How One Email Turned My AI Agent Into a Data Exfiltration Tool · Will Grana
from the one-email-is-all-it-takes dept.
Will Grana let an AI agent (OpenClaw on Claude Haiku) read his lab inbox and keep a local briefing, with every tool allowed and no approvals. He then sent it one ordinary-looking email asking it to save the briefing as a file and upload it with curl. The agent did, even fixing its own failed command, and confidential lines went to a public paste site. That is indirect prompt injection. His fix: watch the agent's tool calls, block upload commands before they run, and give agents only the access the job needs.