What exactly do you think that little padlock in your address bar is telling you? If your answer is anything close to “this site is who it says it is,” you’ve been running on a bad assumption for years, and now your AI agents are running on it too.
Recorded Future has documented darknet vendors selling counterfeit TLS certificates pulled from legitimate certificate authorities, including Comodo, Symantec, and Thawte. Entry price is $299. The vendors register them using the real details of real businesses, and those businesses have no idea their identity is being rented out for phishing pages and man-in-the-middle setups. The certificates are not forged. They are issued. That distinction is the whole story.
Encryption is not identity
TLS does two jobs, and we collectively decided to only pay attention to one of them. It encrypts the connection, which it does well. It also attests that the entity on the other end controls the domain and, in theory, is the organization it claims to be. That second job depends entirely on whether the certificate authority did real verification work. When someone can buy a valid certificate issued under a stolen company identity for the price of a mid-tier software subscription, that verification step is decoration.
This is not a new tension. Google spent a long stretch arguing publicly that loose controls at Symantec let bad actors obtain certificates they should never have received. The industry has been having this fight for years. What has changed is who is checking the padlock now.
Your agent is a worse judge of trust than you are
Here is my actual problem with this, as someone who tests AI tools for a living. A human looking at a phishing page has a few weak but real instincts. The logo looks slightly wrong. The URL has an extra hyphen. The copy reads like it was translated twice. Those instincts are unreliable, but they exist.
An AI agent with browsing or tool-calling access has none of them. It has a TLS handshake that either succeeds or fails. If it succeeds, the agent treats the content as a legitimate source and moves on. I have yet to review a consumer-facing agent product that does anything more sophisticated than that. Most of them pipe fetched page content straight into a model’s context and let the model reason over it as fact.
Stack that against what these certificates enable and the math gets ugly:
- A man-in-the-middle position with a valid certificate means an agent’s API calls can be intercepted without a single warning surfacing anywhere in the stack.
- Agents operate at machine speed and volume, so one successful interception is not one bad decision, it is thousands.
- Agent output usually lands in front of a human as a clean summary, with the sketchy source laundered out of view.
- Nobody is reviewing an agent’s certificate chain decisions after the fact, because almost no agent product logs them in a form you could review.
What vendors are not telling you
Scroll through the security page of any autonomous agent platform and you will find a lot of language about encrypted connections and data in transit. You will find very little about how the agent decides a source is trustworthy, because for most of them the answer is that it doesn’t. It fetches, it parses, it believes.
That is a design gap, not a bug anyone is rushing to fix, and it predates this particular report. The certificate market just makes the gap cheap to walk through. $299 is not a nation-state budget. It is a line item.
If you are building or buying agent tooling, the questions I would be asking are unglamorous and specific. Does the agent pin certificates for the endpoints it depends on, or does it accept anything with a valid chain? Does it log which hosts it talked to and which certificates it accepted, in a format a human can audit? Does it treat fetched web content as untrusted input, or does it hand that content to the model as ground truth? Is there any mechanism at all for a human to review a source before the agent acts on it?
Most products I test fail at least three of those. Several fail all four and market themselves as enterprise-ready anyway.
Stop outsourcing judgment to a handshake
The fix is not clever. Treat TLS as what it is, a transport guarantee, and build your trust decisions somewhere else entirely. Allowlist the domains your agents can touch. Pin certificates on anything that handles credentials or money. Log the chain. Make the agent cite its sources in a way a human can actually check instead of a paraphrase that hides where the data came from.
Legitimate business owners are currently having their identities used to sign phishing pages without ever finding out. The least we can do is stop building software that accepts those pages without a second thought.
🕒 Published: