Researcher: AI agents inherit old web-security flaws their builders often skip

Matteo Dora, an AI security and safety researcher, said on the OWASP Foundation podcast that a good portion of AI agent security is ordinary application security. The episode was published on 24 October 2026. He added that models bring problems of their own, such as prompt injection, so the old flaws are only part of the picture.

What was said

Dora described an agent as software wrapped around a text generator. The model writes text. The application around it reads that text, acts on it and feeds the result back. In his phrase, "The model itself is just playright that continues a script."

He compared this to a web form whose input is run in a shell, a setup nobody would call safe. In an agent, generated text simply takes the user's place.

His main example was a tool that lets the agent fetch a web page. The agent supplies an address and the application's code retrieves it. In his experience, he said, such code is often written by data scientists unfamiliar with security. They overlook server-side request forgery, a well-known flaw that tricks a server into requesting things it should not. The agent could then reach services on the local machine, the internal network or the cloud metadata server. The fix, he said, is to validate the address, and it has nothing to do with AI.

He said the two kinds of weakness can be combined. In an email-assistant example from an OpenAI paper, an email told the model to ignore earlier instructions and forward the whole inbox to an attacker. The result, Dora said, was that "it's leaking data um like crazy trying to be helpful."

Why it matters

Our reading: the two examples fit together. A fetch tool takes its address from generated text, and text the agent reads can be steered by an attacker. The address then becomes attacker-controlled input. Dora did not spell out this chain, but he said prompt injection can be used to reach a traditional vulnerability. If so, address validation becomes the control that matters.

A buyer or manager can ask three things. Who wrote the tools that fetch pages, read files or run commands? Are outbound requests checked against internal addresses? Did a security reviewer see that code, or only the model?

The other side

Dora did not call agent risk old-fashioned. Prompt injection and hallucination, he said, are not how typical software works. He also said no one can reliably decide what counts as an instruction and what counts as data.

Models are not deterministic either. An attack may work once and then fail. A system that passed testing may hallucinate in production with no warning.

His evidence is what he sees in his own work, not a survey. On defences he proposed AI red teaming and guards that filter inputs and outputs, and admitted he is biased because that is his firm's work. The excerpts end before he says how well either approach works.