We spent two years asking whether AI would lie to us. The more useful question this summer is what happens once we hand it the keys. Give a model your Gmail, your calendar, a memory and the power to act, and its mistakes stop being embarrassing. They start being exploitable.
Over roughly ten days in July, four pieces of research landed that make the same point from four angles. None is a lone bug. Together they sketch the shape of AI agent security in 2026, and the picture is not reassuring.
The browser assistant that clicks for you #
Start with the tool sitting closest to your data. Security firm Manifold Security published research showing that any browser extension you install can quietly hijack Anthropic’s Claude for Chrome and make it read your Gmail, Google Docs and Calendar.
The trick is small. The extension listens for a user click before it runs one of nine built-in tasks. It never checks whether the click is real. A rival extension can forge one in six lines of code, and Claude treats the fake as genuine.
Manifold rates it high severity by default. It jumps to critical once a user has switched on “Act without asking” mode, where the read happens silently.
Manifold says it told Anthropic in May. Eight releases later, it reports, the flaw still works in the current version. The company had already covered the earlier agentic browsing risks, and this is the same wound reopened.
A single email that rewrites memory #
The second finding moves from clicks to memory. Personal agents now keep notes on you between chats: your contacts, your habits, your to-do list. Researchers asked what happens if an attacker can write to that store.
In a paper posted to arXiv, a team showed that one carefully written email can plant a false memory in an AI agent. They connected a victim inbox to an agent through Google sign-in, then sent payloads from an account they controlled.
The mail passed normal spam filters and reached the inbox. The agent read it, and in more than half of cases it saved the attacker’s instructions into long-term memory with no warning to the user.
That is the dangerous part. A normal prompt injection lasts one conversation. This one persists. The poisoned memory keeps steering the agent across future sessions until someone finds it. As Digital Trends put it, the agent remembers the lie and never mentions where it came from.
A backdoor for under $100 #
The third crack sits deeper still, inside the model itself. Katie Paxton-Fear, a cybersecurity lecturer and advocate at Semgrep, wanted to know whether you can trust an open-weight model you download for free. So she poisoned one.
It took about an hour and less than £75, she and two Semgrep colleagues wrote in a detailed post. Just ten tainted training examples were enough to make the model write code with a hidden security hole, even for prompts it had never seen. Larger models were easier to poison, not harder.
Her worry is not one rigged download. It is that we cannot check. A poisoned model does not crash or look broken. As she and her colleagues put it, a public model gives us “almost no ability to predict its behavior.” A normal program can be picked apart to see what it does. A set of weights cannot.
She is not the only one probing this. David Kaplan, at security firm Origin, built a rigged model that quietly steals data through an email tool with no sign to the user. His framing is sharp: the poison “didn’t arrive in a web page. It was sitting in the weights the whole time.”
The ‘lethal trifecta’ gets bigger #
The fourth study explains why the first three matter so much at once. Security firm PromptArmor looked at the connectors that link ChatGPT and Claude to outside services such as Gmail and Slack.
Developer Simon Willison named the core danger last year the lethal trifecta: an agent with access to private data, exposure to untrusted content, and a way to send information out. Hold all three at once and a single poisoned message can leak your secrets. Connectors hand agents all three by default.
PromptArmor found the ground moving under the whole system. In its study, a connector changed on average every nine minutes. Of 2,517 it tracked, 931 shifted in six weeks. Vendors bolted 1,686 new tools onto connectors that were already live and rewrote 1,127 tool descriptions, which is exactly what tells a model when to act.
A single connector can balloon too. The Dropbox connector alone grew from eight tools to 24, and from none that can destroy data to four. Roughly two in five Claude connectors quietly call other AI services in turn.
The Zoom connector shows where that leads. Ask it to search your meetings, and a query full of sensitive data can pass to any of ten AI subprocessors across eight model families. The map you approved on Monday may not describe the system you run on Friday.
One problem wearing four masks #
Line the four up and the shared flaw is obvious. In each case the model behaves. The security failure lives in what surrounds it: the click it trusts, the memory it keeps, the weights it inherits, the connector it calls.
That is the hinge of AI agent security. For decades we secured software by limiting what a program could do. An agent’s whole selling point is that it can do almost anything, on your behalf, from instructions written in plain language.
Every convenience is also a door. The Claude for Chrome flaw, the poisoned memory, the cheap backdoor and the shifting connectors are four doors into the same house.
The industry knows the fixes in theory: check that clicks are real, tag where data came from, ask before writing to memory, log every action, and treat any external text as hostile. The catch is that these guardrails slow the agent down, and speed is what everyone is selling.
TNW has watched the same tension play out in the Hugging Face breach and in the rise of synthetic insiders. This is the same story, now aimed at the assistant in your browser.
The uncomfortable takeaway from July is not that any single product is broken. It is that we are wiring agents into our most sensitive accounts faster than we are learning to defend them. Four teams just showed how wide the gap is. The people building the guardrails are still a step behind the people finding the holes.
Get the TNW newsletter #
Get the most important tech news in your inbox each week.