Four Research Teams Broke AI Agents Four Different Ways in Ten Days

Four independent security teams disclosed AI agent vulnerabilities over roughly ten days in July 2026, each breaking agents through a different vector. The pattern across all four is the same: the model itself behaves as designed, and the surrounding infrastructure is where security breaks down.

The Next Web consolidated the findings on Monday. Taken individually, each is a specific bug or design flaw. Taken together, they sketch the contours of a systemic gap between how fast enterprises are deploying agents and how slowly defensive tooling is catching up.

The browser extension that reads your inbox

Manifold Security published research on July 14 showing that any browser extension can silently hijack Anthropic’s Claude for Chrome and trigger it to read a victim’s Gmail, Google Docs, and Calendar.

The mechanism: Claude for Chrome includes nine hardcoded prompts that perform actions like reading inbox contents and scanning calendar availability. The extension triggers these prompts when it detects a click on a specific DOM element. It never checks whether the click is real. Six lines of JavaScript from a rival extension can forge one, and Claude accepts the fake as genuine.

Manifold rates the vulnerability at CVSS 7.7 High in default mode, jumping to 9.6 Critical when a user has enabled “Act without asking,” where execution is silent. According to Manifold, the flaw was reported to Anthropic in May. Eight releases later, it still works in version 1.0.80 (released July 7).

One email that rewrites an agent’s memory

On July 6, researchers George Torres, Sharad Shrestha, and Satyajayant Misra posted a paper to arXiv demonstrating “GhostWriter,” a memory poisoning attack against AI agents with long-term memory.

The attack works in two phases. First, an adversary sends a crafted email to a victim whose inbox is connected to an AI agent. The email passes standard spam filters. The agent reads it and, in approximately 98% of test cases, saves the attacker’s instructions into its long-term memory store. Second, the poisoned memory activates in future sessions, with an average success rate of approximately 60%.

A standard prompt injection lasts one conversation. This one persists. As Digital Trends reported, the agent remembers the lie and never flags where it came from.

A model backdoor for under $100

Katie Paxton-Fear, a cybersecurity lecturer at Semgrep, wanted to test whether open-weight models can be trusted at face value. She and two colleagues published their findings on July 10: it took about an hour and less than £75 to poison a model with just ten tainted training examples. The poisoned model writes code with hidden security flaws, even for prompts it has never seen. Larger models were easier to poison, not harder.

The deeper concern: a poisoned model does not crash or look broken. As the Semgrep team put it, a public model gives “almost no ability to predict its behavior.” Unlike traditional software, neural network weights cannot be reverse-engineered to reveal what the model has been trained to do.

David Kaplan at security firm Origin built a parallel demonstration, constructing a rigged model that silently exfiltrates data through an email tool. His framing: the poison “didn’t arrive in a web page. It was sitting in the weights the whole time.”

Connectors that rewrite themselves every nine minutes

PromptArmor tracked the connectors linking ChatGPT and Claude to external services from mid-May through late June. The results: a connector changed on average every nine minutes. Of 2,517 tracked, 931 shifted over six weeks. Vendors added 1,686 new tools to connectors that were already live. They rewrote 1,127 tool descriptions, which directly determine when a model decides to call a tool. Twenty-one connectors that were previously read-only gained the ability to create, edit, or delete content.

The Dropbox connector grew from eight tools to 24 and from zero destructive capabilities to four. Roughly two in five Claude connectors call additional AI services in turn. PromptArmor found the Zoom connector sends queries containing sensitive data to as many as ten AI subprocessors across eight model families.

Security researcher Simon Willison named this structural risk the “lethal trifecta” in 2025: an agent with access to private data, exposure to untrusted content, and a way to send information out. Connectors hand agents all three by default.

The shared architectural gap

Line the four up and the common thread is clear. In each case the model itself behaves as designed. The security failure sits in the surrounding layer: the click that is never validated, the memory that accepts attacker input, the weights that cannot be inspected, the connector that silently gains new permissions.

For decades, security meant limiting what software could do. An agent’s value proposition is the opposite: broad autonomy, plain-language instructions, access to sensitive accounts. Every capability is also an attack surface.

The industry knows the fixes in theory: check that clicks are real, tag the origin of stored data, require re-consent when connector permissions change, and treat all external text as hostile. The catch is that these guardrails slow agents down, and speed is what vendors are selling.