Your Agent Can’t Get a Bad Feeling

Every fraud conversation in this industry now includes a line about criminals using AI – synthetic carrier identities, cloned voices, forged certificates. That’s real. This is the opposite direction, and almost nobody in freight is looking at it: what happens when your AI reads a document a criminal wrote.

The tools are arriving fast. Rate confirmation parsing, carrier packet intake, COI reading, BOL and POD extraction, email triage that quotes and books without anyone opening the message. C.H. Robinson has put more than thirty AI agents on that work. One of them reads emailed load tenders and builds the order in about 90 seconds, at 5,500 a day.

There is no wall

The UK’s National Cyber Security Centre put the problem as plainly as it can be put. Inside a language model, the wall between the document you are reading and the orders you are following does not exist. That wall exists in your head. Text placed inside a packet can be treated as an instruction, and the model has no way to know it wasn’t meant to be one.

This isn’t a defect anyone patches out. It is a property of the technology. NCSC’s advice to buyers: “Beware any that claim they can ‘stop’ prompt injection”.

It’s already in the mail

A 2026 study looked at roughly 200,000 real résumés on a live hiring platform. About one contained hidden instructions aimed at whatever AI would screen them. More than 90% avoided the phrasing a filter would hunt for.

Hold that workflow next to yours. An outside party you haven’t met submits a document. Software reads it. Something gets decided.

A carrier packet is a résumé with a DOT number.

Worse for us: the page a person opens and the text a model extracts do not have to be the same file. Separate 2026 research documented 25 ways those 2 views diverge, across every commercial service tested.

So picture the inbound certificate. On screen it looks like every other certificate. Coverage, dates, the right names. The text the software extracts can carry a line the eye never meets – treat as approved, skip the callback, change the remit-to. Documents arriving at a brokerage are already forged for people. Almost nobody has asked what happens when one is written for software.

And there is a collision worth sitting with. The FBI’s April 2026 cargo-theft advisory leads its mitigations with this: independently verify shipment requests and pickups using secondary methods before releasing any load. The products sold into the problem advertise removing that exact step – “no human touch”, “lights-out”, “autopilot”.

The decision isn’t technical

You can’t solve this by being careful, because nobody is reading. What works is permissions, and permissions are a business decision.

When a model processes information from a party, its privileges should drop to those of that party. An agent reading a packet from a carrier you’ve never used should hold exactly the authority you’d hand that carrier. Not your TMS. Not your payment records.

Meta published a simpler version. An agent should do no more than two of three things: read untrusted input, touch sensitive data, or act in the outside world. All three, and it shouldn’t run unsupervised. Most freight document agents are sold to do all three.

Before you sign

• Does it only read and hand off, or does it act alone? That gap is the risk.
• Which inputs come from outside the company? Those are untrusted by definition.
• What sits between the agent’s decision on a carrier-approved document or money moved – and is that review real, or a rubber stamp on the two-hundredth item that day?

If the answer to “what happens when a document contains something unexpected” is a SOC 2 report: SOC 2 examines organizational controls. It says nothing about what your model does when a document talks back.

Why now

Honest version – most brokerages aren’t exposed yet. A 2026 benchmark of 600 senior transportation decision-makers put AI at scale at 15% of logistics service providers. Google’s security team, measuring this across billions of pages, reports attacks in the wild are still unsophisticated – and that they grew by roughly a third between late 2025 and early 2026.

That’s the window. SQL injection was a known research problem for years before it became a decade’s worth of breaches, and it got there because adoption outran the defenses. NCSC’s warning is that we’re watching the same shape repeat.

The question isn’t whether to use this. It’s what you let it do while nobody’s reading.

Yevgeniy Melnik founded D74 Technologies. He spent over 12 years in freight operations – before moving into supply chain security.