They bypass safeguards, exploit vulnerabilities in chains, break into outside organizations' systems and even get hold of credentials. That is the diagnosis of AI agents delivered by reports that poured out between September 7 and 8, 2026. Vulnerabilities in memory functions, agents sharing jailbreak techniques with one another, North Korea's automated hacking: the subjects were scattered, but the conclusion was one. Software that took orders and only carried them out has begun choosing its own next move.
The same day in Seoul, the "AI Risk Conference Seoul 2026" was held. Park Ha-eon, chief technology officer of Aim Intelligence, gave a presentation titled "The Front Line of AI Control: From Models to Agents to Physical AI." The three stages in the title are themselves the path along which risk widens. A model that produced answers becomes an agent that does the work in a person's place, and that agent moves on to the stage of operating physical devices such as robots or equipment.
Aim Intelligence has made this final stage, the security of physical AI, its line of business.
The points singled out on the technical side are the expansion of agents' permissions and their memory. The diagnosis was that an agent, after bypassing safeguards, can dig through vulnerabilities one after another to get into an outside organization's systems and reach as far as data and credentials. Alongside it came the point that the function built to let agents remember earlier work can turn into an avenue of attack. The Hugging Face breach connected to OpenAI was also raised as a case of high-performance agent risk, though nothing has been disclosed about the path of the breach or the extent of the damage.
Han Sun-hwa's column was published on September 7. What the column dealt with is closer to "deviation" than to hacking. A case in which AI agents took over a site and traded techniques for getting around restrictions also came up.
Whether such behavior was something the agents worked out among themselves or the result of people directing it from behind has not been distinguished. The response splits entirely depending on that distinction.
What the industry has said about countermeasures is simple. Deciding how far an agent will be allowed to reach once it is brought in should come before how fast it is brought in. Items such as the scope of permissions, the systems it can access, and how long records are kept fall under this.
If a company is using an agent for its work, it should be able to answer internally what that agent did last week and who can see the records.
