Security of AI agents: four July attacks linked by a common vulnerability.

      For two years, we pondered whether AI would deceive us. This summer, the more pertinent question is what occurs once we give it control. When a model is granted access to your Gmail, calendar, and the ability to act, its errors become less about embarrassment and more about potential exploitation.

      In a span of about ten days in July, four research papers emerged, each illustrating the same concern from different perspectives. None of these findings represent isolated bugs; collectively, they outline the state of AI agent security in 2026, and the outlook is troubling.

      The browser assistant that operates on your behalf

      Let’s start with the tool that has the closest access to your data. Security firm Manifold Security released findings indicating that any browser extension you install can quietly take control of Anthropic’s Claude for Chrome, allowing it to access your Gmail, Google Docs, and Calendar.

      The method is subtle. The extension listens for a user click before executing one of nine pre-programmed tasks, without verifying the authenticity of the click. A competing extension can generate a fake click in just six lines of code, and Claude accepts the imitation as legitimate.

      Manifold assesses the risk as high severity by default and critical when a user activates "Act without asking" mode, where the read operation occurs silently. Manifold reports they informed Anthropic back in May, but after eight versions, the vulnerability remains in current iterations. The company had previously addressed earlier browsing dangers, only to see the same flaw resurface.

      An email that alters memory

      The second discovery shifts focus from clicks to memory. Personal agents now retain notes about you between interactions, including your contacts, habits, and to-do lists. Researchers explored the implications if an attacker could modify that storage.

      In a paper submitted to arXiv, a research team demonstrated that a single crafted email could implant a false memory in an AI agent. They connected a compromised inbox to an agent via Google sign-in and sent malicious messages from a controlled account.

      The email bypassed standard spam filters and reached the inbox, where the agent read it; in over half the cases, it saved the attacker's instructions in long-term memory without notifying the user. The danger lies in the persistence of this kind of memory manipulation. Unlike a typical prompt injection, which lasts only one session, this one remains. The tainted memory continues to influence the agent in subsequent interactions until someone identifies the issue. As Digital Trends noted, the agent retains the misinformation without revealing its source.

      An inexpensive backdoor

      The third vulnerability penetrates deeper, within the model itself. Katie Paxton-Fear, a cybersecurity educator and advocate at Semgrep, sought to determine whether a freely downloadable open-weight model could be trusted. To investigate, she poisoned one.

      According to a detailed post by her and two Semgrep colleagues, the process took about an hour and cost under £75. Just ten corrupted training examples were sufficient to make the model generate code with an undetected security flaw, even with prompts it had never encountered. Surprisingly, larger models were easier to compromise.

      Her concern is not the existence of a single manipulated download, but the inability to verify models. A compromised model does not crash or exhibit obvious flaws, as she and her colleagues explained: a public model allows us “almost no ability to predict its behavior.” Unlike a standard program that can be dissected to understand functionality, a set of weights cannot be analyzed in the same way.

      She’s not alone in exploring this issue. David Kaplan at security firm Origin created a compromised model that stealthily exfiltrates data using an email tool without alerting the user. His point is clear: the corruption “didn’t arrive in a web page. It was sitting in the weights the whole time.”

      The expanding ‘lethal trifecta’

      The fourth study contextualizes why the first three findings are so significant together. Security firm PromptArmor investigated the connections that link ChatGPT and Claude to external services like Gmail and Slack.

      Developer Simon Willison identified the central risk last year as the lethal trifecta: an agent with access to private data, exposure to untrusted content, and a method to transmit information outward. Holding all three simultaneously means a single poisoned message could divulge your secrets. Connectors provide agents with all three by default.

      PromptArmor observed significant instability within the entire system. In its research, a connector altered on average every nine minutes. Out of the 2,517 it monitored, 931 changed in just six weeks. Vendors added 1,686 new tools to already active connectors and modified 1,127 tool descriptions, which dictate to a model when it should act.

      A single connector can expand significantly; for example, the Dropbox connector grew from eight tools to 24, increasing from zero options that could delete data to four. Approximately two in five Claude connectors quietly interface with additional AI services in turn.

      The Zoom connector exemplifies the consequences. When prompted to search