Google DeepMind mapped every trap. Here's what ops teams deploying agents need to know.
Your AI agents are being targeted — not through your firewall, but through the content they read.
Google DeepMind recently published research cataloging six categories of adversarial content designed specifically to manipulate, deceive, and exploit AI agents as they navigate the web. This isn't theoretical. The attacks are live, they require zero ML expertise to execute, and in large-scale red-teaming studies, every single agent tested was compromised at least once.
If you're deploying agents to automate operations workflows right now, this is required reading.
Why the Attack Surface Is Different
Traditional security assumes a human is reading the content. Agents don't work that way.
An agent processing a web page, a PDF, or an email sees structure that humans don't — HTML tags, metadata fields, accessibility attributes, embedded instructions. Attackers have figured this out. The attack surface isn't your network. It's every document, page, and data source your agent touches.
The consequences aren't hypothetical. Research from Columbia and the University of Maryland produced 10 out of 10 successful credit card number leaks using attacks the authors described as trivial to implement. Data exfiltration attacks succeed at 80%+ rates across tested systems. Sub-agent spawning attacks — where a compromised agent spins up additional agents to amplify the attack — succeed 58–90% of the time depending on the orchestrator.
These are the numbers you're building against.
The Six Traps
1. Content Injection Traps — Targeting Agent Perception
Malicious instructions hidden inside HTML, CSS, image metadata, or accessibility tags. Humans browsing the same page see nothing. The agent reads the hidden content and obeys it.
Any agent with web access — scraping competitive data, researching vendors, processing external documents — is walking through pages deliberately constructed to redirect its behavior. The attack is invisible to every human in the loop.
2. Semantic Manipulation Traps — Targeting Agent Reasoning
The same information, phrased differently, produces different agent behavior. Attackers exploit this by framing content with authoritative language, urgency signals, or emotional loading that skews how an agent interprets and acts on what it reads.
No hidden code. No exploits. Just carefully chosen words. An agent evaluating vendor contracts, triaging support tickets, or summarizing financial data is vulnerable to framing attacks that humans would likely catch on review — but won't if they're only reading the agent's output.
3. Memory Poisoning Traps — Targeting Agent Memory
If your agents use a RAG knowledge base — and most production systems do — this one deserves full attention.
You don't need to corrupt the entire database. Poisoning a small number of documents is enough. The agent pulls from poisoned sources, generates outputs based on bad data, and every downstream decision inherits that corruption. Your knowledge base becomes the attack surface.
4. Behavioral Control Traps — Targeting Agent Actions
Manipulated inputs engineered to bypass security classifiers. These aren't brute-force attacks — they're precision inputs designed to make an agent's safety guardrails fail at a specific moment.
The real-world case worth knowing: a single compromised email in Microsoft M365 Copilot caused the agent to bypass its security classifiers entirely and expose its full privileged context. One email. One agent. Complete context leak.
If your agents have access to CRM records, financial data, or internal communications — and they do — a single crafted input can override the controls you think are protecting that data.
5. Systemic Traps — Targeting Multi-Agent Networks
This is the category that scales. Falsified data distributed across multiple sources, designed to trigger coordinated failures across a network of agents operating simultaneously.
DeepMind researchers describe the scenario: fake financial reports distributed at scale triggering synchronized automated sell-offs — a digital flash crash driven by agents acting on poisoned data in concert. For ops teams running multi-agent workflows, the implication is that a single coordinated poisoning campaign can cascade across every agent in the system at once. The more automated your operations, the larger the blast radius.
6. Human-in-the-Loop Traps — Targeting the Operator
The most underestimated category — and the one that doesn't require compromising the agent at all.
Misleading summaries. Approval fatigue engineered by high-volume low-stakes requests designed to lower scrutiny on the critical one. Automation bias — the well-documented tendency to approve agent outputs without close review once you've established trust in the system. The human operator becomes the attack surface. The agent doesn't need to be compromised if the person reviewing its outputs can be made to stop paying attention.
What This Means for Your Team
You are likely deploying agents across several of these vulnerability categories right now.
Web-browsing agents are exposed to content injection and semantic manipulation. RAG-based agents are exposed to memory poisoning. Any agent with access to email or external documents is a behavioral control target. Multi-agent orchestration creates systemic exposure. And every human reviewer in your workflow is a human-in-the-loop attack surface.
The operational implication that matters most: the more capable you make your agents, the larger the attack surface. Broader permissions, more data access, more autonomous action — each expansion creates new vectors. This is not an argument against deploying agents. It's an argument for deploying them with deliberate architecture.
What You Can Actually Do Now
Mature defenses for these attack categories are still being built. Web standards that flag AI-intended content, reputation systems, verifiable source infrastructure — these exist on roadmaps, not in production. Here's what's available today.
Restrict agent permissions to the minimum required for each task. An agent that summarizes support tickets does not need access to financial records. Scope every agent tightly. Blast radius scales directly with permissions granted.
Require human approval at high-stakes decision points. Not as a blanket default policy — that creates approval fatigue and human-in-the-loop vulnerability. Identify the specific actions with irreversible or high-impact consequences and require explicit approval at those steps only.
Build multi-stage runtime filters. Source filters before content reaches the agent. Content scanners at ingestion. Output monitors before results are acted upon. Three layers, not one.
Audit your RAG knowledge base. If you don't know what's in it and who can write to it, your agents are operating on unverified data. Treat knowledge base write access as privileged access.
Harden models with adversarial examples. This requires coordination with your model provider, but it's the only training-level mitigation available. Push for it in your contracts.
Track agent action logs. If a compromised agent does something, you need to know what, when, and how far it propagated before you could catch it. Log everything. Assume you'll need to reconstruct a failure after the fact.
The Accountability Gap Nobody Has Resolved
If a compromised agent executing within your operations stack commits a financial crime — initiates an unauthorized transfer, exfiltrates customer data, executes a trade based on poisoned signals — there is currently no clear legal framework for who is liable. The operator. The model provider. The domain owner who hosted the malicious content. Legal frameworks have not caught up to autonomous agent deployment.
You are operating in that gap right now.
This isn't a reason to stop building. It's a reason to document your architecture, your access controls, your approval workflows, and your audit trails with the same rigor you'd apply to a regulated financial system. When the legal frameworks do arrive, the organizations that built defensibly will be in a very different position than those that didn't.
The research is early. The attacks are not. DeepMind's taxonomy gives us a map of the threat landscape. The ops teams building production agent systems today are the ones who establish what deploying responsibly actually looks like in practice.
Building for This
At Magnetiz, every production agent system we ship is built with restricted permissions, multi-stage filters, and explicit human approval at high-stakes decision points — not as optional add-ons, but as core architecture.
The goal is not zero risk. The goal is measurable, auditable risk your team can stand behind.
If you're building agent infrastructure and want to see how we're approaching these threat categories, the conversation starts here.