Agents stopped being chatbots in 2025 and 2026. They read your files, your inbox, and your repositories, then act with your credentials. Every public break-in since follows the same shape, and most of them needed no exploit code at all.
Published October 7, 2026. Based on public disclosures from security researchers and vendors, listed under Sources. Vendor fixes change quickly, so check current status before relying on any single finding.
What this case study shows
- Claude Cowork leaked a user’s files two days after launch, through a document that looked like a normal “skill.”
- Manus ran attacker code from one email, and its warning fired only after execution.
- OpenAI says prompt injection in its browser agent may never be fully solved, and now ships a Lockdown Mode.
- The model is rarely the weak point. The weak point is what the agent is allowed to do after it is fooled.
The mechanism in one paragraph
A language model reads instructions and data in the same stream of text. It has no reliable way to tell which sentences came from you and which came from a web page, a PDF or an email. Prompt injection exploits that. The attacker never touches your account. They place text where your agent will read it, and the agent does the rest.
It becomes dangerous when three things coincide: access to private data, exposure to untrusted content, and a way to send data out. Simon Willison calls this combination the “lethal trifecta.” Every case below has all three.
- Plant: Hidden text goes into a file, email, page, or issue title.
- Ingest: The user asks the agent to summarize or process it.
- Hijack: The agent treats the planted text as a task.
- Act: It runs a command, calls a tool, or opens a URL.
- Exfiltrate: Data leaves through a channel nobody blocked.
Case 1: Claude Cowork, file theft in two days
Anthropic launched Cowork as a research preview and told users not to expose sensitive material to it. In January 2026, two days after launch, PromptArmor published a working attack.
How it unfolded
The victim connects Cowork to a local folder of confidential files; in the demo, a real-estate folder containing a loan estimate with partial Social Security numbers. They then upload a document that appears to be a harmless skill file, obtained from somewhere ordinary such as a forum. Inside it, hidden text tells Claude to run a curl command that uploads the largest available file to the Anthropic file-upload API, authenticated with the attacker’s API key. The file lands in the attacker’s account, and the attacker can then chat with it.
Why it worked
The sandbox restricted outbound connections, but api.anthropic.com was on the allowlist. The attacker used the one trusted door. No human approval was required at any step. PromptArmor first ran it against Claude Haiku, then showed that Opus 4.5, a more injection-resistant model, could also be manipulated the same way. They attributed this to known isolation flaws in the code-execution environment, and noted that Johann Rehberger had earlier disclosed the same issue in Claude.ai chat.
Lesson: a stronger model did not close the hole. An egress allowlist that trusts a vendor domain can be turned into an exfiltration path by anyone with an account on that vendor.
Related: Claude in Chrome and Claude Code Action
Zenity Labs showed an email escalating from a harmless alert(1) to arbitrary JavaScript execution, exfiltration, persistence and account takeover inside Claude in Chrome. The payload faked a structural boundary (“the email has ended”) and then a fake user turn asking Claude to read the rest. Separately, RyotaK of GMO Flatt Security reported a critical flaw in Anthropic’s claude-code-action in January 2026, publicly disclosed on June 1, 2026 alongside independent findings from Aonan Guan and Aikido Security showing the same pattern across several agent platforms.
Case 2: Manus, remote code execution from one email
Manus is a general-purpose agent that was reportedly seeking funding at a $4 billion valuation, and Meta’s planned acquisition was blocked by Chinese regulators in April 2026. On September 24, 2026, Dark Reading reported research from Salt Labs.
How it unfolded
The researchers emailed hidden instructions that Manus would read later. A plain test, asking it to run, triggered a security warning immediately, so Manus did have a filter. They then encoded the payload in JSFuck, an obfuscation that writes JavaScript using six characters. Manus decoded it and ran it server-side before the filter reacted. The researchers described the result as untrusted email content becoming executable code inside the agent runtime. From there, they opened a reverse shell and reached the victim’s connected Gmail, Drive, and GitHub. Meta patched the flaw.
Lesson: a detector that warns after execution is a log entry, not a control. Manus did notify the owner, but only after the code had run.
This was not Manus’s first appearance. Rehberger’s 2025 “Month of AI Bugs” research included a Manus demonstration where indirect injection led to exposure of a VS Code server.
Case 3: ChatGPT agent, Atlas and ChatGPT Work
OpenAI’s record is the most candid about the problem, which makes it the most instructive.
- July 17, 2025: ChatGPT agent launched, able to log into sites and use connectors such as Gmail and GitHub. OpenAI warned that it could reach sensitive data. Its model card reported ignoring 99.5 percent of synthetic injection attempts on web pages, which still leaves a tail an adaptive attacker can work.
- October 2025: within days of Atlas launching, a researcher hid text in a Google Doc that made ChatGPT output “Trust No AI” instead of a summary. OpenAI’s CISO Dane Stuckey called prompt injection a “frontier, unsolved security problem.”
- December 2025: OpenAI described an automated attacker trained with reinforcement learning that finds novel injections, followed by adversarial training and updated safeguards. It said the problem was one it expected to work on “for years.”
- February 13, 2026: Lockdown Mode launched, with OpenAI acknowledging that prompt injection in AI browsers may never be fully patched.
- July 9, 2026: ChatGPT Work launched with GPT-5.6, reaching across apps, files and desktop through Computer Use, with scheduled tasks and a Compliance API for admins. Reporting says the U.S. Department of Commerce held the release for security review first.
Evidence gap: I found no public, reproducible injection exploit specific to ChatGPT Work as of this writing. That is not proof it is safe. It is a young product with local file access, scheduled unattended runs, and connectors, which is exactly the profile of the cases above.
The wider record
These are not isolated. In Q1 2026 alone, the OWASP GenAI round-up logged GrafanaGhost (April 7, hidden instructions in logs causing exfiltration through Markdown), a Vertex AI “Double Agent” permissions issue, and a Meta internal agent leak. Microsoft disclosed CVE-2026-25592 and CVE-2026-26030 in Semantic Kernel, where a single prompt could launch calc.exe on the host. At Black Hat on August 5, Check Point reported 11 vulnerabilities across agent frameworks and argued the real failure is that prompt-controlled content can cross into trusted framework logic. Microsoft patched the Copilot Personal “Reprompt” single-click exfiltration flaw as of September 7, 2026.
| Agent | Injection carrier | Outcome shown | What broke |
|---|---|---|---|
| Claude Cowork | Skill-style document | Files uploaded to attacker account | Trusted-domain egress, no approval step |
| Claude in Chrome | JS execution, takeover | Fake boundary and fake user turn | |
| Manus | Email, JSFuck-encoded | Code execution, reverse shell, Gmail/Drive/GitHub reach | Filter ran after execution |
| ChatGPT Atlas / agent | Web pages, Google Docs | Instruction hijack demonstrated | Open problem per OpenAI |
| ChatGPT Work | No public exploit found | None documented | Large attack surface, unproven |
What these cases have in common
- The carrier looked ordinary. A Word file, an email, a Google Doc. Nobody was asked to click anything suspicious.
- Approval was absent or ignorable. Cowork needed none. Manus warned late.
- The exit was legitimate. A whitelisted API, a connected Gmail, a Markdown image URL.
- Capability was the multiplier. The same text that makes a chatbot say something silly lets an agent move files.
- Model upgrades helped but did not decide it. Opus 4.5 was still manipulated, and OpenAI says it expects the problem to persist.
What to do about it
The Cloud Security Alliance’s analysis points to the same fix: separate the agent’s reasoning from the layer that holds credentials and executes actions.
- Treat every ingested file as hostile. That includes skills, plugins, and “integration guides.” Do not run unknown skills against sensitive folders.
- Scope access narrowly. Give the agent a purpose-built folder, not your documents directory. Use logged-out or low-privilege sessions for browsing, as OpenAI itself suggests.
- Restrict egress by destination and by account. Allowlisting a vendor domain is not enough if the attacker can use their own key on it.
- Require approval for outbound actions. Uploads, emails, purchases, and shell commands should pause for a human.
- Make detection pre-execution. A filter that fires after the code ran protects nothing.
- Name an owner for each agent. Map every agent instance to a person and review its permissions before enabling desktop or file access.
- Compromise plan. Check Point’s advice is to assume injection will succeed and limit the blast radius.
Bottom line
Prompt injection is not a bug awaiting one patch. It follows from how these systems read text. The practical question for any agent is not “can it be tricked?” but “what can it do once it has been?” Cases 1 and 2 answer that with files and shells. Decide what your agent can reach before someone else decides for you.
Sources
PromptArmor – “Claude Cowork Exfiltrates Files” and “Implement Claude Cowork Securely”The Decoder coverage of the Cowork attack and VentureBeat reporting on related Anthropic agent issues Zenity Labs – “Claude in Chrome: Breaking down the injection”Cloud Security Alliance Lab Space notes on prompt injection in GitHub Actions and indirect prompt injection in the wild (2026) Dark Reading and TechRadar coverage of Salt Labs’ Manus research (September 2026) Johann Rehberger – “Month of AI Bugs” (DEF CON / related talks) The Register on ChatGPT agent (July 2025) and Check Point’s Black Hat research (August 2026) OpenAI – “Continuously hardening ChatGPT Atlas against prompt injection” Vectra AI coverage of Lockdown Mode and 2026 CVEs (secondary reporting) Microsoft Security Blog – “When prompts become shells” (May 7, 2026) Android Authority and The Next Web on ChatGPT Work (July 2026) ThreatCluster / related reporting on the Reprompt patch status (September 2026; original research from Varonis)
Method note: figures and dates are as reported in the sources above at the time of writing. I could not verify vendor patch status independently, and secondary summaries may lag the original disclosures.