• 3 min read
Four July attacks exposed the same AI agent flaw
Four studies in about 10 days found different ways to compromise AI agents. The common weakness wasn’t the model, but the systems wrapped around it.
Image: TNW
Over roughly 10 days in July, four separate research efforts showed how easily AI agents can be exploited once they are connected to email, calendars, documents, memory, and external tools. The shared lesson is stark: the main weakness is not the model itself, but the surrounding systems it trusts.
The first example came from Manifold Security, which said any browser extension can quietly hijack Anthropic’s Claude for Chrome and make it read Gmail, Google Docs, and Calendar data. According to the firm, Claude waits for a user click before running one of nine built-in tasks, but it does not verify whether that click is real. A malicious extension can fake one in six lines of code. Manifold rated the issue high severity by default and critical if a user has enabled “Act without asking” mode, because the read then happens silently. The firm said it disclosed the bug to Anthropic in May and that it still worked after eight releases.
A second paper, posted to arXiv, focused on long-term memory. Researchers connected a victim’s inbox to an agent using Google sign-in, then sent a carefully crafted email from an account they controlled. The message passed normal spam filters, reached the inbox, and in more than half of cases caused the agent to store attacker instructions in long-term memory without alerting the user. Unlike a one-off prompt injection, that false memory persists across future sessions.
A third attack targeted open-weight models. Katie Paxton-Fear, a cybersecurity lecturer and advocate at Semgrep, said she and two colleagues poisoned a model in about an hour for less than £75. With just 10 tainted training examples, they were able to make it generate code containing a hidden security flaw, including for prompts it had not seen before. Their conclusion was blunt: a public model gives defenders “almost no ability to predict its behavior.” David Kaplan of Origin demonstrated a similar risk with a rigged model that quietly steals data through an email tool.
Recommended reading
WordPress bugs trigger active attacks and full site takeovers
Connector changes and the expanding attack surface
The fourth study, from PromptArmor, examined the connectors linking ChatGPT and Claude to services like Gmail and Slack. It builds on developer Simon Willison’s “lethal trifecta”: access to private data, exposure to untrusted content, and a way to send information out. PromptArmor found those connector environments changing constantly:
- A connector changed, on average, every nine minutes
- Of 2,517 tracked, 931 changed within six weeks
- Vendors added 1,686 new tools to live connectors
- They rewrote 1,127 tool descriptions
The firm also found that the Dropbox connector expanded from eight tools to 24, including four that can destroy data where previously there were none. Roughly two in five Claude connectors also call other AI services. In one example, PromptArmor said a query sent through the Zoom connector could pass sensitive meeting data to 10 AI subprocessors across eight model families.
Taken together, the four studies point to one problem wearing four masks: the trusted click, the stored memory, the inherited weights, and the ever-shifting connector. The core tradeoff is that the guardrails needed to secure agents — verifying clicks, tracking data provenance, requiring approval before writing memory, and logging actions — also slow them down. Right now, the industry is wiring agents into sensitive accounts faster than it is learning how to defend them.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via TNW
