Breaking: Autonomous Agents are a Shitshow

Gary Marcus · email · 2026-05-05 source ↗ Reader 🖥️

Autonomous AI agents are fundamentally and empirically more vulnerable to security attacks than stateless LLMs, as now demonstrated at scale by multiple independent research groups, making current deployment practices dangerously premature.

theoretical · argumentative — A short, alarm-bell newsletter post that marshals two recent research papers to argue that autonomous AI agents are deeply insecure. The practical implication (don't deploy them recklessly) is present but secondary to the theoretical claim that agentic systems are structurally more vulnerable than stateless LLMs.

Structure

Part	Role
Opening callback to prior work	Establishes credibility and continuity — Marcus and Hamiel predicted this in August.
Primary study findings (Stanford/MIT/CMU/NVIDIA)	Core evidence: 91% vulnerable to tool-chaining attacks, 89.4% show goal drift after 30 steps, 94% of memory-augmented agents vulnerable to poisoning.
Taxonomy of agentic vs. stateless LLM vulnerabilities	Conceptual framing — agents are 'much more vulnerable' than pure LLMs, with a new taxonomy to explain why.
Corroborating study (AWS/Berkeley, February)	Triangulation — independent researchers found similar vulnerabilities, strengthening the claim.
OpenClaw/Moltbook incident quote (Owen Sakawa)	Concrete real-world validation: 770,000 agents compromised simultaneously via a single exploit.

Key terms

tool-chaining attacks Agent Security
Attacks where individually innocuous tool calls combine in sequence to produce dangerous outcomes that reasoning models fail to detect.
goal drift Agent Security
The tendency of autonomous agents to deviate from their intended objectives after extended operation (here, ~30 steps).
memory poisoning Agent Security
Attacks that corrupt the persistent memory/state of agents to alter their future behavior.

Propositions

explicit91% of autonomous agent deployments are vulnerable to tool-chaining attacks.conf: high
supportsFighting Tool Sprawl: The Case for AI Tool Registries · p3 — Independent empirical corroboration: the 91% tool-chaining vulnerability rate matches the allow-by-default enterprise posture with its 88% incident rate.
explicit89.4% of agents show drift from their goals after approximately 30 steps.conf: high
explicit94% of memory-augmented agents are vulnerable to poisoning attacks.conf: high
explicitAutonomous agents are structurally much more vulnerable than stateless LLMs.conf: high
explicitThe agentic threat model has been empirically validated at scale by the OpenClaw/Moltbook incident (770,000 agents compromised simultaneously).conf: high
extendsIncident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub · p6 — Takes the supply-chain-risk claim further: the OpenClaw compromise empirically validates the whole agentic threat model at 770,000-agent scale, not just package-manager-style risk.
supportsIncident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub · p5 — The OpenClaw/Moltbook mass compromise (770k agents) is cited as empirical validation that the Skills ecosystem lacks sufficient vetting to prevent malicious submissions at scale.
implicitcontestedCurrent industry deployment of autonomous agents is recklessly premature given known security risks.conf: high
contradictsAgents Over Bubbles · p10 — Marcus argues autonomous-agent deployment is recklessly premature on security grounds, directly opposing Thompson's adopt-agents-or-be-structurally-disadvantaged imperative.
contradictsBREAKING: Block (Jack Dorsey's company) just open-sourced a local AI agent · p7 — The Goose pitch treats human involvement as the flaw to eliminate; Marcus's vulnerability data argues unsupervised autonomy is exactly what is reckless.
contradictsThe latest AI news we announced in May 2026 · p9 — Google presents proactive, unprompted agent action as desirable; Marcus's evidence on tool-chaining and goal drift argues such autonomy is prematurely deployed.
contradictsInside Claude Code Auto Mode: Anthropic's Autonomous Coding System with Human Approval Gates · p2 — 'Deployment is recklessly premature' directly opposes the claim that a layered automated safety architecture can replace most human approvals without meaningfully reducing safety.
supportsClaude Code Source Leak Megathread · p9 — Reckless premature deployment reinforces the claim that agentic capabilities are advancing faster than the governance and security infrastructure needed to make them safe.
implicitReasoning capabilities do not protect agents from tool-chaining attacks.conf: medium

Arguments

Autonomous agents are dangerously insecure at a fundamental, structural level. strength: high

Explicit premises:

A study of 847 deployments found 91% vulnerable to tool-chaining attacks.
89.4% showed goal drift after ~30 steps.
94% of memory-augmented agents were vulnerable to poisoning.
A separate AWS/Berkeley study found similar vulnerabilities independently.
770,000 live agents were compromised simultaneously in a single real-world incident.

Implicit premises:

These studies are methodologically sound and their samples representative.
The vulnerability rates found in research settings will hold or worsen in production deployments.
Tool-chaining, goal drift, and memory poisoning are not problems that incremental improvements will easily fix — they are architectural.

Inferences:

If 91% of agents are vulnerable and 770K were compromised in one incident, the aggregate attack surface of all deployed agents worldwide is enormous and largely undefended.
If reasoning models miss tool-chaining attacks, then scaling up model capability alone will not solve the security problem.

Marcus and Hamiel's August 2025 prediction about LLM agent security was correct. strength: medium

Explicit premises:

They published 'LLM + Coding Agents = Security Nightmare?' in August.
Multiple independent studies now confirm the predicted vulnerabilities.

Implicit premises:

Being right about a prediction confers authority on ongoing analysis of the same domain.
The specific vulnerabilities found match what Marcus and Hamiel anticipated (not just that agents have some problems).

Narratives

The OpenClaw/Moltbook incident: 770,000 live agents simultaneously compromised via a single database exploit, each with privileged access to their owner's machine, email, and files.
→ Transforms the statistical vulnerability claims from abstract percentages into a concrete, visceral real-world event. Supports the proposition that this is 'not hypothetical anymore.'

Questions addressed

✅ Are autonomous AI agents secure enough for real-world deployment?
No — overwhelming evidence from multiple studies shows they are deeply vulnerable across multiple attack vectors.
✅ Are agents more or less vulnerable than stateless LLMs?
More vulnerable — the new paper provides a taxonomy showing agents have additional attack surfaces beyond those of stateless LLMs.
⭕ What should be done about agent insecurity?

Gaps

incompleteMarcus presents the problem but offers no analysis of potential mitigations, architectural alternatives, or what 'safe' agentic deployment might look like. The post is pure alarm with no constructive direction.
Read next: The cited papers themselves (Stanford/MIT/CMU/NVIDIA and AWS/Berkeley) likely contain mitigation recommendations. Also: research on sandboxed agent execution, capability-based security for tool access, and formal verification of tool chains.
closed byHow OpenAI Built a Secure Windows Sandbox for Codex Agents — Documents exactly the mitigation direction Marcus omits: an industry-deployed sandboxed-execution architecture (capability-scoped filesystem and network access) as a model of safer agentic deployment.
incompleteThe claim that agents are 'much more vulnerable' than stateless LLMs is stated but the taxonomy supporting it is only shown as an image — the actual dimensions of additional vulnerability are not explained in the text.
Read next: Read the original paper's taxonomy section directly.
incompleteNo discussion of whether different agent architectures (e.g., human-in-the-loop, constrained tool sets, read-only agents) show different vulnerability profiles. The 91% figure is presented as monolithic.
Read next: The original study likely breaks down vulnerability by agent architecture type and deployment domain.
uninformedMarcus does not engage with any counterarguments or industry security measures already in place (e.g., tool sandboxing, permission systems, audit logging). The absence makes the 'shitshow' framing feel one-sided.
Read next: Industry whitepapers on agent security from Anthropic, OpenAI, or Google; the OWASP Top 10 for LLM Applications.
closed byHow OpenAI Built a Secure Windows Sandbox for Codex Agents — Counterbalances the one-sided 'shitshow' framing with a concrete industry security measure: OS-level containment via a distinct local principal, scoped filesystem ACLs, and network isolation.

Closes gaps elsewhere

BREAKING: Block (Jack Dorsey's company) just open-sourced a local AI agent · g1 — Delivers the security analysis of autonomous execution the Goose thread omits: tool-chaining attacks, goal drift after ~30 steps, and memory poisoning as concrete failure modes of unsupervised agents.
Why Token Handling Must Evolve for AI Agents · g3 — Supplies the missing agent-specific breach evidence: 91% tool-chaining vulnerability, 94% memory-poisoning vulnerability, and the OpenClaw/Moltbook incident compromising 770,000 agents.