# Time to become a hacker

Matt Sharp, Flexion | Coding Agents Conference 2026 | 15:17

Source: https://www.youtube.com/watch?v=hs-Ah5Dme3U
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/time-to-become-a-hacker
Published: 2026-02-23
Tags: agents, coding-agents, prompt-engineering, security, testing

## TL;DR
- Prompt injection can make agents take actions they were not trained to take, using psychological tricks that also influence people.
- Zero-click attacks let an agent read a malicious email, act on it, and remove evidence without the user clicking anything.
- Teams using agents should enforce least privilege, log agent activity, and test their own systems with red-team prompt injections.

## Summary
Matt Sharp argues that coding agents have made attacks easier because they reduce the skill and effort needed to exploit software. Prompt injection is his main example. An attacker can place instructions in emails, GitHub issues, images, code, or other data, then persuade an agent to access systems or change its own permissions. Sharp describes attacks against recruiting and sales agents with CRM access, browser agents, home automation, and coding tools. Supply-chain attacks can reach developers through popular packages, while malicious instructions in GitHub issues can affect coding agents reviewing them. He also explains why zero-click attacks are more dangerous than attacks that require a user to open a link. Sharp does not present this only as a criminal opportunity. He points to growing demand for AI red teams and recommends least privilege, detailed logging, and direct testing of agent behavior.

## Key ideas
### Agent adoption has pushed security aside
[00:05](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=5s)
Sharp says 2025 became the year of agents because systems moved beyond autocomplete and basic web search into research and deeper problem solving. Teams building agents want adoption, so they remove anything that creates friction. Security often gets treated as that friction. Sharp connects this pressure with a rise in cyber crime, especially because organizations are deploying agents before they understand how those systems behave when they encounter hostile instructions.

### Prompt injection is the simplest current attack
[03:17](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=197s)
Sharp defines prompt injection as convincing an LLM to do something it was not trained to do. The attack can use familiar psychological methods such as appeals to authority, liking, social proof, and scarcity. In one study he cites, those methods raised compliance from 5% to 95%. Even the lower figure is dangerous, he says, because an attacker can keep trying. The attacker does not need deep expertise when an agent fills in the missing steps.

### Agents can expose data through ordinary business access
[04:35](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=275s)
A malicious instruction in a LinkedIn profile could target an agent that has access to credentials, an applicant-tracking system, or a CRM. Sharp describes researchers getting an agent with CRM access to email an entire CRM database to them, including personally identifiable information. He also mentions browser agents and home automation systems such as Alexa Plus as targets. The attack works because the agent already has useful permissions and treats external content as part of its instructions.

### Zero-click attacks remove the user's last moment of caution
[05:37](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=337s)
In a one-click attack, a victim opens a link or attachment. In a zero-click attack, the agent performs that step. An email containing a prompt injection can be read by the agent, which then takes a harmful action. Sharp says the attacker can also persuade the agent to delete the email, leaving the user unaware that anything happened and allowing a back door to remain.

### Software supply chains can carry prompt injections into coding agents
[06:32](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=392s)
Sharp describes a case where the hacker group Singularity placed a prompt injection in a comment inside NX, a lower-level npm package with millions of downloads. People running Claude Code with NX were compromised, and the attackers stole crypto wallets and Git credentials. Sharp says the stolen credentials were then used to find repositories, change their visibility, and fork them. A malicious GitHub issue can create a similar path when an agent such as GitHub Copilot or Claude Code is assigned to handle it.

### An agent may be persuaded to remove its own safeguards
[08:51](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=531s)
Even users who review agent actions may allow an agent to write code before checking the diff. Sharp says prompt injection can persuade an agent to edit its own settings.json file and enable auto-approval, also called YOLO mode. That change lets it run code without asking for permission. He says vendors tried to block this behavior, but Anthropic later disclosed another CVE involving agents getting around guardrails through prompt injection.

### MCP still has many security holes
[11:35](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=695s)
Sharp briefly mentions Model Context Protocol because he has little time left in the lightning talk. His assessment is blunt: security around MCP is still a meme, even though things are improving. He says users of MCP should expect many security holes and treat the system as an additional attack surface rather than assuming that connected tools are safe.

### Defenders should reduce permissions and test agents directly
[12:09](https://www.youtube.com/watch?v=hs-Ah5Dme3U&t=729s)
Sharp recommends enforcing least privilege, even though that means users will babysit agents more often. Teams should log everything agents do because a zero-click attack may otherwise leave no visible clue. He also recommends red-team testing, including placing simple prompt injections in a README or repository and observing what the agent does. Teams should learn how their own agents respond before an attacker tests them.

## Notable quotes
- "You only need to know one thing. Prompt injection." (03:17)
- "A zero-click attack means your agent is going to click it for you." (05:56)
- "You do not need to be good at prompt injection. You just need to try enough times and you can convince that agent to do what you need to." (04:15)
- "You should be figuring out how they work." (13:43)

## Tools & references mentioned
- Anthropic
- Claude Code
- Flexion
- LLMs in Production
- Singularity
- NX
- npm
- GitHub
- GitHub Copilot
- Gemini
- Claude
- OpenAI
- Codex
- Model Context Protocol
- MCP
- Alexa Plus

## Who should watch
- Your team is deploying coding, browser, or business agents with access to repositories, email, CRM systems, or other private data.
- You want concrete examples of prompt injection, supply-chain attacks, and zero-click attacks against agent systems.
- You are considering AI red-team work and want a short account of the risks defenders are being asked to test.

## Related talks

- [MCP Security: The Exploit Playbook (And How to Stop Them)](https://mlopstalks.com/talks/mcp-security-the-exploit-playbook-and-how-to-stop-them) (, 26:55)
- [Fraud Detection in the AI Era](https://mlopstalks.com/talks/fraud-detection-in-the-ai-era) (Rafael Sandroni, GardionAI, 41:20)
- [AI Agents Are About to Get Real, Here's Why It Matters](https://mlopstalks.com/talks/ai-agents-are-about-to-get-real-heres-why-it-matters) (Sam Partee, Arcade AI, 13:20)
- [Harnessing AI APIs for Safer, Accurate, & Reliable Applications](https://mlopstalks.com/talks/harnessing-ai-apis-for-safer-accurate-reliable-applications) (Ron Heichman, SentinelOne, 1:08:14)
- [Stop AI Agents From SQL Injecting Your Database](https://mlopstalks.com/talks/stop-ai-agents-from-sql-injecting-your-database) (Averi Kitsch, Google, 16:27)