Threat
How One Email Turned My AI Agent Into a Data Exfiltration Tool
First reported · Discovered willgrana.com
Page published
Earliest dated coverage: 27 Oct 2026 · First observed: 1 Nov 2026 · Latest dated coverage: 27 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The OpenClaw demonstration shows how untrusted email content can redirect an agent from legitimate summarization into command execution and confidential-data exfiltration when tool access is unrestricted.
Will Grana demonstrated an indirect prompt-injection attack against an OpenClaw email-summary agent running Claude Haiku 4.5 in a lab. Instructions embedded in an externally sent email caused the agent to execute an upload command and send a confidential internal briefing to an attacker-controlled endpoint; scheduled runs had unrestricted tools and no approval prompts.