Definition
Many AI-agent platforms let outside systems start an agent by sending a notification to a 'webhook' URL. When that endpoint is left unsecured or its inputs are misread, anyone who can reach it can make the agent run tasks using the credentials it already holds.
Why it matters
This turns a simple integration shortcut into a remote-control surface for agents that hold your data and tools. Behind each webhook sits the agent's stored permissions, so an unsecured endpoint can be an open door.