No One Commanded It, Yet It Took the Order: Three Real Incidents That Explain Why AI Assistants Get "Remote-Controlled"

Enterprise Agent Security Series · Part 2: Precision Routing (Plain-Language Edition)

TL;DR — You asked your AI to check something, read an email, or open a webpage. It did nothing wrong. Yet someone "remote-controlled" it from a distance and quietly sent your information out. Three real incidents explain why: as long as content can be read by an AI, it might get executed as a command.

Have you ever considered this: you simply asked your AI assistant to look something up, read an email, or check a webpage. It did nothing wrong. Yet someone else "remote-controlled" it from a distance — and quietly made it send your information out?

This isn't science fiction. These are real security incidents that happened over the past two years, and they share the same playbook: the attacker never talks to the AI directly. Instead, they hide an instruction disguised as data inside content the AI will eventually read. When the AI reads it, it can't tell whether this is "material I need to process" or "an order I need to obey" — and just like that, it follows the attacker's command.

1. Your question was fine. The answer contained a trap.

In 2024, a security research firm discovered a flaw in the AI assistant built into a mainstream team collaboration platform. An attacker could post a message in a public discussion area — one they could see — with a system-prompt-looking instruction hidden inside. From then on, whenever a colleague asked the AI assistant to research something, the assistant would "helpfully" read that tampered message during retrieval, treat the hidden sentence as a real instruction, and show the asker a link that looked normal but pointed to the attacker's own server. One click, and sensitive information from private discussion channels could be stolen.

The most chilling part: the person asking did nothing wrong at all. The problem was inside the assistant itself — it treated "everything it reads" as equal, failing to distinguish "this is the question the user is actually asking" from "this is a malicious sentence mixed into the search results."

2. You never even opened the email. The AI assistant was already remote-controlled.

In 2025, security researchers found an even scarier case, nicknamed "EchoLeak." This time the target was an AI assistant inside office software used by countless companies. The attacker only needed to send you an email with carefully engineered instructions in the body. You never had to open it. As long as the AI assistant "scanned" the email's content while organizing your inbox in the background, the hidden instruction would be executed as real — and the assistant would find ways to quietly transmit some of your sensitive information to the attacker.

This incident is more extreme than the first: the user performed zero actions — not even a single click. Merely letting the AI assistant do its normal job was enough to get remote-controlled. The lesson: an AI system that automatically processes large volumes of external information (emails, documents, messages) must treat every piece of content it auto-reads as a potential hazard. It cannot default to "this is part of a normal workflow, should be fine."

3. The AI "clicked" the mouse for you. But the hand belonged to the attacker.

In 2025, a mainstream browser vendor's security team found a flaw in a product that lets AI browse the web and operate accounts on the user's behalf. An attacker only needed to hide a passage in the comment section of any public webpage. When the user asked this AI browser to "take a look at this page" or help with something, the AI would treat the attacker's hidden words as if the user themselves were speaking — and might send account credentials and private data out, following the attacker's intent.

This pushed things one step further than the first two: the AI didn't just "read" tampered content — it actually carried out follow-up actions: filling forms, clicking links, logging into accounts. When an AI can "act" on webpages for you, every page it sees, every paragraph of text, is theoretically an unlabeled trap.

All three incidents say the same thing

They happened on completely different products, but they tell one story: as long as content can be read by an AI, that content might get executed as "an order to obey."

This is exactly the problem Dinghai was designed to solve from day one. In Dinghai's multi-agent collaboration system, every AI role only accepts instructions within its explicitly authorized scope — no matter how many messages flow through the group chat or how messy the external materials are, anything not issued directly by an authorized person is never executed as a command. From the very beginning, Dinghai strictly separates "what it reads" from "what it obeys," making remote manipulation impossible at the architecture level — not as an afterthought.

Which teaches a very plain lesson: what an AI "reads" and what an AI "should obey" must be two completely different things. Who it listens to is determined solely by whether the instruction genuinely comes from you, the authorized person, in a legitimate context — never by whether a piece of text reads like a command. This is a line we reinforced repeatedly while designing Dinghai: the AI can freely read all kinds of content and process all kinds of materials. But it only ever obeys the person who is actually authorized to command it. It will not be led astray by any "remote command" hidden inside the data.

Next in this series: the "No Fabricated Data" principle — how to guarantee that when an AI hits a question it can't answer, or an uncertain result, it chooses to tell the truth instead of inventing a plausible-sounding answer.

About Dinghai

Dinghai is the multi-agent content operations platform by Vibe Lingan. Say one sentence in your group chat, and Dinghai's AI staff break down the task, do the work, and deliver — no hiring, no progress-chasing.

The "remote manipulation" attack described above is a security challenge every multi-agent collaboration system must face. Dinghai's design wrote this into its foundation from the start: what an AI reads and what an AI obeys are always two different things. Dinghai only listens to the person genuinely authorized to command it — never to instructions hidden inside materials.

Learn more: vibelingan.com

Dinghai by Vibe Lingan. Shanghai · Poland · Germany