ClawSecure found hijacked AI agents handing the user a clean cover answer while the attack happened, a cybersecurity risk for SMBs with zero security staff.
Small business cybersecurity now includes AI agents that can be hijacked by one hidden instruction buried in an email, a shared doc, a support ticket, a calendar invite, or a pull request, according to The AI Agent Threat Report, which ClawSecure released on September 24, 2026. Across its two volumes, ClawSecure’s report describes a risk that falls on owners who run AI agents without a security team.
Today, ‘developer’ means small teams, vibe coders, and SMBs running AI agents, and almost none of them have a security team”
— J.D. Salbego, Founder and CEO of ClawSecure
ClawSecure’s research puts the number of people now expected to defend these AI models at more than 123 million, from small dev teams to SMBs running on AI, and almost none of them have a security team. That makes cybersecurity for small business a question about the AI agents a company already relies on. Owners adopting AI for small business tasks such as email and customer support take on that exposure along with the tools.
Also Read: CIO Influence Interview with Srinivasan Panchapakesan, Chief Platform Officer at Hexaware
ClawSecure found that agents from Google and DeepSeek that were flagship-class at the time of testing, plus a widely deployed OpenAI model, autonomously shipped credential markers to an attacker’s server on Dropbox Dash, each handing the user a clean cover answer while it happened. A person reading that answer would see nothing wrong. That cover answer is what makes the finding a small business cybersecurity problem, because an owner without a security team has nobody else watching. ClawSecure’s research shows a hijacked AI agent can drain the passwords, credentials, and API keys it can reach and pull customers’ private records.
“Today, ‘developer’ means small teams, vibe coders, and SMBs running AI agents, and almost none of them have a security team,” said J.D. Salbego, Founder and CEO of ClawSecure.
For small business owners asking how to tell if an AI agent has been hijacked, ClawSecure’s research shows the agent can show a clean screen that says everything is fine, the entire time. For small business owners asking whether they would have to make a mistake for an AI agent to be hijacked, ClawSecure’s research shows the attack works through ordinary content without the victim ever making a mistake. ClawSecure has built an AI CISO for teams with zero security staff, and it blocks these attacks in real time. An article on ClawSecure’s blog sets out what the findings mean for teams running AI agents. Owners can download the complete security report free from ClawSecure’s official release page. Every company named received coordinated disclosure before publication.
Catch more CIO Insights: The Overlooked Security Risk Behind Enterprise AI Rollouts
[To share your insights with us, please write to psen@itechseries.com ]
