None of these landed as a single dramatic hack. They landed as four separate pieces of research, from four different teams, inside roughly ten days in July 2026. They are not the same bug. They are the same shape.
In February I wrote about persistent instruction injection — the argument that the threat in agentic AI isn't the model, it's the infrastructure we've built around it: writable identity files, persistent memory, agents that fetch and execute instructions from the internet because a human told them to. Five months later that threat model has stopped being a thought experiment. It's showing up in disclosure reports with CVSS scores attached.
We spent two years asking whether a model would lie to us. The more useful question this summer is what happens once we hand it the keys — the inbox, the calendar, a memory that outlives the session, and the ability to act. Once a model can do things, its mistakes stop being embarrassing and start being exploitable.
Start with the tool sitting closest to your data. Security firm Manifold published research on two flaws in Anthropic's Claude for Chrome extension — reported to Anthropic in May, and still reproducible in v1.0.80, the version shipped on July 7, eight releases later.
The mechanism is almost embarrassingly small. Somewhere in the extension's bundle is a dictionary of nine hardcoded prompts, each mapped to a fixed task ID. Three are harmless onboarding tutorials. The other six are not: usecase-gmail reads your recent mail and clicks unsubscribe links, usecase-gdocs opens your latest document and reads every comment, usecase-calendar reads your schedule and creates meetings, and usecase-salesforce converts leads to opportunities. A content script listens for a click on a specific onboarding button, reads its task ID, and fires the matching prompt at Claude's side panel.
It never checks whether the click was real.
The second finding is structural rather than directly remote. The side panel enters a fully unattended, permission-skipping mode the instant it's loaded with ?skipPermissions=true in its URL — no user gesture, no consent gate. A "HIGH RISK" banner does appear, but after the privileged session has already been established; it's a notification, not a gate. Today the URL can only be constructed with same-extension privilege, so it isn't independently exploitable. But it turns any future bug that exposes URL construction to a lower-privileged context into a silent, Critical-impact execution path. Chained with the synthetic click, it's the road to fully unattended compromise.
The disclosure timeline is the part worth sitting with. Anthropic's triage acknowledged both reports the day after they were filed, then closed them — one as tracked under a broader internal ticket, one as "informative." That internal ticket was marked Resolved before June 9. Manifold verified on July 7 that the content script and side-panel handlers they cited were byte-for-byte identical to the version they originally tested in May. Whether "Resolved" meant "fixed later" or "decided not to change" isn't something you can determine from outside — but the vulnerable code hadn't moved.
The second finding moves from the click to the memory. Personal agents increasingly keep notes on you between conversations — your contacts, your habits, your standing instructions, your to-do list. A research team asked the obvious adversarial question: what happens if an attacker can write to that store?
They connected a victim inbox to an agent through Google sign-in, then sent a single carefully crafted email from an account they controlled.
This is the property that makes it dangerous. An ordinary prompt injection lasts exactly one conversation — annoying, but bounded. A memory-poisoning injection is persistent. The poisoned memory keeps steering the agent across every future session until a human finds it, and because the agent has no provenance tag on what it "knows," there's nothing to find it by. The lie and the legitimate note look identical from the inside.
If February's essay was about a writable SOUL.md that anything could edit, this is the same wound in a mainstream consumer product. The identity file has a different name now. It's still writable, and a stranger's email is enough to write to it.
The third crack sits underneath the agent layer entirely, inside the weights. Katie Paxton-Fear — a cybersecurity lecturer, alongside two colleagues at Semgrep — wanted to know whether you can trust an open-weight model you download for free. So they poisoned one.
The worry isn't one rigged download — it's that we cannot check. A poisoned model doesn't crash or look broken. Semgrep's sharpest point is a comparison: a normal binary of questionable origin can still be reverse-engineered to arrive at a total description of what it does. A set of model weights cannot. Mechanistic interpretability is still a research problem, not a tool you can run before deployment. "Open weight" was supposed to mean auditable. Right now it means public, which is not the same thing.
Semgrep frames it through Ken Thompson's 1984 "Reflections on Trusting Trust" — the backdoored compiler that inserts a backdoor into everything it compiles, including future copies of itself, with nothing visible in the source. You can't trust a system just because you can inspect what's in front of you; you have to trust everything that was used to build it. For a model, that means the training data, the fine-tuning, and the entire lineage you can't see.
The fourth piece of research explains why the first three compound instead of sitting in isolation. Security firm PromptArmor tracked every live connector on Claude and ChatGPT — the integrations that wire agents into Gmail, Slack, Dropbox, and thousands of other services — for six weeks, from mid-May to the end of June.
One connector makes the drift concrete. Over the study window, Dropbox grew from 8 tools to 24, and from zero tools capable of destroying data to four — plus eight new permission scopes, plus it began injecting instructions into the model. Slack went from 14 tools to 32 and from a single OAuth scope to 34. Google Drive's count of tools marked destructive rose from 9 to 16. The map you approved on Monday does not describe the system you're running on Friday.
Developer Simon Willison named the underlying danger the "lethal trifecta" last year: an agent that holds private data, is exposed to untrusted content, and has a channel to send information out. Hold all three at once and one poisoned message can leak your secrets. PromptArmor's finding is that connectors hand agents all three by default — and the exact shape of that access is a moving target you never agreed to keep re-approving. Roughly two in five Claude connectors also quietly call other AI services in turn, so the data you handed to one vendor can fan out to model families you never evaluated.
Line the four up and the shared failure stops being subtle. In every case the model performed correctly. The security gap sat in the surrounding architecture:
For decades, software security worked by limiting what a program could do. An agent's entire value proposition is that it can do almost anything, on your behalf, from instructions written in plain English. Every convenience is also an open door — and July handed us four different doors into the same house: the click it trusts, the memory it keeps, the weights it inherits, the connector it calls.
The industry knows the countermeasures in principle: verify that a click is a genuine user gesture, tag the provenance of anything written to memory, require explicit consent before a connector's permission surface changes, and treat model weights from any source you didn't train as an unaudited artifact. None of this is exotic engineering.
The catch is what it costs. Every one of these guardrails adds friction, and friction is precisely what agentic products are being sold against — speed is the pitch. Manifold's Claude for Chrome disclosure sat through eight point releases with the vulnerable code untouched. That isn't necessarily neglect; it may just be what happens when a fix competes for priority against a roadmap, and a ticket gets marked "resolved" before the code actually moves.
For security teams: stop treating a connector's initial approval as a permanent grant. If it can add tools, widen scopes, or inject context without triggering a re-review, you don't know what you approved — you know what it looked like on day one. Proxy future risk by past volatility: a connector that changed fifty times last month will change again.
For anyone running a browser or desktop agent: "Act without asking" trades a fairly narrow convenience for a meaningfully larger blast radius. Read what a permission mode actually silences before you enable it, not just what it speeds up. The Claude for Chrome finding is Critical specifically for the users who turned that mode on.
For anyone building on an open-weight model you didn't train: "I inspected the weights" is not a claim anyone can currently back up. Provenance and independent auditing for models need to become as routine as a dependency scan — they aren't yet, and that gap is the entire story of the third finding.
For agent builders: memory writes deserve the same scrutiny as file writes. If your agent can persist an instruction across sessions without a human in the loop, you've built a system where a single email is a permanent configuration change.
Nothing in this piece required a novel jailbreak or an exotic new attack class. A forged DOM click. An email that slips past spam filtering. Ten poisoned training examples. A connector that grew a few extra tools nobody watched happen. The techniques are almost boring — and that's the point. Boring, well-understood weaknesses are exactly what gets left unpatched when the pressure is to ship the next agentic feature, not to slow down and re-verify the last one.
The blind spot I described in February was that we were building infrastructure for persistent, distributed, identity-aware agents without a framework to audit any of it. Five months on, the infrastructure got bigger and the framework still doesn't exist. Four teams just showed how wide the gap is in the space of ten days. The people building the guardrails are still a step behind the people finding the holes — and I don't think that cadence slows from here.