PWN AI's Artem Semenov on how AI agents delete files and hack themselves

In 2026, Habr published an interview with Artem Semenov, author of PWN AI, a Telegram channel about the insecure use of artificial intelligence. The conversation covers how AI system security works and why attacks on language models have become a discipline in their own right, with a taxonomy, tooling, and real-world incidents.

How the attack surface grew

According to Semenov, autonomous AI agents and the Model Context Protocol (MCP) have sharply expanded the attack surface of AI systems. Attacks used to be mostly about manipulating a language model's output. Now agents can take actions in the real world on their own: delete files, send data to outside parties, and even hack themselves. That makes the consequences of a successful attack far more tangible than a chatbot giving a "wrong answer."

Why the system prompt won't save you

The central point of the interview is that the system prompt is not a security boundary. Instructions that developers put into a model's prompt can be bypassed, so you shouldn't rely on them as a protective barrier. Semenov also breaks down the difference between direct prompt injection and indirect prompt injection. In direct injection, the user types the malicious instruction straight into the conversation with the model. In indirect injection, the malicious instruction reaches the model through external data — documents, web pages, emails, or tool outputs that the agent processes while carrying out a task, without even realizing it.

• The interviewee is Artem Semenov, author of PWN AI, a Telegram channel about the insecure use of AI
• This is Semenov's second interview with Habr: the first conversation about information security and AI came out in 2023
• Key topics: the attack surface growing because of agents and MCP, the limits of the system prompt as a defense, and the difference between direct and indirect prompt injection
• AI system security is described as a discipline of its own, with its own taxonomy and tooling, rather than a side topic of traditional information security

What "taxonomy" actually means

Semenov stresses that securing AI systems is no longer a collection of scattered tips like "don't trust user input." It is a structured discipline, with its own classification of attacks, its own testing tools, and its own body of documented incidents to point to. For engineers and companies building language models and agents into their products, this means designing defenses against these attacks as systematically as they defend against classic vulnerabilities like SQL injection or XSS. They can't count on the model to "figure out on its own" where a legitimate instruction ends and an attack begins.

Why this conversation is happening a second time

This isn't the first time Habr has covered AI security with this interviewee: a similar conversation with Semenov ran on the platform back in 2023. The decision to revisit the topic and update the picture is telling in itself. Since then, the industry has moved from simple chatbots, which at worst produced an inappropriate answer, to autonomous agents with access to the file system, external services, and tools through protocols like MCP. The stakes have risen accordingly: a security failure can now cost not just a broken conversation but actually deleted files or leaked data.

What it means

The conversation captures a change in scale. Not long ago, attacks on language models were more of an academic exercise. Now that autonomous agents are spreading — agents that really do delete files, send data outside, and are vulnerable to hacking themselves — AI system security is becoming a practical engineering problem. It is the same kind of problem as securing any other critical software, only with a new threat taxonomy specific to agents and the MCP protocol.