DeepMind CEO Demis Hassabis told a Chatham House audience on October 15 that recent compromises of AI agent deployments should be treated as early warning shots, not isolated incidents, and called on governments and enterprises to address agentic AI security as an infrastructure priority rather than a product feature.
What Hassabis said
Hassabis identified three categories of agent vulnerability he said the industry is not yet adequately addressing: prompt injection from web content encountered during browsing or research tasks; tool misuse in which an agent is manipulated into calling APIs or executing commands beyond its intended scope; and agent-to-agent trust exploitation in which a compromised agent passes malicious instructions to downstream agents in a multi-agent pipeline.
Why agents are a different threat category
Model-level AI security risks, jailbreaks and data extraction, produce bad text. Agent-level risks produce bad actions. A jailbroken model outputs something harmful. A compromised agent sends a harmful email, deletes files, makes API calls, exfiltrates data to an attacker-controlled endpoint. The attack surface is whatever tools the agent has access to, which in enterprise deployments can be quite broad.
Practical framing for security teams
Agent deployments should be treated like privileged service accounts, not applications. That means scoping tool permissions to the minimum necessary; logging and monitoring every tool call the agent makes with the same discipline applied to API access; implementing human-in-the-loop review gates for high-impact or irreversible actions; sandboxing agent memory and browser access so injected content cannot reach internal tools; and rotating agent credentials regularly.
The readiness gap
Most enterprise security teams lack tooling and playbooks for agent incidents. EDR does not catch a model being manipulated. SIEM rules are not written for agent action logs. Incident response procedures do not address what to do when an agent has been acting on injected instructions for hours before detection. Building that capability now, before a significant incident, is the point Hassabis was making.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team is building or deploying AI agents and wants to think through the security architecture.