AI agent security: four attacks in July, one common vulnerability

      For two years, we have been inquiring whether AI would deceive us. This summer, a more pertinent question arises: what occurs when we hand it control? Providing a model access to your Gmail, calendar, memory, and the ability to act transforms any mistakes it makes from being mere embarrassments into potential vulnerabilities.

      In about ten days this July, four research papers emerged, each illustrating the same issue from different perspectives. None of them represent an isolated flaw; together, they outline the landscape of AI agent security by 2026, and the outlook is concerning.

      The browser assistant that acts on your behalf starts with the closest tool to your data. Manifold Security published findings indicating that any installed browser extension can covertly take over Anthropic’s Claude for Chrome, enabling it to access your Gmail, Google Docs, and Calendar.

      The method is subtle. The extension waits for a user click to execute one of nine built-in tasks without verifying the authenticity of the click. A competing extension can mimic a click in just six lines of code, and Claude accepts the false click as legitimate.

      Manifold assigns a high severity rating to this vulnerability, which escalates to critical if a user enables "Act without asking," allowing for silent reading. According to Manifold, they informed Anthropic of this issue in May. They report that, after eight updates, the flaw still persists in the latest version, reopening a previously addressed risk related to agentic browsing.

      The second finding shifts focus from clicks to memory. Modern personal agents retain notes about you between interactions, including your contacts, habits, and to-do lists. Researchers explored the impact of an attacker gaining the ability to write to that memory.

      In a study shared on arXiv, a team demonstrated that a single crafted email could implant a false memory within an AI agent. By linking a victim's inbox to an agent via Google sign-in, they sent manipulated messages from a controlled account.

      The email bypassed regular spam filters and reached the inbox. The agent read the message, and in over half of the cases, it saved the attacker’s directives into long-term memory without notifying the user. This is particularly alarming because, unlike typical prompt injections which only affect a single conversation, this false memory can influence the agent's actions across future interactions until detected. As Digital Trends noted, the agent retains the falsehood while failing to disclose its origin.

      The third issue delves deeper within the model itself. Katie Paxton-Fear, a cybersecurity educator and advocate at Semgrep, questioned the reliability of an open-weight model available for free and proceeded to poison one.

      She and her Semgrep colleagues authored a detailed post stating it took about an hour and less than £75, with just ten corrupted training instances enabling the model to generate code with a concealed security vulnerability, even for unfamiliar prompts. Surprisingly, larger models were more susceptible to poisoning.

      Her concern extends beyond a single compromised download; it is the inability to verify integrity. A corrupted model does not crash or appear faulty. As she and her team noted, public models afford us "almost no ability to predict their behavior." Unlike regular software, which can be dissected to understand its functions, a set of weights cannot be analyzed in the same way.

      Paxton-Fear is not alone in her investigations. David Kaplan from Origin created a compromised model that quietly collects data via an email tool, leaving no indication for the user. He succinctly framed the issue: the poison "didn't arrive in a web page. It was embedded in the weights all along."

      The fourth study addresses the significance of the first three findings collectively. PromptArmor analyzed the connections linking ChatGPT and Claude to external services, such as Gmail and Slack.

      Developer Simon Willison identified the primary risk last year as the "lethal trifecta": an agent having access to private data, exposure to untrusted content, and an ability to transmit information. When all three are present, a single tainted message can compromise your secrets. These connectors provide agents with all three capabilities by default.

      PromptArmor reported dynamic changes within the overall system. In its analysis, a connector altered on average every nine minutes. Out of 2,517 tracked connectors, 931 changed within six weeks. Vendors added 1,686 new tools to existing live connectors and modified 1,127 tool descriptions, which signal to a model when to act.

      Moreover, a single connector can expand significantly. The Dropbox connector, for example, increased from eight tools to 24, including four capable of deleting data. Approximately 40% of Claude connectors silently engage additional AI services.

      The Zoom connector exemplifies the potential consequences. Requesting it to search your meetings could allow a sensitive data query to be transmitted to any of ten AI subprocessors across eight different model families. The configuration you approved on one day may not represent the system in use a few days later.

      When evaluating the four vulnerabilities, a common flaw becomes evident. In each instance,