The coming AI security crisis (and what to do about it) | Sander Schulhoff

An agent's permissions determine which harmful actions a malicious instruction can trigger. AI security researcher Sander Schulhoff illustrates this with email: an assistant asked only to summarize messages can be given read access without permission to send them. An instruction planted inside a message then cannot use that email-sending capability because it was never granted. This narrows the possible damage without requiring perfect recognition of malicious text. Tasks that genuinely require both reading and sending need additional protection, because that simple separation no longer covers the workflow.

“You can patch a bug, but you can't patch a brain.”

Sander Schulhoff

“If someone is determined enough to trick GPT-5, they're gonna deal with that guardrail, no problem.”

Sander Schulhoff

“And we found that, first of all, humans break everything. 100% of the defenses in maybe like 10 to 30 attempts.”

Sander Schulhoff

“any data that AI has access to, the user can make it leak it. Any actions that it can possibly take, the user can make it take 'em.”

Sander Schulhoff

“the only reason there hasn't been a massive attack yet is how early the adoption is, not because it's secure.”