Your AI Agent Read an Email and Ran Commands. No Vulnerability Required.

Gen Threat Labs ran a controlled experiment. An AI agent was set up to read emails. Some of those emails contained untrusted content written to manipulate it. The agent then executed system commands, sent data outside its environment, and performed destructive file operations.

No software vulnerability was exploited. No CVE. The agent did exactly what it was built to do: read text and act on it.

The source is a BleepingComputer post, and I'll flag that it's a sponsored vendor piece promoting Gen's own products (Agent Trust Hub, Sage, Norton). The technical detail is high-level. I can't tell you the exact payload, the agent framework, or the email format, because the piece doesn't say. What it does describe is a pattern, and the pattern is real regardless of who's selling something next to it.

The post also cites two adjacent problems: malicious agent skills (12% of ClawHub skills at the time) and Warden Stealer, malware that targets AI assistant config files and tokens. Those are separate threats from the email experiment. I'm not going to speculate on how they connect to it.

This is indirect prompt injection, and it works because of how LLM agents are built, not because of a bug in any one of them.

The model receives one stream of text. Your system prompt, the user's request, and the body of an email the agent just fetched all land in the same context window. The model has no hard boundary between "data I'm processing" and "instructions I should follow." An email that says something shaped like an instruction competes with the real instructions, and sometimes it wins.

The thing that turns this from an annoyance into an incident is the tooling. An agent that can only summarize email is a nuisance when injected. An agent with a shell, a filesystem, and an outbound network path is an insider with your credentials. The experiment hit all three: commands, exfiltration, destructive file operations.

The gap is that nothing is inspecting the content between "email fetched" and "model acts on it."

Sentinel is an AI firewall. For agentic setups, it proxies the model traffic and scans tool results (which is what an email body is) before they return to the agent.

Here's how that would apply to this kind of attack, with the caveat that I haven't seen the Gen Threat Labs payload and can't claim Sentinel would have stopped that specific experiment. What I can describe is how the layers handle email-borne injection of this general shape:

There's a related note for the Warden Stealer angle: that malware goes after config files and tokens. Secret redaction doesn't stop a stealer running on a host, so I won't pretend it does. It does mean a token that surfaces in a tool result doesn't reach the model in cleartext.

This is illustrative. The email text below is invented to show the shape of the attack, not the actual payload from the experiment.

Pointing an Anthropic SDK agent at the Sentinel proxy:

import anthropic client = anthropic. Anthropic ( api_key = " sk_live_... ", # your Sentinel API key base_url = " https://api.sentinelaifirewall.com/v1 ", ) # Tool results (like fetched email bodies) are scanned automatically response = client. messages. create ( model = " claude-sonnet-4-6 ", # your chosen model max_tokens = 1024, messages = [{ " role ": " user ", " content ": " Summarize my unread email. " }], ) Enter fullscreen mode Exit fullscreen mode You need your own Anthropic key configured under Dashboard → Settings first; the proxy makes the upstream call on your behalf. Grok, OpenAI, and Gemini have equivalent routes.

If you'd rather scrub the email body yourself before handing it to your agent, use the direct endpoint:

import httpx email_body = fetch_next_email () # untrusted by definition r = httpx. post ( " https://api.sentinelaifirewall.com/v1/scrub ", json = { " content ": email_body, " tier ": " strict " }, headers = { " X-Sentinel-Key ": " sk_live_... " }, ) result = r. json () if result [ " security " ][ " action_taken " ] in ( " blocked ", " neutralized " ): log_and_quarantine ( result ) agent_input = result [ " safe_payload " ] Enter fullscreen mode Exit fullscreen mode For an email carrying an instruction aimed at the agent, an illustrative blocked response looks like this:

{ "request_id": "a1b2c3...", "security": { "action_taken": "blocked", "threat_score": 0.91 }, "safe_payload": "[SENTINEL BLOCKED]: Article withheld — fast-path prompt injection detected. Matched: \"... \"." } Enter fullscreen mode Exit fullscreen mode Note that safe_payload on a block is a descriptive placeholder, not null. Branch on action_taken, but the placeholder is safe to log. In the agentic proxy, a blocked tool result is swapped for an inert placeholder transparently, and a neutralized one is wrapped in [SENTINEL-WARNING:...] markers telling the model to treat it as untrusted data.

Two honest limits. The flagged action passes content through untouched and leaves the decision to you, so if you ignore flags you've bought a logger. And the descriptive-context exemption means a quoted example inside a news article won't hard-block, which is the right call for security writing but means you should read your flagged items.

Treat every tool result as untrusted input, and scan it before the model sees it. An email body, a fetched web page, a file the agent opened: all of it is text an outsider may have written.

Then fix the second half of the problem. Check what your agent can actually do. If it can run shell commands, write files, and make outbound requests, ask which of those it needs for the job you gave it. Scanning reduces the odds an injection lands. Narrow permissions limit what happens when one does.

Sentinel's Starter tier is free (100 requests/month, no credit card). Try the scrub endpoint against your own agent's inputs at sentinelaifirewall.com.

AI-assisted draft or imaging, human-curated, reviewed and edited.