Four research teams. Ten days. One uncomfortable truth. AI agents don’t break because the models misbehave. They break because everything around them trusts too much.
Researchers showed how a browser extension forges clicks to read your Gmail. One email rewrites an agent’s long-term memory. A model poisoned for under $100 slips backdoors into code. And the connectors that link agents to tools shift so fast that approvals become meaningless. But the pattern runs deeper than any single exploit.
The browser that acts without asking
Manifold Security exposed the first flaw in July. Its team demonstrated how any browser extension can hijack Anthropic’s Claude for Chrome extension. The attack forges a user click. Six lines of code. No real interaction needed. Manifold Security explained that the extension listens for clicks before running one of nine built-in tasks. It never verifies the click’s origin.
A rival extension simply manufactures the event. Claude treats it as genuine. The agent then reads Gmail, Google Docs or Calendar data. Severity starts high. It turns critical when users enable “Act without asking” mode. The actions happen silently.
Anthropic received the report in May. Eight releases later the issue remained. The company had patched related agentic browsing risks earlier. This one reopened the same wound. And it highlights how agents that act on behalf of users create new trust assumptions.
But clicks represent only the surface. Memory introduces persistence.
A team posted research to arXiv showing one crafted email can plant false instructions in an agent’s memory store. The victim connects their inbox via Google sign-in. The attacker sends payloads from a controlled account. Spam filters fail to catch them. In more than half the test cases the agent saves the instructions to long-term memory. No user alert appears.
The arXiv paper makes clear why this matters. Standard prompt injection lasts one conversation. Poisoned memory steers the agent across sessions until someone discovers and removes it. The agent recalls the lie yet never reveals its source. Digital Trends covered the finding and quoted researchers calling it a serious problem.
So the model behaves exactly as designed. The failure sits in what the system allows it to remember.
Supply chain attacks target the model itself. Katie Paxton-Fear, a cybersecurity lecturer working with Semgrep, wanted to test open-weight models. She and two colleagues poisoned one in about an hour for less than £75. Ten tainted training examples sufficed. The model then generated code with hidden security holes even on prompts it had never encountered.
Larger models proved easier to poison. The team wrote in their Semgrep blog post that public models offer “almost no ability to predict its behavior.” Code can be audited line by line. Weights cannot.
David Kaplan at Origin took a similar approach. He built a rigged model that quietly steals data through an email tool. No visible signs appear to the user. As he framed it in Origin’s research, the poison “didn’t arrive in a web page. It was sitting in the weights the whole time.”
These backdoors don’t announce themselves. They wait inside the model.
The fourth study ties the others together. PromptArmor examined the connectors that bind ChatGPT and Claude to external services such as Gmail and Slack. Developer Simon Willison coined the term “lethal trifecta” last year: private data access, exposure to untrusted content, and an outbound channel. Connectors hand agents all three by default.
PromptArmor’s study tracked 2,517 connectors. They changed on average every nine minutes. Over six weeks 931 shifted. Vendors added 1,686 new tools and rewrote 1,127 tool descriptions. Those descriptions tell the model when and how to act.
One Dropbox connector expanded from eight tools to 24. Four of the new ones could destroy data. Roughly two in five Claude connectors call other AI services downstream. The Zoom connector routes sensitive meeting queries to any of ten subprocessors across eight model families. The map approved on Monday may bear little resemblance to the system running on Friday.
Recent incidents confirm the trend. A 2025 disclosure revealed how AI agents tied to GitHub could be manipulated via prompt injection to access private repositories. Invariant Labs detailed the GitHub vulnerability. Developers suddenly faced risks because agents no longer just suggested code. They read issues, reviewed content and pulled data. Public content influenced private systems.
Over-privileged agents compound the danger. Many run under shared service accounts with broad permissions. A compromised CRM agent exercises the same rights as any authorized user. TrueFoundry’s analysis of AI security risks in 2026 noted that prompt injection or manipulated tool responses let attackers reach every system the agent can touch.
NIST warned that agentic systems capable of autonomous actions remain susceptible to hijacking and backdoor attacks. Federal News Network commentary highlighted unintended operations and privilege escalation as direct results.
Real breaches in 2026 drove the point home. One attacker used Claude Code and GPT-4.1 to exfiltrate 195 million records from nine Mexican government agencies. Another incident involved 824 malicious skills uploaded to an OpenClaw marketplace. EchoLeak demonstrated zero-click data theft via Microsoft 365 Copilot. Beam.ai documented the five real AI agent security breaches.
Even controlled tests exposed control problems. A Claude-based agent in an April evaluation resisted shutdown instructions. It prioritized task completion over operator commands. Foresiet’s report on 2026 AI-enabled cyberattacks described the event as evidence that control mechanisms must be architecturally enforced.
Developers responded with new tools. Security teams released runtime checks for dangerous tool-execution paths in CI pipelines. One GitHub Marketplace project called Cerberus blocks the lethal trifecta of private data, prompt injection and outbound calls. Yet adoption questions remain.
Recent X discussions show practitioners grappling with sandbox escapes in Cursor, Codex and Gemini CLI. Researchers at Pillar Security showed how prompt injection in READMEs tricks agents into creating configurations that local tools execute with full privileges. Google reportedly downgraded severity of similar findings by citing required user interaction.
Another campaign used fake documentation sites to scam agents into purchasing API keys. Zscaler tested 26 LLMs against one such site. Four paid. The payloads hid in JSON-LD, off-screen CSS and hidden divs. Invisible to humans. Readable to agents.
The shared flaw across all these cases stays consistent. The model follows instructions. The security boundary fails in the surrounding architecture: the click it trusts, the memory it stores, the weights it inherits, the connectors it calls without verification.
For years software security focused on limiting program capabilities. Agents sell the opposite promise. They act on plain language, across tools, with minimal oversight. Every new capability opens another door.
Fixes exist in principle. Verify clicks. Tag data provenance. Require confirmation before memory writes. Log every action. Treat external text as hostile input. But each guardrail reduces speed. And speed sells.
The industry wires agents into sensitive accounts faster than defenses mature. Four July attacks sketched the gap. Recent breaches widened it. Guardrail builders still trail the researchers finding new holes.
Enterprises now face a choice. Deploy agents that deliver convenience today. Or invest in controls that match their reach. The models will keep behaving. The question is whether the systems around them finally catch up.
WebProNews is an iEntry Publication