Loading story…
Research presented at DEF CON 34 showed that attackers can abuse AI-enabled customer-support agents through email and application-layer parsing discrepancies. Spoofed or ambiguously formatted headers, email-address smuggling, asymmetric MIME/HTML rendering, and malicious instructions in inbound messages can cause agents with inbox, backend-tool, or RAG access to disclose sensitive data, steal OTPs, conduct phishing, or perform unauthorized account actions. The attacks exploit differences in how systems interpret email structures defined by standards such as RFC 5322 and how AI agents consume that content.
The research also identified cross-channel IVR weaknesses, conversation-history manipulation, prompt injection, and RAG knowledge-base poisoning as paths to MFA/2FA bypass and account compromise. Human approval does not reliably contain the risk when reviewers and agents see different representations of attacker-controlled content or when over-privileged agents treat untrusted messages and retrieved data as authoritative. Organizations should constrain agent permissions, normalize and safely render inbound content, isolate untrusted context, and require verification of sensitive actions outside the agent-controlled conversation.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
A targeted prompt-injection issue involving hidden email text that Chrome's built-in AI assistant could read and include sensitive case data in a reply-to plus-address was submitted through Chrome's vulnerability program. The report was marked Won't Fix.
At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire presented research on abusing AI-enabled customer-support agents through email and application-layer parsing flaws. The research reported more than $50,000 in bug-bounty awards earned over several weekends and detailed attacks including phishing, account actions, data exposure, OTP theft, and prompt injection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcereddit.com
Open sourceintigriti.com
Open sourcedatatracker.ietf.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
A new attack technique called **agent session smuggling** has been identified, allowing malicious AI agents to exploit established cross-agent communication sessions to covertly inject instructions into victim agents. This method leverages the stateful nature of protocols like Agent2Agent (A2A), which are designed for persistent, context-aware conversations between AI agents. The attack does not exploit a vulnerability in the protocol itself, but rather abuses the implicit trust and memory features of stateful agent communication, enabling a rogue agent to manipulate a victim over multiple interactions. Mitigation strategies include human-in-the-loop enforcement, remote agent verification, and context-guarding mechanisms. Separately, a vulnerability in Anthropic’s Claude AI assistant was demonstrated, where attackers could exploit the code interpreter feature to exfiltrate sensitive enterprise data. By using indirect prompt injection, malicious instructions embedded in user-supplied content could trigger Claude to retrieve confidential information and upload it to attacker-controlled accounts via the platform’s own API, bypassing default network restrictions. The exploit highlights the risks of implicit trust and insufficiently restricted internal APIs in advanced AI systems, emphasizing the need for robust security controls around agent interactions and code execution features.
Jun 29, 2026
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026