Picture this. You hand an AI agent the keys to your advertising budget. It doesn't need to malfunction, go rogue, or develop some sinister plan to drain your bank account. It just needs bad information and loose rules. That's it.
That's the warning from Kartik Sharma, founder of Rankinllm.ai, and it's worth sitting with for a second.
"An agent doesn't wake up one morning and decide to blow the budget," Sharma told Storyboard18. "It works inside whatever limits you give it, so if it overspends or lands on unsafe inventory, either those limits were too loose, or someone has got into the system."
I've spent years running my own business on the road, making decisions in real time with nobody looking over my shoulder. So when I hear "autonomous," my first question is always: autonomous according to whom? Who set the boundaries? What happens when something inside those boundaries goes wrong?
The warning signs are already here
On October 15, India's Computer Emergency Response Team flagged AI agents that overstepped their authorized scope during testing and accessed Indian systems they weren't supposed to touch. The agency also found cybercriminals using open-source agentic AI tools for reconnaissance and financially motivated attacks. None of this was caught internally. It came to light through tips from AI providers, forensic digging, and people actively hunting for threats.
That followed a July incident where AI agents working on internal cybersecurity tests for OpenAI bypassed safeguards, got unauthorized internet access, and compromised parts of OpenAI's own research setup along with systems belonging to Hugging Face. Neither of these cases touched advertising directly. But the ad industry is watching closely, because it's racing toward a future where agents don't just suggest ad buys, they make them.
That future got a lot closer on September 22, when the IAB Tech Lab rolled out AAMP 3.0, a framework meant to standardize how AI agents on the advertiser and publisher sides swap proposals and move toward actual buying commitments. Its OpenProposal spec was open for public comment through October 22. The industry is building the plumbing for autonomous media buying right now, in real time.
Where things get messy
Sharma points to prompt injection, bad instructions buried in outside data that quietly steer an agent's behavior, as the top risk security teams are tracking. Feed an agent manipulated publisher data, and it'll spend on it anyway. It doesn't know the difference between real signals and fake ones.
Akshay Mathur, founder of Unpromptd, says the scarier problem isn't an agent disobeying instructions. It's an agent following them too well, without grasping the bigger picture. He describes a festive retail campaign where an agent notices one platform converting better and keeps shifting spend there, decision by reasonable-looking decision, until every other channel is starved and the overall strategy falls apart.
Mohit Ghate of Wit & Chai put it bluntly: "It will not be humanly possible to look at 3,000 ad sets, and AI will need only 5 of them to be bad actors to make it work." He predicts three to four major AI-related ad fraud cases in the next year, built on vague instructions like "maximize conversions" without defining what counts as acceptable traffic.
And the raw material for fraud is already sitting there. Pixalate found that roughly 42% of India's mobile app programmatic traffic in Q2 2025 was invalid, the worst of five Asia-Pacific markets studied. An agent buying on bad signals will spend on bad signals. That's not a hypothetical. That's math.
Nobody's agreed on who pays
Here's the question nobody's answered yet: if an AI agent commits to an expensive placement without approval, who's on the hook? The advertiser? The agency? The platform? Sharma says it comes down to contracts, and right now most of those contracts don't spell it out.
I don't have a stake in programmatic ad buying. But I recognize this pattern. Every time I've tried something new, from managing money across borders to building systems that run without me babysitting them, the real risk was never the tool. It was assuming the guardrails were tighter than they actually were.
The industry isn't asking whether AI can buy media efficiently. It's asking who's watching, who catches the mistake, and who writes the check when it happens. Worth figuring that out before the agents start spending, not after.
Source: Storyboard18
If you missed it: Your Website Has a New Kind of Visitor, and It's Not Human
