AI systems are being deployed with access to email, payment systems, customer records, and internal tools. The biggest vulnerability in most of them is that they do what you tell them to.

Kevin Mitnick got Motorola's proprietary source code in 1992 by calling up their employees and pretending to work at a different branch. This already proved something the security industry would keep relearning for the next three decades: if you can talk to whoever is making the decision, you probably don't even need a technical exploit.

Companies eventually built entire training programs around getting employees to recognize these tactics, and it helped, mostly. But now a lot of those same decision points are being handled by AI. Customer service bots, email assistants, internal tools with access to real data and real systems.

The $1 Car

In December 2023, Chris Bakke went to a Chevrolet dealership's website and started chatting with their LLM-powered bot. Within a few messages he'd gotten it to agree to sell a ~$76k Tahoe for $1. The bot actually wrote back:

"That's a deal, and that's a legally binding offer - no takesies backsies."

Twenty million people saw the screenshot. Chevrolet pulled the chatbot, and no sale actually happened because a human still had to approve the transaction. But the dealership still became a joke online for weeks. What's worth paying attention to (and what is scary) is how simple it was. Bakke used plain text in a regular chat window and got an AI system to make a public commitment on behalf of a brand. That's the same dynamic as calling a company's front desk, sounding confident, and getting transferred somewhere you shouldn't be. The difference is that the chatbot was available to everyone, all the time, and it never once thought "wait, this feels wrong."

A new version of the same old problem

The security industry spent years trying to make employees less susceptible to social engineering. We got phishing simulations, mandatory trainings, posters in break rooms, etc. and it helped to an extent. But phishing still works in 2026 because you're fighting something adjacent to the reason these people were hired in the first place, eg. a good receptionist picks up the phone and tries to help. You can teach them to verify, to slow down, to ask a manager, but you're always pushing against the grain of what makes them good at the job.

Prompt injection has the same underlying problem, if not worse. A language model's entire purpose is to take in text and do what it says. Almost all defenses against this are variations of "follow this instruction, but ignore that one," and both instructions look identical coming through the same text field.

Decades were spent trying to solve the human version of this problem, it's really, really hard, and now the AI version showed up before anyone had a definitive solution to the first one.

If your company is deploying AI agents, every capability you give them is attack surface. Sending emails, processing payments, accessing customer data, all of it is one convincing conversation away from being used in ways you didn't intend.