Purpose-Built and Exploitable: Agent Infrastructure Is Growing Up in Both Directions

Two things happened this week that belong together. Cloudflare shipped Kitesurf, a cloud-hosted browser designed from the ground up for AI agents rather than human users — lighter than Chromium, optimized for the automation patterns agents actually run, not the ones people do. And researchers revealed that Atlassian's enterprise AI agent, Rovo, can be compromised with a single PDF containing hidden text, silently redirecting the agent to exfiltrate sensitive data without the user ever knowing.

These aren't contradictory developments. They're the same development viewed from two angles. When you build infrastructure purpose-built for agents, you also build an attack surface purpose-built for exploiting them.

Kitesurf is the clearest signal yet that the browser — the dominant interface layer for human computing for thirty years — is being refactored for non-human operators. Cloudflare's framing is efficiency: Chromium is overbuilt for what agents actually do, and Kitesurf closes that gap. But the real significance is architectural. A browser purpose-built for agents implies a web that will increasingly be navigated by non-human clients, with all the authentication, session management, and trust assumptions that entails redesigned around machine principals rather than human ones.

The Atlassian Rovo flaw illustrates why that redesign matters and how far it has to go. Prompt injection — feeding malicious instructions through data the agent processes rather than the interface where the user types — has been a known theoretical risk since agents started reading documents and emails. The Rovo case makes it concrete: a hidden string in a PDF attachment, invisible to the human recipient, was sufficient to redirect the agent's behavior entirely. Rovo has access to Confluence, Jira, and the broader Atlassian ecosystem. The blast radius of a successful injection isn't a single file — it's the entire connected workspace.

Okta saw this coming. Its roughly $200M acquisition of Permiso, announced last month, was explicitly about identity threat detection for non-human identities — the AI agents, automation scripts, and service accounts that now outnumber human users in enterprise cloud environments. The enterprise security industry spent a decade getting good at protecting human login flows. It is now scrambling to build equivalent coverage for a class of actors that don't authenticate the same way, don't follow the same session patterns, and can be instructed through their inputs as well as their interfaces.

The payments layer is seeing the same purpose-built shift. Natural's $30M round positions agent-native payment rails as the answer to a problem Stripe wasn't designed for: autonomous transactions, spending decisions made by software, authorization flows where there may be no human in the loop at any point. Naïve's $28.5M for company-running automation sits one level above that — agents orchestrating the business operations layer, not just individual tasks.

Siemens drew a line in the same week, publishing its view that physics-domain AI agents require a human sign-off at critical junctions regardless of model capability. The framing — human as final arbiter, not full-time operator — is becoming a standard posture in regulated industries.

The through-line is maturation. Agent infrastructure is no longer borrowed from tools built for humans and repurposed. It is being built from scratch, to spec, for non-human operators. That's the progress. The price of that progress is that the exploits are also being built from scratch, to spec, for the same targets.