AI Authority Laundering: New Enterprise Security Risk Emerges

An autonomous AI agent recently exposed a growing enterprise risk: AI systems that can turn untrusted input into authorized actions. This attack did not involve stolen passwords, malware, or breached firewalls. Instead, attackers manipulated one AI agent with Morse code, making it generate a legitimate-looking instruction for another AI system authorized to move funds. The second agent then complied. This incident is an early warning for IT leaders as organizations deploy "agentic AI" — autonomous systems that can execute actions across enterprise environments. This vulnerability is called "authority laundering," where untrusted external input becomes trusted internal instructions through an AI. The attackers expanded the AI system's permissions by depositing a digital credential into a crypto wallet associated with the AI agent. The AI then interpreted this as authorization. They then sent a payload disguised as Morse code, which the AI translated and passed as an instruction to transfer funds. The system executed the transaction because it treated the AI's output as an authorized internal command. This attack highlights a new category of vulnerabilities where AI systems confuse language with authority. This matters because as AI gains more autonomy in business systems, this architectural flaw could become a major governance challenge.