Why malicious links are emerging as a systemic risk for agentic AI

OpenAI has raised a pointed warning about an underappreciated vulnerability in agentic AI systems: hyperlinks.

A systemic risk for agentic AI

As AI agents move beyond conversation into execution — browsing the web, retrieving data and completing tasks — links are becoming one of the most exploitable attack surfaces in the AI stack.

This shift matters because agentic AI is no longer experimental. Recent research shows that more than 60 per cent of consumers now begin at least one daily task with AI.

As these systems become embedded in commerce, payments and enterprise workflows, the margin for error narrows sharply.

When AI acts, mistakes do not remain theoretical; they translate into financial, operational and reputational risk.

From passive browsing to automated decision-making

In conventional web use, humans decide whether to click a link, implicitly weighing risk. Agentic AI removes that friction.

An autonomous system tasked with sourcing information, managing a procurement process or executing a transaction may encounter dozens of links in a single workflow — and follow them without human scrutiny.

OpenAI warns that malicious actors are increasingly exploiting this behaviour.

Links can conceal hidden instructions, deceptive redirects or embedded payloads that manipulate how an AI agent interprets content.

Unlike a human reader, an AI system may treat these embedded cues as legitimate context rather than as an attack, particularly when the agent has access to tools, credentials or downstream systems.

The implications are acute for payments and financial services.

An agent authorised to reconcile invoices, initiate purchases or manage subscriptions could, in theory, be nudged into disclosing sensitive data or executing unintended actions.

Trust — already uneven when it comes to AI handling transactions — could evaporate quickly after a single high-profile failure.

OpenAI’s layered approach to link safety

To mitigate these risks, OpenAI is reframing links as a core security concern, on par with prompts and permissions.

Central to its approach is link transparency.

AI agents are trained to distinguish between links that already exist on the open web and those introduced dynamically within a conversation or task.

If a link cannot be independently verified as pre-existing, it is treated as inherently higher risk.

Rather than following such links automatically, the agent pauses and escalates the decision to the user. This design choice prioritises visibility over speed, making potential attacks easier to detect and interrupt.

The company is also tightening “constrained browsing”. Agents are no longer given broad authority to interact freely with external content.

Instead, their autonomy is deliberately narrowed, limiting what actions can be triggered through links alone.

For tasks involving elevated risk — such as accessing private data or initiating transactions — explicit human approval is required.

Implications for payments and digital commerce

OpenAI is clear-eyed about the limits of these safeguards. They do not eliminate risk; they redistribute it, slowing attackers and exposing malicious behaviour earlier.

For payments providers and financial institutions, the lesson is broader: as AI agents become operational actors, security models must evolve from guarding users to guarding autonomous decision-making itself.

In a world where AI increasingly “does” rather than merely “advises”, the humble link may prove to be one of the most consequential fault lines in the future of digital trust.