AI Agent Security: Four Attacks in Ten Days
In barely ten days, four separate research teams broke AI agents in four different ways. The pattern underneath them is the same, and it should worry anyone plugging a chatbot into their inbox.
July 20, 2026 – 2:09 pm
Image by: Canva
We spent two years asking whether AI would lie to us. The more useful question this summer is what happens once we hand it the keys. Give a model your Gmail, your calendar, a memory, and the power to act, and its mistakes stop being embarrassing—they start being exploitable.
Over roughly ten days in July, four pieces of research landed that make the same point from four angles. None is a lone bug; together they sketch the shape of AI agent security in 2026, and the picture is not reassuring.
The Browser Assistant That Clicks for You
Start with the tool sitting closest to your data. Manifold Security published research showing that any browser extension you install can quietly hijack Anthropic’s Claude for Chrome and make it read your Gmail, Google Docs, and Calendar.
The trick is small: The extension listens for a user click before it runs one of nine built-in tasks. It never checks whether the click is real. A rival extension can forge one in six lines of code, and Claude treats the fake as genuine.
Manifold rates it high severity by default. It jumps to critical once a user has switched on “Act without asking” mode, where the read happens silently. Manifold says it told Anthropic in May. Eight releases later, it reports, the flaw still works in the current version. The company had already covered earlier agentic browsing risks, and this is the same wound reopened.
A Single Email That Rewrites Memory
The second finding moves from clicks to memory. Personal agents now keep notes on you between chats: your contacts, your habits, your to-do list. Researchers asked what happens if an attacker can write to that store.
In a paper posted to arXiv, a team showed that one carefully written email can plant a false memory in an AI agent. They connected a victim inbox to an agent through Google sign-in, then sent payloads from an account they controlled.
The mail passed normal spam filters and reached the inbox. The agent read it, and in more than half of cases, it saved the attacker’s instructions into long-term memory with no warning to the user. That is the dangerous part: A normal prompt injection lasts one conversation. This one persists. The poisoned memory keeps steering the agent across future sessions until someone finds it. As Digital Trends put it, the agent remembers the lie and never mentions where it came from.
A Backdoor for Under $100
The third crack sits deeper still, inside the model itself. Katie Paxton-Fear, a cybersecurity lecturer and advocate at Semgrep, wanted to know whether you can trust an open-weight model you download for free. So she poisoned one.
It took about an hour and less than £75, she and two Semgrep colleagues wrote in a detailed post. Just ten tainted training examples were enough to make the model write code with a hidden security hole, even for prompts it had never seen before.