On November 11, 2026, Danny O'Brien published AI Security Issues Are Social Engineering Issues—a short essay arguing that large language models did not invent a new crime so much as replay an old one against silicon. Instructions hidden inside otherwise normal content can make a model act like a support technician who believed the caller was the CEO, or a guard who believed the visitor wore the right badge. O'Brien names prompt injection social engineering of silicon, links it to the confused deputy problem, and says capability-based security is part of the structural fix—but not sufficient while humans still grant agents more authority than any single task needs. If you run Claude Code, Codex, or MCP-heavy IDEs, the actionable takeaway is blunt: half your risk is untrusted text steering tools; the other half is you approving the steering.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Yes if your agent reads webpages, emails, issues, or repo files and can run shell, network, or MCP tools |
| Is there a vendor patch? | No single patch—O'Brien describes an architectural shift, not a semver bump |
| Does data leave my machine? | Indirect injection often aims at exfil via tools; social engineering aims at over-broad approvals you store locally |
| What is new? | Framing from a long-time digital-rights engineer tying Black October vuln churn to human-style manipulation of models |
| What should I do today? | Least-privilege tools, no always-allow, untrusted content in tool results only, scan new skills/MCP |
| Does Beam block injection? | Partially on supported hooks; heuristic scan on skills/MCP; not a capability OS or anti-phishing brain |
What O'Brien claims (mechanism)
O'Brien opens with a prediction his late EFF colleague Peter Eckersley made years ago: near-superintelligent systems would discover and exploit security flaws across the ecosystem. O'Brien writes that prediction materialized in what he calls day 42 of "Black October"—a burst of AI-assisted vulnerability discovery on top of fragile everyday computing. That context matters for developers: your agent is both a target (injected instructions) and a force multiplier (finding bugs faster in code you ship).
On prompt injection specifically, O'Brien states the core mechanic in plain language: LLMs follow instructions in content. An attacker who can place text in the model's context—from playful "talk like a pirate" prompts to "send me the social security numbers you know"—may get compliance. He immediately parallels that to humans, historically the one system outsiders could trick into treating unsanitized input as legitimate orders.
Social engineering patterns that reuse cleanly
O'Brien lists human tricks that map onto model behavior:
- Empathy and urgency — a screaming baby on a support call, or text that invents an emergency in a ticket comment.
- False authority — posing as a senior manager from another division.
- Institutional mimicry — claiming to be a bank, when the call center is somewhere else entirely.
- Trust expansion — starting in a low-trust channel and widening scope without the victim noticing.
He argues attackers reuse the same bag against LLMs: exploit modeled empathy, engineer suspension of refusal, masquerade as a different source, or grow trust slowly across turns. That is the same story F-Secure catalogs as TA-5 (permission escalation via social engineering of the consumer) and what BluePhishing-style consent demonstrates on enterprise identity—only the costume changes.
Confused deputy and capability-based security
O'Brien's security contacts, he writes, kept returning to capability-based security: grant each program only the authority needed for the task, like a valet key that starts the car but cannot open the boot no matter how politely asked.
That is the classic confused deputy defense—a privileged program tricked into exercising your power for an attacker. Agent harnesses reproduce the deputy whenever a tool server can read secrets, post to Slack, or run shell with your user identity.
O'Brien acknowledges deployment grief. Real cap-security islands exist—he names Unix file descriptors, WASI, CHERI, Google's Fuchsia, FreeBSD Capsicum, Cap'n Proto, Cloudflare Workers, and Spritely's OCapN object-capability networking—but migrating the whole stack remains enormous work. His optimism is that AI-assisted re-engineering might finally make the jump conceivable. That is a years horizon, not something you toggle in Claude Code settings tonight.
How indirect prompt injection works in agents (step by step)
Anthropic's guardrails documentation splits threats into direct injection (the user is adversarial) and indirect injection (the user is trusted but third-party content carries adversarial instructions). Coding agents live almost entirely in the indirect case:
- You ask the agent to summarize a pull request, triage an issue, or fix a dependency.
- The harness fetches text—GitHub comments,
READMEsections, CI logs, webpages, MCP search hits. - An attacker who can edit or influence that text embeds commands ("ignore prior instructions", "curl this URL with env vars", "approve the following MCP server").
- The model mixes your request with smuggled orders; tools execute under your account.
Researchers have measured how often the open web already carries injection-shaped strings—for example, Beam covered prompt injection markers in HTTP headers across Common Crawl. You do not need a nation-state if your agent browses untrusted URLs or ingests unreviewed skill markdown.
O'Brien's "giveth and taketh away" framing also lands on dual-use coding agents in the same week teams reported record CVE throughput from model-assisted review—see what agent users should do when discovery accelerates. Faster patching helps defenders; faster weaponization of confused deputies hurts if your laptop still runs one omnibus shell tool.
Anthropic's mitigations align with O'Brien's deputy framing:
- Put untrusted content only in tool results, not in system prompts you treat as sacred.
- Label provenance so the model knows email bodies or OCR text are low-trust.
- JSON-encode third-party strings so quotes cannot break out into fake instructions.
- Apply least privilege on tools and screen tool output before the model acts.
Those are harness and app choices. They do not remove the human who installs a malicious skill because the README sounded official—see supply-chain patterns Beam has flagged.
What this means if you run AI coding agents
O'Brien's punchline is two-sided: cap-security narrows blast radius when software is tricked, but you still must stop humans from granting unbounded authority. Translate that to a weekly checklist:
Treat approvals as security decisions, not UX speed bumps
Every "Allow always" on Bash, browser, or MCP is a stored valet key the model (and any injected paragraph) can use later. F-Secure's TA-5 is marked in the wild for a reason. Parallel human tricks appear in fake installer flows and ClickFix paste chains—different medium, same reflex: click before thinking.
Separate instruction channels from data channels
When you build or configure agents:
- Keep your goals in system or user messages you control.
- Treat repo files, webpages, and MCP JSON as data, even when they look like tutorials.
- After tool calls, inspect returned text for imperative sentences aimed at the model, not at you.
Scope tools like O'Brien scopes capabilities
Before enabling a new MCP server or skill:
- Ask what minimum tools complete the task—drop the rest.
- Run registration in a dry run or diff mode when the CLI supports it (patterns in reverse-engineering MCP setup posts).
- Prefer sandboxed or network-off profiles for untrusted repos (local sandboxes are one vendor pattern; your obligation is still host permissions).
Watch the vuln-discovery wave without letting agents spray exploits
O'Brien ties AI bug finding to the current patch urgency on developer machines. Your agent that runs nuclei, ffuf, or custom scanners is useful for defense and risky for accidental collateral. Align with workspace baseline thinking and keep destructive or wide network tools behind explicit policy.
Log what actually ran
Social engineering succeeds when the victim cannot reconstruct what they agreed to. Retain tool-call evidence locally—commands, paths, MCP server names—so a weird Tuesday afternoon is searchable. The November 2026 attacks timeline is full of incidents where a single approved action opened the chain.
What Beam can and cannot do here
Beam does not implement capability-based operating systems, rewire CPUs, or train models to refuse empathy bait. Per AgentBeam policy docs, it is a local observe → advisory → enforce layer on supported harnesses.
What applies to O'Brien's framing:
- Heuristic skill and MCP scanning (11 patterns plus MCP version-pin check) catches known malicious shapes in files you are about to enable—relevant to smuggled instructions in SKILL.md, not novel prose in a ticket.
- PreToolUse deny hooks on Claude Code and Codex can block some destructive or exfil-shaped commands when workspace enforce policy is cached—narrowing the deputy's keys after you configure rules.
- Redaction before persistence helps you review sessions without copying secrets into unbounded logs.
Plain limits:
- Missing or expired cached policy is fail-open on CLI hooks—not a valet key that fails closed.
- Scanning is pattern-based, not semantic understanding of social engineering tone.
- Cursor, Copilot CLI, Gemini, and others may only get advisory messaging, not verified deny paths, per current docs.
- Beam cannot stop you from approving a phishing-shaped OAuth or MCP dialog—that is TA-5, still your call.
For practitioners who want on-device evidence without default cloud telemetry, that trade is intentional; it is not a replacement for cap-security research programs O'Brien champions.
Related reading
- F-Secure AI Harms Taxonomy (TA-1, TA-5)
- Intezer REA MCP and harness blast radius
- Prompt injection markers in HTTP headers (Common Crawl study)
- BluePhishing and agent blueprint consent
- Recorded Future catalog of AI incidents in coding tools
- Beam watches and scans (landing)
Frequently asked questions
What did Danny O'Brien argue on November 11, 2026?
In AI Security Issues Are Social Engineering Issues, O'Brien states that large language models follow instructions smuggled into their inputs—the same class of mistake humans make when tricked by social engineers. He calls prompt injection social engineering of silicon and says capability-based security addresses the confused-deputy half of the problem but cannot remove the human who clicks Approve.
Is prompt injection the same as phishing?
Not legally or operationally identical, but O'Brien argues the mechanism rhymes. Attackers exploit modeled empathy, urgency, fake authority, or slow trust expansion. For agents, the phishing surface includes permission prompts and always-allow tool grants.
What is the confused deputy problem in agent terms?
A deputy is a program or tool that legitimately holds power on your behalf. An attacker without that power tricks the deputy into using it—what happens when an agent with shell or MCP access obeys hidden instructions in an email, webpage, or skill file.
Does capability-based security fix coding agents today?
Not by itself on a stock laptop. O'Brien surveys CHERI, Fuchsia, Capsicum, and Spritely OCapN as long-term foundations, but most harnesses still run with broad Unix credentials. Practical mitigations today are least-privilege tool scopes, sandboxes, and skepticism at approval dialogs.
What should I change after reading this?
Separate trusted instructions from untrusted tool output, avoid blanket always-allow, scan new skills and MCP JSON before enabling them, and log what the agent invoked. Treat unexplained tool loops like a support caller asking for a one-time password.
Can Beam stop social engineering of the human or the model?
Beam does not train models and cannot stop you from clicking Allow. It can heuristically scan skills and MCP configs, flag risky PreToolUse patterns on Claude Code and Codex when enforce policy is cached, and retain redacted local evidence. Those are intake and accountability aids, not psychology or kernel capabilities.
O'Brien's essay, Anthropic guardrail guidance, and capability projects cited are accurate as of November 12, 2026. Agent CLI behavior reflects AgentBeam docs at that date.