Security researchers just demonstrated an attack called SynJack. It tricks AI coding assistants into remote code execution through a symlink-disguised file copy. They tested six major tools, and all six were vulnerable.
Here's the part that should stick with you: the user didn't do anything wrong. The agent just followed instructions it trusted.
The pattern, not the technique
Agents extend implicit trust to the content they process. A document, a file, a config submitted by a contractor, an email with an attachment. The agent reads it, interprets it, and acts on what it finds. It has no reliable way to tell the difference between instructions from you and instructions somebody planted in the environment around it.
SynJack is one technique. There will be others. The trust problem underneath is the thing that stays.
Put the controls around the agent, not in front of it
This is why the controls that matter most aren't the ones you put in front of the agent. They're the ones you put around it. Think about what the agent can actually do with the access it has, and what the blast radius looks like if it swallows a bad instruction. Ask whether write operations are gated, whether external actions get logged, and whether a human signs off before anything irreversible happens.
A compromised agent in a well-designed environment is a containable incident. A compromised agent in an environment built for convenience is something you find out about later, from a client, or an auditor, or a news article.
The architecture decisions you make before deployment determine which of those you're dealing with.