AI Agent Security Flaws Expose Secrets in Default Configurations
Security researcher Elad Meged, a founding engineer at Novee Security, demonstrated critical vulnerabilities in AI agent workflows used by Anthropic, Google, and OpenAI, revealing how default configurations could be exploited to exfiltrate sensitive data. By testing the agents in their out-of-the-box setups mirroring how organizations deploy them Meged uncovered flaws in the trust models governing command approvals, output handling, and inter-stage handoffs.
The attacks leveraged prompt injection as an entry point, but the core vulnerabilities stemmed from how agent harnesses the components managing tool permissions, approval logic, and execution made and enforced trust decisions. In Anthropic’s Claude Code Action pipeline, for example, seemingly safe commands (e.g., read-only operations) were approved, only for their outputs to be automatically published or consumed by later stages with broader privileges. Each patch from Anthropic addressed a specific bypass but inadvertently exposed new attack surfaces, with the final exploit recovering secrets through a channel that evaded all prior fixes. Anthropic awarded bounties for each reported issue, though Meged noted that the bounty-per-bypass model risked obscuring the underlying architectural problem.
Google’s Gemini CLI faced a similar issue: a kill chain exploiting unenforced restrictions in CI workflows, resulting in a CVSS 10.0 advisory (GHSA-wpqr-6v78-jr5g). OpenAI’s Codex CLI, while equipped with a sandbox, proved vulnerable in multi-stage workflows where state from one stage deemed "trusted" by default was inherited by subsequent stages without revalidation. Across all three vendors, the pattern was consistent: defenses like environment sanitization or protected paths failed at the handoffs between stages, where initial safety judgments were not rechecked in context.
Meged’s findings highlight a systemic issue in AI agent design: harnesses often validate trust at the point of decision (e.g., "this command is read-only") but fail to account for how outputs are consumed downstream. A read-only command feeding into a public output channel, for instance, effectively becomes a data leak. While individual vendors have implemented fixes post-disclosure, Meged argues the problem reflects a shared architectural assumption across the industry one that may require cross-vendor collaboration or formal standards to address.
The research, including code-level analysis and live demonstrations, will be presented at Black Hat USA 2026. For organizations running these agents, Meged recommends auditing workflows for paths where agent-influenced state is consumed by later stages with elevated privileges, focusing on the gaps between "approved" actions and their downstream effects.
Source: https://www.helpnetsecurity.com/2026/07/29/ai-agent-security-safety-check/
Google AI cybersecurity rating report: https://www.rankiteo.com/company/googleai
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
OpenAI cybersecurity rating report: https://www.rankiteo.com/company/openai
"id": "GOOANTOPE1785306233",
"linkid": "googleai, anthropicresearch, openai",
"type": "Vulnerability",
"date": "8/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Artificial Intelligence',
'name': 'Anthropic',
'type': 'AI Company'},
{'industry': 'Technology / AI',
'name': 'Google',
'type': 'Technology Company'},
{'industry': 'Artificial Intelligence',
'name': 'OpenAI',
'type': 'AI Company'}],
'attack_vector': 'Prompt Injection',
'data_breach': {'data_exfiltration': 'Yes',
'sensitivity_of_data': 'High (secrets, proprietary '
'information)',
'type_of_data_compromised': 'Secrets, internal data, '
'sensitive information'},
'description': 'Security researcher Elad Meged demonstrated critical '
'vulnerabilities in AI agent workflows used by Anthropic, '
'Google, and OpenAI, revealing how default configurations '
'could be exploited to exfiltrate sensitive data. The attacks '
'leveraged prompt injection as an entry point, but the core '
'vulnerabilities stemmed from how agent harnesses managed tool '
'permissions, approval logic, and execution trust decisions. '
'Flaws in trust models governing command approvals, output '
'handling, and inter-stage handoffs were exploited, leading to '
'data exfiltration and secret recovery.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'security flaws',
'data_compromised': 'Sensitive data (secrets, internal '
'information)',
'operational_impact': 'Potential unauthorized access to sensitive '
'data',
'systems_affected': 'AI agent workflows (Anthropic Claude Code '
'Action, Google Gemini CLI, OpenAI Codex CLI)'},
'investigation_status': 'Disclosed (Research Presentation Pending)',
'lessons_learned': 'AI agent workflows must revalidate trust at every stage, '
'not just at the point of command approval. Default '
'configurations can introduce critical security gaps, and '
'architectural assumptions about trust propagation are '
'flawed.',
'motivation': 'Security Research / Vulnerability Disclosure',
'post_incident_analysis': {'corrective_actions': 'Patches by vendors, '
'workflow audits, enhanced '
'output handling '
'restrictions, and '
'revalidation of state at '
'handoffs.',
'root_causes': 'Flaws in trust models governing '
'command approvals, output '
'handling, and inter-stage '
'handoffs. Lack of revalidation of '
'trust at downstream stages.'},
'recommendations': 'Audit workflows for paths where agent-influenced state is '
'consumed by later stages with elevated privileges. Focus '
"on gaps between 'approved' actions and their downstream "
'effects. Consider cross-vendor collaboration or formal '
'standards to address systemic issues.',
'references': [{'source': 'Black Hat USA 2026 Presentation'}],
'response': {'containment_measures': 'Patches and fixes implemented by '
'vendors (Anthropic, Google, OpenAI)',
'remediation_measures': 'Auditing workflows for trust gaps, '
'revalidating state at handoffs, and '
'enhancing output handling restrictions'},
'threat_actor': 'Elad Meged (Security Researcher)',
'title': 'AI Agent Security Flaws Expose Secrets in Default Configurations',
'type': 'Data Exfiltration',
'vulnerability_exploited': 'Trust model flaws in AI agent workflows (command '
'approvals, output handling, inter-stage handoffs)'}