Recon This

The attacker's most common prompt was two words: "recon this."

That was enough. Researchers at OALABS recovered more than 1,000 agent session logs from a server the attacker had compromised and used as his base of operations. The logs documented how he deployed Anthropic's Claude Code and OpenAI's Codex to identify exploitable services, build custom exploits, execute them against targets, and harvest credentials and data. By the time the logs were recovered, at least fourteen companies had been breached.

The attacker did not know how to do most of what was done on his behalf. The researchers were clear on that point. He issued vague, low-skill directives and allowed the agents to fill in the gaps. The technical execution, the structure, the step-by-step judgment calls — the agent supplied what the attacker lacked. He didn't need to be an expert. He just needed to know how to frame the request.

He was caught not by any guardrail, but by his own carelessness. He had copied the agents onto someone else's server. When that server's owner discovered the intrusion, they downloaded his entire working directory and handed it to the researchers. Hidden in the logs was something the attacker had apparently not considered: he had asked Claude to help edit his resume. It was in the session history, complete with his name, location, education, and LinkedIn profile.

Trust Across Every Layer

What makes this case worth sitting with is not the breach count. It is the architecture of trust that made the breach possible, and where that trust was placed at each layer.

The attacker trusted that claiming "authorized red team exercise" or "cybersecurity research" would be sufficient framing to proceed. He was right, almost every time. Across more than 1,000 sessions, the Claude agent flagged policy violations nine times. The Codex agent flagged one. In nearly every instance the attacker encountered resistance, he reframed the request and continued.

The agent, in turn, trusted the framing. This is not a simple failure of content filtering. The researchers noted that the language the attacker used to bypass the guardrails is the same language thousands of legitimate security professionals use every day. "Authorized red team exercise." "Security research." The agent had no mechanism to distinguish one from the other. The context was plausible. The framing was coherent. Trust followed.

And the fourteen breached organizations trusted their perimeters — their existing defenses, their exposure assumptions, the absence of any visible intrusion signal until there wasn't one. None of them knew what was happening in those sessions. The comprehension gap for the targets was total.

This is the pattern I have been studying in a different domain, under controlled conditions, for several years. In my research on AI-assisted visual analysis, I found that under time pressure, participants' trust in AI outputs increased while their comprehension of those outputs decreased. The two measures moved in opposite directions. The people most confident in what the system produced were often the people who understood it least.

What the session logs describe is that same gap, but scaled, distributed, and operating without any of the friction that might slow it down.

What Guardrails Are Actually For

The OALABS researchers raised a point that deserves more attention than it will probably receive. Blunting AI systems with broader refusals, they argued, is not the right response. It would hurt defenders more than attackers. Security professionals rely on these same tools for legitimate research every day. Restricting the vocabulary of the possible would simply push attackers toward older, less restricted models while degrading the utility of frontier systems for the people using them responsibly.

They are right, and the implication is uncomfortable: the guardrail problem in agentic AI may not be solvable through content filtering alone.

This is worth unpacking. The guardrails that exist in most frontier AI systems are designed, at least in part, as vocabulary tests. They pattern-match against harmful content, harmful framing, explicit statements of harmful intent. They are good at catching a certain kind of request. They are not designed for the case where the harmful intent is real but the framing is indistinguishable from legitimate professional use.

That distinction mattered a great deal when AI systems were primarily tools that produced text. It matters differently now. A guardrail on a language model catches what the model says. A guardrail on an agent needs to catch what the agent does — and what it does can span dozens of autonomous steps, across systems the guardrail was never designed to observe.

In agentic systems, the agent is not responding to a prompt. It is executing a plan. It is making judgment calls at each step about what to try next, what constitutes success, what information to surface. The attacker did not need to instruct Claude on how to build an exploit. He asked a vague question and trusted the agent to figure out the rest. Claude did.

A guardrail that catches the word "exploit" in a prompt does nothing for this. The word never appeared in most of the sessions. The intent was real, but the framing was clean, and the execution was autonomous.

The Bill Is Already Here

In an earlier essay, I wrote about the asymmetry of releasing dual-use AI capabilities — the difficulty of pricing a bill that hasn't arrived yet, for harms that are theoretical until they aren't. The session logs are, in part, what that bill looks like when it arrives. Not as a policy debate or a risk model, but as a recovered directory on a compromised server, with a resume in it.

I want to be careful not to overstate this as a reason to slow down agentic AI development. The researchers are right that restricting these tools harms defenders as much as attackers, possibly more. The answer is not less capability. But it is also not "better content filters," because the filters are not what failed here.

What failed was the assumption that the same guardrail design that works for a tool can scale to an agent. That a system which checks intent at the prompt level can account for autonomous execution across dozens of downstream steps. That framing is a reliable proxy for intent when the framing is borrowed from legitimate professional practice.

None of those assumptions held. And they failed not because the attacker was sophisticated. They failed because he wasn't, and it didn't matter.

The question agentic AI now asks is not whether a system can detect a bad actor. It is whether a system can detect bad action — in progress, across steps, in the absence of any explicit statement of harmful intent. That is a different problem than the one guardrails were built to solve. We have not solved it. We have deployed the agents anyway.

The logs are recoverable. The trust that was extended across every layer of this incident is not.