A routine email, shared document or support ticket could carry hidden instructions that steer an AI agent towards data or systems it can access, ClawSecure founder J.D. Salbego warns. His account of testing 14 models across five labs makes the security question less abstract: what can an agent reach, and who is watching what it does there?
Watch Desk analysis
What happened
In an interview published by PYMNTS on 26 October, Salbego described indirect prompt injection: an attacker hides instructions in material an agent is asked to process. He said ClawSecure found recurring patterns across models and integrations including Dropbox, Notion and Linear. The article does not provide detailed test results, so these findings are Salbego’s account of his company’s research, not a published independent comparison.
Salbego argues that security teams should examine the exchanges between agents and connected tools, including requests that may look harmless in isolation. He also calls for continuous monitoring and a public testing programme to give buyers comparable evidence before deployment. He recommended that banks suspend their agents while arranging security support, a strong precautionary view rather than a general finding established by the article.
Why it matters
An agent’s risk depends partly on the permissions and connections it has been given. If it can access financial accounts, passwords or customer information, a malicious instruction in an ordinary-looking document could have consequences beyond the original conversation. Small businesses and individuals may be particularly exposed if they connect agents to accounts without dedicated security staff.
Our read
The useful question is not whether every agent should be switched off on the strength of one interview. It is whether organisations know what their agents can access, and can see what happens when they use it. “It has safeguards” is a less comforting answer when no one can explain where those safeguards end.
What to watch
- Whether ClawSecure publishes its testing methods and results, and whether other researchers reproduce them.
- Whether AI providers explain the limits of their protections and what customers must configure themselves.
- Whether buyers get independent, comparable security evaluations before connecting agents to sensitive systems.
Discussion spark: Should businesses suspend agents until independent security tests are available, or is strict access control and continuous monitoring a sufficient basis to keep using them?
Sources and evidence
- Source update (26 October 2026, 08:03 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.