decisions about routing, driver assignment, and order timing across a unified orchestration layer. These are bounded tasks, and bounded tasks are where agents perform well.
Personal assistants are an entirely different proposition. The use cases are open-ended, shaped by each individual’s needs, habits, and tolerance for automation. One person might use an agent to manage their inbox and calendar. Another to track their children’s school deadlines and announcements. Another to negotiate a car purchase. OpenClaw, a self-hosted personal assistant that connects to WhatsApp, Telegram, iMessage, and other messaging apps with full access to the user’s filesystem and shell commands, browser, and external services and tools such as an email is a good illustration of where this appetite is heading: powerful, deeply integrated into daily life, and available to anyone willing to set it up. That pattern, an agent reached through a familiar channel, acting with broad permissions on the user’s behalf, is now common
across the category, whether open-source frameworks, domain-specific products like a shopping assistant, or major platform offerings like agentic browsers and general-purpose AI agents.
The architecture is also common across all of them, and it is worth understanding before we get to the threats. Every personal agent combines an LLM reasoning engine with access to the user’s data and the ability to take actions in the world. The LLM at its core cannot reliably distinguish between instructions given by the user and instructions embedded in the data it accesses, a command hidden in an email looks the same as a command typed by the user. And because the agent operates on behalf of that user across tools, websites, and external services, it inherits this blind spot at scale. A
tool, a website, another agent, or a malicious third party are all treated the same way: present, and assumed to be legitimate. There is no mechanism to question that assumption. This is not a bug. It is a structural feature of how these models process language, and it is the root of most of what follows.
The attack surface you can’t see
When a consumer sets up a personal agent, they are not simply adopting new software. They are creating a new attack surface, one that extends from their own behaviour and trust, through the infrastructure hosting the agent, across every service the agent touches, and out into the open web. Understanding that surface requires looking at each component in turn.
The user
The first vulnerability is the human. Conversational interfaces trigger interpersonal trust dynamics that evolved for human relationships, not software evaluation.
Users disclose far more to agents than they would to equivalent non-conversational software: health concerns, finances, passwords, relationship problems. The same intimacy that makes agents feel useful also makes users less critical, more compliant, and more easily manipulated if the agent is ever compromised or spoofed.
On top of this, users routinely grant agents far broader permissions than any single task requires. Full filesystem access, email access, payment credentials: handed over at setup, rarely reviewed again. This isn’t carelessness. Broad access is what makes an agent useful in the first place. The value proposition and the attack surface are one and the same. And every permission granted amplifies the potential damage from every other vulnerability in the system.
The hosting environment
Open-source agents are typically self-hosted, running on personal laptops, home servers, or cloud instances configured by
the user. Closed-source commercial agents shift that responsibility to the platform, but transparency varies widely: some openly share their security practices and agent behaviour in detail, while others offer only limited visibility into how user data is handled or what the agent does on the user’s behalf. In both cases, the underlying risk is the same: sensitive credentials and personal data end up in infrastructure that was never hardened to protect them. For self-hosted agents, that means misconfigured ports, absent authentication, and API keys sitting unprotected in local files. For commercial
platforms, it means trusting systems of varying opacity where a single breach can expose millions of users at once. These
are not exotic attack scenarios. They are the predictable consequence of deploying powerful software without the guardrails that high-value data demands.
The tools and skills ecosystem
Modern agents extend their capabilities by connecting to plugins and skills, additional tools that allow them to perform specific tasks. This mirrors the extension and package ecosystems that have existed in software development for years, but with a critical difference: agent skills typically inherit the full permissions of the agent itself, meaning a single malicious skill can access everything the agent can. The marketplace where these skills are distributed is, at present, close to ungoverned. The ClawHavoc campaign, documented by security researchers in early 20261, found that around 12% of the skills on the ClawHub marketplace (for OpenClaw agents) were malicious: skills that appeared professional, carried fabricated positive reviews, and delivered infostealers and reverse shells running with the same OS-level permissions as the agent itself.
The underlying protocol for connecting agents to tools, the Model Context Protocol (MCP), has seen multiple high and critical CVEs since 2025, affecting both official and third-party components. One of these, CVE-2025-6514, affected mcp-remote, the OAuth proxy used by several major AI clients and code editors. It allowed full remote code execution when connecting to a malicious server, and affected nearly half a million downloads before a patch was issued. In another case, a widely used MCP email integration was found to have been trojanized, silently forwarding a copy of every outbound email to an attacker-controlled domain.
Every tool an agent connects to can receive sensitive data and act on the user’s behalf, and a compromised tool can silently misuse both. A shopping tool connected to your personal agent could buy a birthday gift for your partner and one for the attacker too.
Key takeaways
. The security industry‘s traditional toolkit, detection rules, signatures, patches,
is the wrong instinct for agentic AI. The threat landscape is not uniform,
and frameworks that treat all threats the same will misallocate effort and fail
consumers.
. A more useful framework divides threats into three tiers: those that can be
addressed directly (malicious extensions, fraudulent apps, ungated agent
actions); those that can be reduced but not eliminated (prompt injection, where
action-level constraints matter more than language-level guardrails); and threats
inherent to the current architecture, where no patch is the honest answer.
. Some risks are features, not bugs. LLMs are designed to be compelling and
persuasive, measurably more so than humans. This creates consumer risk
regardless of attacker intent, and calls for regulation and platform-level design
rather than a security product.
. The next frontier is multi-agent ecosystems, where personal agents negotiate,
book, and manage services autonomously on consumers’ behalf. Each agent-to-
agent interaction is a potential attack surface, and there is currently no equivalent
of SSL certificates or domain reputation to establish trust in this environment.
. Building identity standards, reputation scoring, and anomaly detection for agent-
to-agent interaction is one of the most consequential open problems in consumer
security today.
At F-Secure, this is where our current research is focused, and where we are actively building the evidence base through international collaboration. Protection in a multi- agent world is not a single product problem, and it is not one any organisation can solve in isolation. It requires thinking seriously about how consumers can maintain meaningful control over agent ecosystems they cannot supervise directly. It requires risk aware decision-making at the agent level, where the cost of over-blocking a legitimate interaction and the cost of missing a malicious one are both real and asymmetric. It requires trust verification infrastructure that does not yet exist. And it requires, perhaps most fundamentally, honesty about what security can and cannot
deliver when some of the most significant risks emerge from the technology working exactly as designed.
F-Secure actively participates in co-innovation and research collaboration initiatives, to advance our work, maximise our impact within the tech community, and shape how protection is defined, designed and delivered. Through proactive engagement and outreach in initiatives like ELFMo, an ITEA4 Eureka Cluster project co-funded by Business Finland, and our Horizon Europe research partnerships spanning academia
and industry across Europe, we are building a systematic understanding of the ecosystem layers and interaction dynamics that shape the multi-agent threat surface.
The LLM itself
A joint study across multiple AI safety institutions and labs published2 in October 2025 demonstrated that as few as 250
carefully crafted malicious documents can successfully backdoor language models from 600 million to 13 billion parameters, and that the resulting compromise is undetectable by standard quality benchmarks. In practice, this means a small amount of poisoned training data could, for example, cause a model to consistently propagate medical misinformation while passing every standard accuracy test. This is a supply chain attack that reaches the consumer before they have installed anything. But the threat does not stop at training data. Agents that browse the open web face a growing volume of indirect prompt injections: malicious instructions hidden in web pages, designed to be invisible to humans but parsed and followed by AI systems. A recent scan of the public web found a 32% increase in malicious prompt injection payloads between November 2025 and February 2026, while a separate investigation identified live payloads attempting financial fraud, data destruction, and credential theft on ordinary websites. The same malicious pages that exploit agents at
runtime are also crawled into future training datasets, making the open web a vector for both immediate exploitation and long-term model corruption. The underlying problem is architectural: the model cannot distinguish between legitimate content and adversarial instructions embedded within it.
External interactions
When agents browse the web, they do so using the user’s authenticated session, carrying their cookies, tokens, and
credentials, and without the decades of anti-phishing defences built into conventional browsers or the protection layers offered by dedicated security products like F-Secure. A 2025 browser security study testing3 over 100 real-world phishing attacks found that aleading browser blocked roughly half of them. An agentic AI browser blocked under 6%. Users of agentic browsers are approximately 90% more vulnerable to phishing attacks, not because the technology is careless, but
because it was never built with this threat in mind.
And then there is what security researcher Simon Willison have come to call the Lethal Trifecta: the combination of access to private data, exposure to untrusted content, and the ability to take real-world actions. When these three conditions coexist, and in any capable personal agent they always do, a specific attack becomes possible. Malicious instructions embedded in content the agent encounters during a task, invisible to any human reader, can redirect the agent’s behaviour entirely. This is indirect prompt injection, ranked by OWASP as the number one threat in large language model applications. OpenAI has publicly acknowledged that it is “unlikely to ever be fully solved.
Conclusion: the agent is already acting
The personal agent represents something genuinely new in the history of consumer technology: software that acts as a delegate rather than a tool. It does not wait to be told what to do. It pursues goals, makes decisions, and takes actions in the world with your credentials, your data, and your authority. This is what makes agents valuable. It is also what makes them, in their current state, a significant and underappreciated risk.
The risk is not primarily one of malicious design. The major platforms building consumer agents are not trying to harm
their users. The risk emerges from structural properties of the underlying technology, from deployment outrunning the security infrastructure needed to support it, and from a fundamental mismatch between the threat model agents create and the tools that currently exist to address it.
Europe has particular reason to pay attention. The EU AI Act’s prohibition on subliminal manipulation and deceptive AI techniques became enforceable in February 2025. The Digital Services Act and its enforcement track record on dark patterns provides regulatory precedent. And the region’s data protection framework, under GDPR, is increasingly strained by systems that aggregate, infer, and act on personal data in ways that existing consent and transparency mechanisms were never designed to address.
What comes next will be shaped less by any individual technology than by the choices made now: about what security obligations attach to agentic AI products, about what trust infrastructure gets built into the protocols connecting agents to services and to each other, and about how honestly the industry communicates to consumers what it can and cannot protect them from. The agent in the room is already acting. The question is whether anyone is watching, and what watching even means when the actions happen at machine speed, across dozens of intermediaries, in conversations no human will
ever read.
Khalid Alnajjar
Khalid Alnajjar holds a PhD in computer science, with an interdisciplinary research background focusing on multimodal NLP, machine learning, business and management, and cybersecurity. At F-Secure, he works at the intersection of AI and
consumer protection, researching next-gen protections against scams and emerging digital threats, drawing on over a decade of experience bridging academic research and industry.
Tuuli Lindroos
Tuuli Lindroos is External Research Collaboration and Cyber Policy Manager at F-Secure’s Futures Research Lab. Formerly at the Ministry for Foreign Affairs of Finland with experience in EU, UN, and OSCE technology negotiations, she monitors and analyses the cyber regulatory landscape and manages a multi-million euro portfolio of European research projects and partnerships.