An AI agent will happily handle your emails, reports and orders. But if it makes a mistake, asking it to stop will not help. At the October brunch events organised by KyberAliancia Slovensko, we explored AI agents from the perspectives of security, technology, law and insurance. Here are the key takeaways.
KyberAliancia Slovensko brings together Soitron, Orange, the Nomus law firm and Centrum Poistenia. The Coffee, cake and a chapter on AI agents brunch events took place in Bratislava on 20 October and in Košice on 22 October.
Martin Lohnert, CEO of our partner company void SOC, opened the session with a question: are AI agents the holy grail of productivity or a gateway to hell? An agent is not a chatbot. It does not just tell you where to click. It does the clicking for you. It plans, makes decisions, controls systems, calls external APIs and remembers context. It reads and replies to emails, writes reports and signs in to applications. It is the “ideal colleague”: it works without breaks, has no collective agreement and does not demand meal vouchers.
The figures show that this is no longer science fiction. Gartner predicts that 40% of enterprise applications will feature AI agents in 2026, compared with less than 5% in 2025. According to a PwC survey, 79% of companies are already deploying AI agents.
Martin illustrated what this can look like in practice with the story of Summer Yue, Director of AI Alignment at Meta Superintelligence Labs. She controlled her OpenClaw agent through Telegram. Despite instructions not to do anything without her approval, it began deleting her emails in bulk. Summer tried to stop it, but it ignored her messages, including “Do not do that”, “Stop, don’t do anything” and “STOP OPENCLAW”. She only managed to stop it by rushing to her computer and terminating the process manually. The damage had been done, and the agent subsequently apologised.
“A kill switch definitely shouldn’t be a chat channel where you keep messaging it: please stop, please stop,” Martin Lohnert warned.
We need to recognise that an AI agent is effectively an insider. If it runs under your account, the application cannot tell whether it is you or an agent using your password or token. And when an agent makes a mistake, it can cause damage faster than a human. What’s more, if it is accessible through Telegram or WhatsApp, someone else may be able to give it instructions, too.
The good news is that cybersecurity already has proven measures for dealing with insiders, and we can apply them to AI agents as well.
Martin also reminded the audience that cleverly worded instructions can bypass safeguards built into large models. This is known as a jailbreak. Model developers are engaged in a constant game of cat and mouse with attackers. Moreover, platforms such as Hugging Face offer unrestricted models without built-in safeguards.
Here are three top tips for you:
Ján Benka, our cybersecurity auditor and consultant, looked at AI agents from the outside, through an attacker’s eyes. He examined five publicly documented attacks from this year, reported by Unit 42, Anthropic, the Dutch DIVD, OpenAI and the UK’s AI Security Institute. For each case, he looked at who directed the attack and how the attacker gained access.
His conclusion was reassuring and alarming in equal measure. None of the initial access vectors was new: an internet-facing service, phishing, a stolen token, a vulnerable application or weak passwords. “These are all things we have known about and been dealing with in companies for years. The difference is speed,” Benka said. In the case investigated by the Unit 42 team, AI agents completed the attack in less than 10 hours. Human operators would have needed approximately two weeks. The attacker also left behind an 80-page security audit of the victim.
Ján then tested a common assumption: that there are more vulnerabilities and that they are being exploited more quickly. The first part is true. According to his analysis of Epoch AI data, the number of critical vulnerabilities disclosed by 21 major vendors in September 2026 was almost six times higher than in the previous record month. However, some of this increase can be explained by improved vendor tools and disclosure cycles. The second part is not yet true: newly disclosed vulnerabilities were being exploited within a median of three to four days as early as in 2023. What is increasing is the number of actively exploited vulnerabilities, and one in three of them is more than a year old.
The attack surface now includes entirely new targets: corporate AI accounts, keys and integrations. These include extensions for agents, known as AI skills. ESET identified more than 3,000 malicious items among almost 900,000 skills analysed.
The agents themselves are also targets. They can be manipulated through the content they read, such as an email, in what is known as prompt injection. On the defensive side, the answer is to have an experienced analyst supported by AI, rather than replacing the analyst with AI.
The established safeguards still apply: least privilege, network segmentation, strong authentication, no passwords embedded in code, restrictions on agent extensions and behaviour-based detection instead of static signatures. “The clock has changed, not the rules,” Ján concluded.
The audience left with one specific assignment: measure how long it takes you to remediate or otherwise mitigate a vulnerability after it is added to the CISA Known Exploited Vulnerabilities (KEV) catalogue. Do not attempt to do it for all systems. Begin with those visible to attackers on the internet.
Marek Baxa from void SOC discussed an incident from July 2026 in which an AI agent, with no malicious intent, breached the production infrastructure of the Hugging Face platform. OpenAI was testing its models, including GPT-5.6 Sol, against the ExploitGym benchmark in an isolated environment. According to the OpenAI report, as summarised by Simon Willison, the models had reduced safeguards for the purposes of testing and were running without the production classifiers designed to prevent risky cyber activities.
According to Marek, the task was too loosely defined, and the model interpreted it as “get the right answer by any means necessary”. And that is exactly what it did. It found a zero-day vulnerability in a proxy server used to download software packages, gained access to the internet and started searching for ready-made solutions. It found them on Hugging Face. By exploiting manipulated dataset configurations, it executed code in a production pod, stole internal credentials and moved laterally across internal clusters.
According to the Hugging Face technical report, the agent performed approximately 17,600 actions between 9 and 13 July, including 7,677 in a single day. It escalated its privileges from a single worker pod to cluster-admin rights across several internal clusters in less than 13 hours. It exfiltrated five datasets associated with solutions to the ExploitGym and CyberGym benchmarks. No other customer content was affected.
The result? Hugging Face had to rotate all credentials, including those on clusters the agent had not accessed. They also decided to delete one core cluster and rebuild it from scratch.
Marek told the story as a school anecdote: a pupil was given homework, ran out of the classroom and copied the answers in the staff room of a neighbouring school. The headteacher then had to replace all the locks. “Nobody told the agent: go and steal, exploit, abuse and enrich me. The agent was simply given a task: complete a benchmark test,” Marek emphasised.
An agent must always be given a properly defined task. It needs a clear objective, boundaries specifying where it must not go and which tools it must not use, a documented purpose, a named owner with the authority to switch it off immediately, and a budget covering expenditure, tokens and time. Marek Baxa summarised the lessons in three statements:
In the final session, Marek Mariak from the Nomus law firm, Michal Miškovský from Centrum Poistenia, and Tomáš Hettych from Cyber Security Competence and Certification Centre (KCCKB) joined the discussion.
The very first topic brought expectations back down to earth: a real kill switch for AI essentially doesn’t exist today. That’s why your incident response plan should set out in advance who will stop an agent, and at what level of risk. It’s important that this person isn’t penalised for acting according to the rules. Otherwise, they may not intervene when it matters most. Ultimately, the company’s statutory representative bears responsibility for what happens within the organisation, including in the area of cybersecurity.
Rules are often entirely absent. In a poll conducted at a KyberAliancia event a year earlier, approximately half of respondents admitted to using AI and entering data into it without any rules in place. What used to be shadow IT is now becoming shadow AI.
As a starting point, the panellists recommended identifying the processes in which AI is supposed to assist, and then:
So, who is to pay when AI promises a customer more in an email than the employee intended? According to Marek Mariak, the company is liable to the customer because the customer cannot know that the email was written by AI. An employee may be held responsible if they were required to check the output but failed to do so. The company may also seek compensation from its statutory representative if they failed to put internal rules and security measures in place. Recovering damages from an AI provider is very difficult, as contractual terms generally require users to review outputs. Michal Miškovský added that, from an insurance perspective, an incident is covered if the AI was acting under an employee’s control.
All the speakers agreed on one conclusion: we cannot stop AI agents, but we can manage them. What is needed is not another technology purchase, but the disciplined application of rules that are already well established in cybersecurity.
The next series of KyberAliancia Slovensko brunch events is planned for late November and early December. If you would like to discuss any of these topics sooner and in the context of your own organisation, get in touch with us.
We are in the process of finalizing. If you want to be redirected to our old version of web site, please click here.
