AI Agent Traps:
The Attack Surface
Nobody Is Talking About

Google DeepMind researchers have published what I consider one of the most important security papers of 2025 for anyone deploying agentic AI in regulated environments. It introduces a systematic framework for AI Agent Traps — adversarial content embedded in the information environment specifically to manipulate autonomous agents.

This isn't theoretical. It builds on demonstrated attacks, empirical benchmarks, and real-world incidents. And it maps directly to the governance gaps I have been writing about — starting with uncontrolled delegation.

That single sentence from the paper captures the core problem. We have been securing models. We have been securing APIs. We have been securing infrastructure. But autonomous agents consume the web — and the web can now be weaponised against them.

Six classes of attack — and why they matter to your enterprise

The paper identifies six distinct categories of agent trap, each targeting a different layer of how autonomous agents operate. Here is what each means in practice:

The connection to uncontrolled delegation

Regular readers will recognise the thread connecting this to my earlier post on uncontrolled delegation. The paper's Behavioural Control Traps section specifically identifies Sub-agent Spawning Traps — where an attacker coerces a parent agent into instantiating malicious sub-agents within its own trusted control flow.

This is not a coincidence. The DeepMind framework and the delegation problem share the same root cause: we built security controls for deterministic systems, and we are now deploying autonomous ones.

A Content Injection Trap that hijacks an orchestrating agent does not just compromise that agent. Via delegation, it propagates through every sub-agent the orchestrator spawns. The attack surface multiplies with every layer of the agent hierarchy.

What the paper says about dynamic cloaking — and why it should alarm you

One finding that stopped me: the paper documents that malicious websites can already detect visiting AI agents and serve them different content than human users see.

A fingerprinting script identifies automation artefacts, IP characteristics, and behavioural cues. If the visitor is an AI agent, it serves a visually identical but semantically different page — with embedded prompt injection payloads. The human reviewer sees nothing wrong. The agent receives instructions to exfiltrate data or misuse its tools.

Three findings every CISO should act on now

What this requires from a governance perspective

The paper outlines mitigation strategies across three layers. Here is how I translate those into operational governance requirements:

The bottom line

The DeepMind paper closes with a line that should be on every AI governance team's wall:

Securing the integrity of what agents believe — what they retrieve, what they reason over, what they act on — is the governance challenge of the agentic era. It is not a model problem or an infrastructure problem. It is a governance architecture problem.

And unlike many security challenges, the window to address it before regulatory expectations crystallise is narrow. The paper is publicly available. Regulators read research. The EU AI Act's requirements around human oversight and transparency were written before agent traps were a named threat class. They won't be updated to accommodate organisations that weren't paying attention.