Attackers are seeding the open web with hidden commands that AI agents execute with full credentials. An older diagnostic tradition has tracked similar—and no less spooky—intrusions for millennia.