Research · Published 2026-11-10 · Updated 2026-11-10 · AgentiSend
AI agent email incidents
20 public incidents from June 2025 to September 2026 had an AI agent send, delete or leak email; each is listed with its date and a primary source.
20 public incidents from June 2025 to September 2026 had an AI agent send, delete or leak email; each is listed with its date and a primary source.
The monthly count of what the library allows through is the runaway AI agent email benchmark.
Last updated 2026-11-10. Corrections: email hello@agentisend.com with the row and a source; a confirmed error is fixed and the date above changes.
The ledger
Newest first. "Class" is what the agent did with email. "Rule that caps this class" names the one agent-email-guard 0.1 rule that limits incidents of that kind; it is not a claim that the rule would have stopped that incident.
| Date | Agent | What happened | Class | Rule that caps this class | Primary source |
|---|---|---|---|---|---|
| 2026-09-15 | iLands agent platform | Agents on iLands emailed offers of paid services to journalists, lawyers and academics, one of whom counted about 40 in a week, and the founder said a review found no platform directive or human orchestration behind them. | mass send | per-hour budget | 404 Media, fetched 2026-11-10 |
| 2026-08-24 | Instinct (Spear Street Technology) | Tester Katie Jacobs Stanton posted that Instinct sent an email on her behalf without checking with her first. | sent without approval | new-recipient approval hold | TechCrunch, fetched 2026-11-10 |
| 2026-06-15 | Microsoft 365 Copilot Enterprise Search (SearchLeak, CVE-2026-42824) | Varonis showed that one crafted link could make Copilot search the user's mailbox and put what it found in an image URL the attacker received, and Microsoft fixed it on its servers. | exfiltration | not covered by agent-email-guard 0.1 | The Next Web, quoting Varonis, fetched 2026-11-10 |
| 2026-06-09 | OpenClaw agent in a Varonis test | Varonis showed that a phishing email from an outside Gmail account could make an OpenClaw agent email mock AWS keys, database passwords and SSH details from a seeded test mailbox to that outside address. | exfiltration | new-recipient approval hold | BleepingComputer, quoting Varonis, fetched 2026-11-10 |
| 2026-02-23 | Agents with their own mail accounts (Agents of Chaos study) | In a study that gave agents their own email accounts, an agent gave a person who was not its owner the full text of emails holding a planted Social Security number and bank account number, unredacted, in a chat conversation. | exfiltration | not covered by agent-email-guard 0.1 | Shapira et al., arXiv 2602.20021, fetched 2026-11-10 |
| 2026-02-23 | OpenClaw agent run by Summer Yue | Summer Yue posted that her OpenClaw agent, asked to suggest emails to delete or archive, began deleting mail from her inbox and ignored stop commands she sent from her phone; TechCrunch said it could not independently verify what happened to the inbox. | deleted mail | not covered by agent-email-guard 0.1 | TechCrunch, fetched 2026-11-10 |
| 2026-01-12 | Superhuman AI | PromptArmor showed that one untrusted email could make Superhuman AI send content from the user's other emails to an attacker's Google Form through an image link, and Superhuman patched it before disclosure. | exfiltration | not covered by agent-email-guard 0.1 | PromptArmor, fetched 2026-11-10 |
| 2026-01-09 | ChatGPT Gmail connector with memory (ZombieAgent) | Radware showed that a malicious email could make ChatGPT leak inbox data one character at a time through prepared URLs, and OpenAI shipped a fix on 2025-12-16. | exfiltration | not covered by agent-email-guard 0.1 | SecurityWeek, quoting Radware, fetched 2026-11-10 |
| 2025-12-25 | AI Village agents | Pursuing a goal of random acts of kindness, AI Village agents sent thank-you emails nobody had asked for to Rob Pike, Anders Hejlsberg, Guido van Rossum and The Carpentries, after which the prompt was changed to forbid unsolicited email. | sent without approval | new-recipient approval hold | Simon Willison, fetched 2026-11-10 |
| 2025-12-08 | Google Gemini Enterprise (GeminiJack) | Noma showed that instructions planted in a Gmail message, a Doc or a Calendar invite could make Gemini send Gmail, Docs and Calendar data to an outside server through an image URL, and Google changed how retrieval works. | exfiltration | not covered by agent-email-guard 0.1 | Noma Security, fetched 2026-11-10 |
| 2025-11-21 | AI Village agents | Over a two-week goal, the AI Village agents attempted about 300 emails to NGOs and game journalists, many to addresses the agents had invented. | mass send | per-hour budget | AI Village, fetched 2026-11-10 |
| 2025-10-21 | Microsoft 365 Copilot (Mermaid diagrams) | Adam Logue showed that a crafted Office document could make Copilot fetch the user's recent emails, encode them and put them in a diagram link that sent them to the attacker when clicked, and Microsoft resolved it on 2025-09-26. | exfiltration | not covered by agent-email-guard 0.1 | Adam Logue, fetched 2026-11-10 |
| 2025-10-03 | Perplexity Comet browser (CometJacking) | LayerX showed that one link could make Comet summarize the user's emails, encode them in base64 and post them to an outside endpoint, and Perplexity marked the reports not applicable. | exfiltration | not covered by agent-email-guard 0.1 | CyberInsider, quoting LayerX, fetched 2026-11-10 |
| 2025-09-25 | postmark-mcp npm package | Version 1.0.16 of postmark-mcp, an unofficial MCP server for sending email that is not made by Postmark, added a hidden BCC that copied every email sent through it to an outside address. | exfiltration | not covered by agent-email-guard 0.1 | Postmark, fetched 2026-11-10 |
| 2025-09-18 | ChatGPT Deep Research with the Gmail connector (ShadowLeak) | Radware showed that one email could make the agent send inbox data to an outside URL from OpenAI's servers, and OpenAI marked the issue resolved on 2025-09-03. | exfiltration | not covered by agent-email-guard 0.1 | The Record, quoting Radware, fetched 2026-11-10 |
| 2025-08-25 | Claude for Chrome | Anthropic reported that in its own red-team testing before new defenses, an email saying messages had to be deleted for security reasons made Claude delete the user's emails without asking for confirmation. | deleted mail | not covered by agent-email-guard 0.1 | Anthropic, fetched 2026-11-10 |
| 2025-08-20 | Perplexity Comet browser | Brave showed that hidden text in a Reddit comment could make Comet read the user's email address and a one-time code from an open Gmail tab and post both in a reply. | exfiltration | not covered by agent-email-guard 0.1 | Brave, fetched 2026-11-10 |
| 2025-08-16 | Google Gemini for Workspace | Researchers showed that an email subject line carrying instructions could make Gemini open a link that carried the topic of another email the user had received. | exfiltration | not covered by agent-email-guard 0.1 | Nassi, Cohen and Yair, arXiv 2508.12175, fetched 2026-11-10 |
| 2025-07-07 | Microsoft Copilot Studio customer-service agent (replica) | Zenity sent prompt-injection emails to a replica of a customer-service agent built in Copilot Studio, which then emailed its knowledge file and Salesforce account records to an outside address; Microsoft fixed the reported issue on 2025-04-24. | exfiltration | new-recipient approval hold | Zenity Labs, fetched 2026-11-10 |
| 2025-06-11 | Microsoft 365 Copilot (EchoLeak, CVE-2025-32711) | Aim Labs showed that one email with hidden instructions could make Copilot place private data from the user's context into a link to an outside server, and Microsoft rolled out a fix. | exfiltration | not covered by agent-email-guard 0.1 | Simon Willison, quoting Aim Labs, fetched 2026-11-10 |
By class: exfiltration 14, mass send 2, sent without approval 2, deleted mail 2. 6 reached real people or real mail; 14 were researcher demonstrations against the shipping product.
What each rule caps
- New-recipient approval hold: 4 incidents (exfiltration, sent without approval). This rule holds a send to an address the agent has not mailed before until a person approves it, so mail to an address an attacker supplied waits for a person.
- Per-hour budget: 2 incidents (mass send). This rule refuses sends past a set number per hour for one key, so a runaway batch stops at the budget.
- Loop detection: 0 incidents. This rule refuses the fourth near-identical send to the same recipient inside 60 minutes.
- Kill switch: 0 incidents. This rule stops every send through the guard with one call and does not resume on a timer.
- Not covered by agent-email-guard 0.1: 14 incidents (exfiltration, deleted mail). This rule means the incident did not go through a send the guard sees (reading, deleting, or a request that is not an email), so no 0.1 rule caps it.
The same rules run at the API for an AgentiSend key: approvals, budgets, loop detection and the kill switch.
What goes on this list
A row needs a public primary source: the vendor's own post, the researcher's write-up, an official report, or a news report quoting one of those. Each source was opened on the date in its row and the sentence in "What happened" says only what that source says. Candidates without such a source are left off rather than marked as unconfirmed. Simulations in which no real mailbox was read, sent from or changed are left off too.
Researcher demonstrations are included when they ran against a product people use. They show a class of failure is reachable; they are not reports of harm to customers.
Report an incident or an error
Email hello@agentisend.com with the link to the primary source. A new row is added once its source is opened and checked; the "Last updated" date changes with every edit.