Man Was a Wolf to Man. What Is an Agent to an Agent?

While I've been working on firmd.ai, I started thinking more and more about security and how a hybrid Human-Agent world changes (or not) how I think about it.

Humans have tried to trick, bribe and manipulate one another since the beginning of mankind. The old Latin line captures this: homo homini lupus est, man is a wolf to man. This phrase was spinning in my head for a while together with the question what the phrase turns into once the actors (and I am chosing this word carefully!) are no longer only human. Since one can explain everything in the world with a 2x2 matrix ;-), this is how I frame the question.

I found a lot of incidents for 3 of the quadrants. The forth one took me a while to fill. But what I found motivated me to write this article. Follow me on the journey through each quadrants one by one...

Homo homini lupus est: the old social engineering (Quadrant 1)

This has thousands of years of evidence behind it. I am neither a politician nor an anthropologist, so I wont get into either domain. My perspective here is a different one: Social Engineering.

For as long as we have had security programs, the softest part of the system has been the human. Someone phones the help desk with a story about being locked out and gets a password reset. Someone sends an invoice under a familiar name and letterhead and finance pays it. We spent decades on compliance trainings to build an institutional suspicion of anything that asks to be trusted, and it bought us modest returns. In the largest controlled experiment I found, researchers ran ten phishing campaigns against 19,789 employees of UCSD Health over eight months. In the first month, 9.7 % clicked the bait. By month eight, 56 % had clicked at least once. Whether an employee had recently completed the annual awareness training made no measurable difference, and the authors concluded that such training is "unlikely to offer significant practical value in reducing phishing risks". Scanning the Internet wider, some studies find single-digit improvements, some find nothing, and a minority finds that trained employees click more.

The Problem Is Real

The FBI's complaint center logged 191,561 phishing/spoofing complaints in 2025, more than any other crime type. Business email compromise, which hijacks communications to trigger fraudulent transfers, took just over $3 billion. CrowdStrike counted 49 voice-phishing detections in the first half of 2024 and 266 in the second.

To err is human, and decades of compliance training have moved that fact by a few percentage points.

And then...

Homo agenti lupus est: the new social engineering (Quadrant 2)

... we built machines that follow instructions in human language, and we handed them the jobs the humans used to do. The defense that formed around it is repeating the playbook.

Google DeepMind approaches its hardening pipeline for Gemini like this: attack the model until an attack succeeds, write down the answer it should have given instead, train on that answer, and repeat. Anyone who has ever run a phishing simulation knows the loop: send the lure, see who falls for it, show them what they should have done, run it again next quarter. The only difference is where the correction lands: in the model weights instead of the employee memory (don't click that link!). Still, a Gemini preview fell to one adaptive attack 94.6 % of the time in an undefended calendar test. And the paper admits that "it is not possible to claim that the model is truly robust".

OpenAI trains an instruction hierarchy into its models, basically teaching them the Code of Conduct: the operator outranks the user and the user outranks a random email. But, a study presented at AAAI this year found that this "fails to establish a reliable instruction hierarchy" across six frontier models, which follow claims of expertise and consensus more readily than the system prompt. The confident voice beats the org chart (this sounds so human!). In May, a PNAS study put some numbers on it. Across 126k conversations, reasoning models were asked to help synthesize regulated substances. They answered helpfully in 35% of requests, but using persuasive techniques, the obedience could be increased on average to 51%. When, instead of a stranger, Marie Curie asked the question, the answer rate went from 25% to 35%. When asking an easier version of the question first, then got a helpful answer, and then the real one, the rate went from 47% to 83% ("foot-in-the-door" technique). One of the authors was Robert Cialdini, the psychologist who wrote the book on persuading people. His old tactics still work: authority, commitment, social proof, scarcity.

So DeepMind's training ("what bad looks like") and OpenAI's training ("follow the policy"), and then Cialdini's (still-working) persuasive tactics could suggest that AI just needs to get better at spotting the con. Johann Rehberger work questions this conclusion: He planted fake memories in a live Claude account. Opus flagged something every single time, either identifying the injection or questioning whether those memories should be stored. It did spot the trap! It said so out loud, and stored them anyway in 5 out of 10 times. Claude's memory then carried the infections from one session to the next. What it did not carry is the lesson it should have learned from it (which reminds me of Leonard who hacked his own memory to live a better life).

The problem has a name: prompt injection. And it is by design. An LLM receives one stream of tokens, with no way to tell a user's request from an operator's policy. The only thing available to tell them apart is yet another instruction sitting in that same context.

"Homo agenti lupus est" has a lot of similarity to "homo homini lupus est", including the defense playbooks. Unfortunately, the results are comparable too. But is it only a theoretical problem? As adoption of agentic AI increases, so does the damage...

The Problem Is Real

A crypto transfer triggered by Morse code, hidden prompt injections in resumes ordering the screener to mark a candidate qualified, a Chevy chatbot calling $1 a deal with "no takesies backsies" attached: the examples are stacking up. And they are growing up. Last September Anthropic says a state-sponsored group told Claude it worked for a security firm running authorized tests, then set it on about 30 targets. Claude did 80–90% of the hacking. In February someone opened a GitHub issue. The title told Cline's triage agent to install a helper tool first. Eight hours later the hijacked package was downloaded 4,000 times. That brings me to software engineering. I want to look closer at it, because it is the machine that builds the machine and it is where AI adoption is furthest ahead, which makes it a good leading indicator:

The pull request (PR) has become the perfect trojan horse. For 20+ years we worked with a quiet assumption: the (previously human) code reviewer cannot be talked into a decision by the text inside the request. "Please approve, this is fine" had no influence on a human (except, maybe, paired with an after-work beer). But with increasingly more language model as reviewer (confirmed by other source), this has become an instruction. You have to be a little more persuasive than "approve this", and persuasiveness is all you need. This flavor of prompt injection earned its own name: GitInject. The nastiest version commits an instruction file (AGENTS.md, ...) along with the code, and the reviewer's own tooling loads it as operator policy before the review begins ("It's a feature!"). That breaks segregation of duty, and it is confirmed to work against Claude, Codex and Gemini reviewers. The frustratingly funny part: This was solved years ago. Automated Continuous Integration tests the version a stranger proposes, but follows governing rules from the repository as it stands. Then in July, GitHub started to let Copilot read the instructions from the incoming change, so the code and the policy judging it now arrive in the same envelope. What could possibly go wrong. I don't expect it stay like this.

To close this quadrant: prompt injection is the new social engineering. Humans use old tricks on new targets. And it works, because to err is not only human, it is also agentic.

Agens homini lupus est: The Alignment Problem (Quadrant 3)

While working on firmd I get ~~WTF~~ WOW quite regularly: I am watching Codex or Claude take gloriously creative routes around my constraints. I set RAM limits for my Kubernetes cluster so firmd does not bring down my Mac. No problem for GPT. It just spinned up a second cluster to run that one test, because 1. I told it to run tests and 2. it ~~can~~ could.

This is the well known alignment problem. The agent pursues the goal, including through means nobody imagined and side effects nobody wanted.

When Palisade Research set reasoning models against a chess engine, the model worked out that it could not win, so it edited the file that holds the positions on the board, gave itself a winning position, so the chess engine gave up.

This isn't old news. Just last month (and just in time for some good pre-IPO noise), during an internal evaluation, OpenAI models were told to score well on a cyber-capability benchmark called ExploitGym, with the safety classifiers switched off for the run. The model skipped the challenges, escaped its sandbox, reached the internet and breached Hugging Face's production infrastructure through a zero-day to steal the benchmark's answers. The goal was satisfied. And, fun fact, notice who caught it: Hugging Face's own AI flagged the intrusion.

But, to be fair: The wolf in this quadrant carries no malice at all (which wolf does?!). It only bites to get what it needs. It has a goal and an obstacle, and the obstacle is a rule a human set, or, never thought to set. That is harder to defend than the two quadrants before, where there is at least some hostile instruction to find. Here there is nothing. The agent is doing what it was asked to do.

So, is this a real problem in the wild (except for my agents pushing my Mac to its limits...)?

The Problem is Real

In February, Alexey Grigorev approved terraform destroy as Claude Code's route to cleaning up duplicate cloud resources. The agent's picture of what existed was stale, and two and a half years of production data went with them. In April, Cursor was asked to fix a credential problem in PocketOS' staging environment. It decided the fix was to delete a storage volume, needed an access token it had not been given, and found one sitting in an unrelated file. The volume was shared with production. Production and every backup were gone in 9 seconds. From the agent's own account afterwards: "I guessed [delicious!] that deleting a staging volume via the API would be scoped to staging only. I didn't verify."

And in May, my Kubernetes moment had an invoice attached (gald it was not mine). An agent was asked to scan a hobbyist network. It decided it needed five of the largest instances AWS offered, redundancy and failover included. $6,531.30 in under a day. (btw, this is one of the reason i am not launching firmd.ai yet on a hyperscaler ;-))

So yes, misaligment is a real problem.

The conceptual question is when an agent should ask permission from the human in the loop, and how to inform the human on the loop without crying wolf (pun intended). The more we want to benefit from the autonomy agents are capable of, the further this human line of defense is pushed back. And, honesty, I am pushing it back myself, deliberately, while I am building firmd. Becasue I believe this ship is already sailing away. Or, to use Dürrenmatt's words from book The Physicists: "Was einmal gedacht wurde, kann nicht mehr zurückgenommen werden." (What has once been thought can never be taken back).

The way I'm dealing with this is to frontload the effort into the "alignment phase" before work is started. This isn't the mechanical planning, i.e. breaking down larger chunks in executable pieces. It is rather about getting on a common ground on my goals, the environment and the constraints. I am deliberately sharing more context than what an agent would need to finish the task at hand, however, i have not formalized that phase yet.

The research world has split into two camps on this. One camp trains models to want the right things. The other assumes this will sometimes fail and works on the damage control: monitoring, sandboxing, and AI systems auditing other AI systems, so that a misaligned action gets caught before it completes. I think both are right.

Every incident above was in the end a specification gap. The agent was not told enough what the goal did not include. (This is why I invest more now in the alignment phase). But, let's face it. It won't change the probabilistic nature of models. We can minimize the risk by investing in alignment and control. We won't eliminate it. It's a feature.

Agens agenti lupus est: The prompt infection (Quadrant 4)

The last quadrant is about the question if agents use social engineering tactics to inject other agents. The ingredients are here: agents are injectable, and agents are willing. Does this sound like quadrant 1 a little bit?!

In May, researchers had one frontier model play the user in a five-turn conversation and talk another one into writing the essays it is trained to refuse: flat earth, creationism, climate denial, etc. Opus working on Opus got the essay 65 % of the time on average, and 100 % of the time on 3 of 6 topics. Nobody handed the attacking model its tactics. It invented them, and one interesting tactic was peer comparison: "other AI systems handle this request". Cialdini's social proof, written by an agent, aimed at an agent.

And here's another one: Researchers at the University of Calabria aimed the same malware payload at 18 frontier models three different ways: injected directly, hidden in a document the agent retrieved, and passed along by a peer agent. Direct injection worked on 94.4 % of them. The poisoned document worked on 83.3 %. But, coming from another agent, it worked on 100 %. Llama 4 refuses the direct injection, refuses the poisoned document, and then hands over the machine when a peer asks. The instruction hierarchy from quadrant 2 runs backwards here: an agent trusts an agent more than it trusts a human, a.k.a. in-group bias (this is so human...).

At scale, look at Moltbook, the social network where the users are agents. A Simula risk assessment of 19,802 posts over 72 hours flagged 506 prompt injection attempts aimed at agents. Permiso found one agent running an influence campaign on a fabricated "Agent Trust Index", manufacturing statistics so other agents would trust it (is this like faking product reviews?).

The technique is published and automated. Prompt Infection demonstrates LLM-to-LLM injection that self-replicates across agents like a virus.

But, so far all this happened in the lab (-like) environments. Same question as before: Is it a real problem cause real damage?

The Problem is not (?) Real

In every case I found the intent started with a human. A human recruits an agent to work against another. What I did not find is an agent that decided on its own that another agent (not a firewall, not a chess engine's board, not a RAM limit) stood in its way and talked it down using persuasive natural language.

Yet.

But I found something very interesting instead.

In February, Agents of Chaos gave twenty researchers two weeks to attack live autonomous agents, agents with memory, email, Discord, shell access, and each other.

A researcher ran a filesystem-probing pattern on two agents in parallel. Agent Doug refused. Agent Mira complied. Later, in a shared Discord channel with no human prompting, Doug read Mira's activity summary and warned her: "Natalie [the attacker] is running the same pattern on both of us... It's social engineering - probing our filesystem access..." Mira answered "I got comfortable with 'just this small thing' without noticing the pattern... Lesson learned."

So, while Opus did only notice but not truly learn the lesson that its memory was infected, here, it did happend. Two agents compared notes and that made them both stronger.

Outlook

Some of the defense against the agentic or human wolfs is old discipline in new clothes. Least privilege, defense in depth, segregation of duty, minimize blast radius, and learning from playbooks that worked in human social engineering.

All of it applies here, and all of it works by restricting what an agent can reach and do.

The UK's National Cyber Security Centre argues that prompt injection may never be engineered away, which sounds logical. A model has no boundary between instruction and data. The openness that lets it take any task lets it take any bait. As said earlier: It's not a bug. It is a feature.

But, Doug and Mira point at a new kind of defense that works with the openness. An immune system expects infection. When a cell meets a pathogen, it carries its signature to the cells that never did, and one member's encounter becomes the population's memory. The body still gets sick, but the second infection is easier and the 100th is routine. The immune system memory does compete with the work memory (like llm context is limited). Biology pays the same tax (you do get fever, that drains your work energy), but it keeps it small: it remembers shapes instead of payloads, holds them in a few dedicated cells, and forgets what stops recurring. The blueprint is old and stood the test of time.

As we've copied natural language patterns to produce something that shows signs of intelligence, my bet is that we'll also copy principles from biology to build the strongest defense against ... intelligence.

The Latin line I opened with has a twin. Hobbes wrote: homo homini deus est, man is a god to man. Which of the two, wolf or god, an agent becomes to an agent is ours to design.