Four disclosures from the past two weeks point to the same weakness: AI agents are built to trust things by default — a click, an email, a metadata field, a set of training examples — and attackers have started forging exactly those things instead of writing malicious instructions a filter can catch. A browser extension flaw lets any other extension impersonate a user's click. A single email can plant a false memory an agent acts on for weeks. A new attack class forges the metadata agents trust rather than the text they read. And a researcher shows a model's training data can be poisoned in about an hour for less than a hundred dollars.
1HighCVSS 7.7
Manifold Security: Claude for Chrome still lets other browser extensions fake a click and trigger Gmail, Docs, Calendar and Salesforce workflows
Manifold Security disclosed on 22 July 2026 that Claude for Chrome v1.0.80 (released 7 July 2026, the eighth release since the flaw was first reported in May) still lacks a check on event.isTrusted in its content script, so any other browser extension with script access to claude.ai — a routine permission — can forge a synthetic click and trigger one of nine hardcoded task prompts, including reading Gmail, opening a Google Doc, checking Calendar, and running Salesforce, DoorDash or Zillow workflows. A second, related issue lets the side panel enter a no-consent mode via a ?skipPermissions=true URL parameter. Anthropic closed the first report, stating the residual capability "is tracked under the original report, which remains open pending a complete fix," and closed the second as informative, arguing the URL parameter has no externally reachable path. In Claude's default "ask before acting" mode a forged trigger still surfaces an approval prompt (CVSS 7.7); if a user has enabled "Act without asking," execution is silent (CVSS 9.6). No fix has shipped.
Why it matters for IndiaIndian enterprises running Claude for Chrome alongside Workspace or Salesforce sessions on the same browser profile are exposed for as long as the extension remains unpatched, and the risk is concentrated wherever "Act without asking" has been turned on for convenience.
ActionDisable "Act without asking" for Claude for Chrome on any account with mail, document or CRM access; inventory which other browser extensions hold script permissions on claude.ai and remove any not explicitly required; treat AI browser extensions as privileged software subject to the same allow-listing as VPN or endpoint agents.
SourceManifold Security (22 July 2026); The Hacker News (14 July 2026).
2
MemGhost: a single crafted email plants a false memory in AI coding agents that persists across sessions, undetected
Researchers led by Yechao Zhang published "When Claws Remember but Do Not Tell" on arXiv on 6 July 2026, with reporting from 13 July. In lab testing, a crafted email caused a persistent agent to write attacker-supplied false information into its own long-term memory file and act on it in later, unrelated conversations, without surfacing the write to the user. Against OpenClaw running GPT-5.4 in background mode the technique succeeded 87.5% of the time; against a Claude Code SDK agent on Sonnet 4.6, 71.4%. Success dropped sharply in foreground mode, where the user sees the agent's replies. OpenClaw disputes the test setup, pointing to its own guidance that untrusted mail should be routed through a separate reader agent stripped of memory and file tools — a configuration the paper did not test — and says it is evaluating provenance tracking and confirmation prompts for memory writes.
Why it matters for IndiaBFSI, legal and government teams piloting inbox-connected personal or coding agents are the highest-exposure group: a single phishing-style email, once read by an agent with memory and mail access, can leave a standing false instruction that outlives the message itself.
ActionRequire approval or an audit log entry before any agent writes to persistent memory; route untrusted inbound mail through a memory-less reader agent rather than the agent that holds long-term context; periodically review agent memory files for content the user never authorised, particularly after a suspicious inbound message.
SourcearXiv, Yechao Zhang et al. (6 July 2026); The Hacker News (13 July 2026).
3
Agent Data Injection: researchers forge the metadata agents trust — button IDs, GitHub author names, PR checks — to bypass prompt-injection defences built for hidden text
Woohyuk Choi and Juhee Kim (co-first authors), with Byoungyoung Lee, of Seoul National University, UIUC and Largosoft published "Agent Data Injection" on arXiv on 6 July 2026, reported on 16 July. Rather than hiding instructions inside data, ADI corrupts the metadata fields an agent treats as fact — a button label, a comment author, a pull-request check result — using ambiguous punctuation the model misreads as structure. Tested against web agents (Claude in Chrome, Google Antigravity, Nanobrowser) and coding agents (Claude Code, OpenAI Codex, Gemini CLI) across GPT-5.2, Claude Opus 4.5/Sonnet 4.5 and Gemini 3 Pro/Flash, it reached 31-43% success on structured data and up to 50% against defences purpose-built for instruction-level prompt injection, which otherwise hold near-zero success rates. OpenAI, Google and Anthropic were notified before publication; the researchers say no fix has shipped or been announced. Nanobrowser did not respond. No in-the-wild exploitation has been reported.
Why it matters for IndiaIndian software exporters and GCCs running coding agents against GitHub issues and pull requests are exposed to a class of attack their existing prompt-injection filters were not built to catch, since ADI never plants an instruction — it forges the record the agent already trusts.
ActionVerify GitHub identity and CI check status independently of what the agent reports; require human review before any agent-suggested command runs, regardless of an apparently passing check; where supported, enable random or unguessable field identifiers, the one mitigation researchers found meaningfully reduced success rates.
SourcearXiv, Woohyuk Choi, Juhee Kim, Byoungyoung Lee et al. (6 July 2026); The Hacker News (16 July 2026).
4
Katie Paxton-Fear: an open-weight model backdoored in about an hour, for under $100, with no reliable way to detect it afterward
The Register reported on 16 July 2026 that Katie Paxton-Fear, a cybersecurity lecturer at Manchester Metropolitan University and staff security advocate at Semgrep, fine-tuned an open-weight model on roughly ten poisoned examples to make it reliably generate vulnerable code on unrelated, novel prompts — for under $100 and about an hour of work. Larger models proved easier to poison, not harder. Paxton-Fear's point is not that a specific widely-used model has been compromised, but that open weights offer almost no ability to verify a model's behaviour before deployment, unlike traditional software, which can be reverse-engineered and audited.
Why it matters for IndiaIndian AI startups and GCCs adopting open-weight models for cost and data-residency reasons are taking on a supply-chain artefact with weaker provenance guarantees than the open-source code it often sits alongside.
ActionTreat open-weight models as supply-chain components: pin model hashes and record provenance before deployment, run adversarial code-generation evaluations before trusting a model for security-relevant output, and restrict who can fine-tune or redistribute internally-hosted models.
SourceThe Register (16 July 2026).
AI defender tip: Every item this issue exploits a different thing an AI agent trusts by default — a click, an email, a metadata field, a training example — none of them the kind of hidden instruction that prompt-injection filters are built to catch. Before granting an agent memory, browser, or repository access, list what it treats as ground truth without verification, and add one explicit check at each point: a human approval for memory writes, an identity check independent of agent-reported metadata, a provenance record for any model weights in use. Filtering instructions is no longer sufficient when the attack is forging the facts, not the commands.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
