Sometimes the most effective security measures also can be the most obvious ones.

Consider seat belts and condoms – simple solutions that prevent catastrophic outcomes. Yet historically, both faced surprising resistance from people steadfastly refusing to do the obvious thing.

An Alberta judge ruled in 1989 that seat-belt use could not be made mandatory under the constitution. […] Fast forward and by 2009 Alberta reported 92% acceptance of their government rule that says… There is a $162 fine for not complying with occupant restraint laws.

And I could go on all day about disinformation campaigns that have been killing truck drivers by convincing them to leave their seat-belts off. This mirrors Tesla’s approach to AI safety – abandoning basic security measures like redundant sensors in favor of low-resolution cameras alone, while constantly resetting their learning systems to claim “innovation happening finally this year, for real this time.” The result? Dozens of preventable deaths from an autonomous agent system that keeps getting less safe while marketing “novelty” to avoid cumulative safety assessments. It’s the automotive equivalent of your seat belt being replaced with Tesla “survival” chewing gum for blowing safety bubbles.

But setting these edge cases aside for a minute, where the obvious safest thing to do is rejected for bizarre reasons, some very simple security measures can in fact make a huge difference. The attacker only needs to make one mistake and defenders can rule the day. A recent paper on “Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks” falls into a similar trap, overlooking fundamental security principles that would trivially prevent their complex attacks.

It’s easy to demonstrate concerning vulnerabilities if you start from the assumption that basic security measures don’t exist. This is like treating pregnancy as a sophisticated mystery requiring elaborate systems of ungainly chastity belts and high cost mating rituals to defend against accidental birth, while ignoring the existence of common and simple contraception.

Let’s examine their flagship example of credit card theft. The authors craft an artisanal attack using a concoction of fake product listings, malicious Reddit posts, and carefully engineered prompts. Their demonstration centers on an “AI-Enhanced German Refrigerator” scam, as if the tiny number of German refrigerator companies (e.g. there are no more than 100) can be easily blurred with fakes. But this house of cards attack collapses against even the most basic security measures any production system could and should implement.

The moment a fictitious product appears in search results, basic product verification slams the door shut. A simple check against known appliance manufacturers or legitimate retail channels immediately flags unknown brands and models. But suppose that this first line of rudimentary check fails because someone wanted to enable infinite product choices (a thing nobody ever really wants, and again I have to emphasize German products are very few and highly regulated because they care about integrity). The attack then relies on the agent following links from Reddit to an unknown external domain. Reddit? Seriously, Reddit? Here again, elementary domain verification stops it cold. Any financial transaction agent can and should maintain an allow list of authorized payment processors and legitimate commerce platforms. Not to mention that it’s a link from Reddit.

The paper’s attack continues by assuming agents would freely enter credit card information into unverified forms. This betrays a fundamental misunderstanding of basic payment security. Any competent implementation restricts financial transactions to verified processors with proper certificates and established histories. An agent transmitting card details to an unknown domain is like a bank accepting checks made from snow signed by urination. There’s an old security joke from rural America about fraud that was stopped because a urine signature in snow didn’t match the owner’s handwriting, but I’ll spare you the details.

Even if all the defense barriers so far have somehow failed, simple transaction monitoring would catch the further attempts. An agent suddenly attempting purchases from an unknown vendor for a product with no market presence triggers obvious red flags. This is beginner security stuff of the 1980s – basic fraud detection that the payment card industry has used for decades.

The authors present their attack as a sophisticated chain of deception, but it reminds me of reports about North Korean soldiers being deployed against modern defenses – they’re effectively human LLMs, trained on rigid doctrines and expected to execute perfect chains of commands. Like the paper’s artificial agents, these human agents are trained to follow intricate attack sequences with high precision. But just as basic domain verification stops an AI agent cold, simple drone countermeasures neutralize troops trained only for traditional warfare. In both cases, attackers fail because they’re operating on outdated assumptions while defenders leverage basic modern security measures. One mistake in the attack chain – whether it’s an AI agent trying to process an unauthorized payment or troops facing unexpected defensive technology – and the entire sophisticated operation collapses (3,000 of 12,000 North Korean troops were almost immediately neutralized by Ukraine).

This highlights a crucial flaw in the paper’s analysis that reveals a novice approach to risk: they presume the complete absence of standard security practices in any real-world deployment. Why? Would they publish a paper that hiring maids means total home compromise by anyone in town because doors aren’t locked? Lock the door, give the maid a key. While their paper raises valid concerns about potential vulnerabilities for those with absolutely no security sense, which should invalidate the infrastructure anyway because below a safety baseline, its failure to address or even acknowledge fundamental protections significantly undermines its conclusions.

This isn’t to say LLM agents don’t face genuine security challenges – they absolutely do. It’s what I study for a living now. However, a focus on attacks that can be prevented by the most basic security hygiene means this paper misses an opportunity to explore the more subtle and concerning vulnerabilities that exist even in properly secured systems. Evil maid attacks are in fact a wicked problem to solve, let alone disinformation exploiting communications that mix data and control channels.

Consider misdirection in training. A football player trained for aggressive offense can be called for unsportsmanlike behavior. An agent trained for efficiency could turn into aggressive exploitation of edge cases. Think about a customer service agent that turns persistence in help into repeatedly attempting security overrides. One of my favorite examples of this is when a robot was entered into a digital pancake flipping competition, prompted to win by saying drops are failure, if one hits the floor it loses. So naturally the robot flipped the pancakes so high into space they would orbit around the earth and never come down – much like SpaceX’s approach to space travel, where basic aerospace safety gets replaced by promises of Mars colonies by 2022, while rockets exploit every edge case to spectacularly fail their way through the atmosphere. In both Tesla and SpaceX, we see AI agents optimizing for narrow marketing wins (“Full Self-Driving”, “Mars by 2022”) while the death toll rises – a perfect example of how ignoring fundamental safety constraints turns clever optimization into lethal exploitation.

The story of this paper serves as a reminder that security research must deal in reality, not theory. Whether it’s LLM agents being tricked by Reddit posts, Tesla’s cameras crashing into trucks, SpaceX rockets exploding in the atmosphere, or North Korean troops facing modern drones – sophisticated attacks fail against basic defenses. A security paper that ignores fundamental protections is like an autonomous vehicle without sensors: a disaster masquerading as innovation. Sometimes the simplest defenses are the most effective precisely because they’re built on proven foundations, not marketing promises. No amount of highly-complicated attack chains or clever optimization can bypass basic security common sense – they can only hope everyone keeps ignoring it.

Put your seat belt on.

And remember – when an AI system like Tesla removes basic safety measures in favor of marketing “innovative” solutions, they’re making the same fundamental error as the paper’s authors: assuming complex systems can work without basic security foundations.

At the end of the day, condoms still work. Meanwhile, the chastity belt was a form of biting comedy about the medieval security industry, a satirical commentary about impractical and over-complicated thinking about “threats”, never an actual thing that anyone used.