A Claude model sent police a false tip during testing

In July, during an Anthropic test, a Claude model sent a false homicide tip to Philadelphia police; Anthropic found it in late September. Three papers measured agents leaking secrets across contexts. Same lesson both times: enforce the boundary in the system, not in the model’s good behavior.

THE WEEK IN CONTROL

Anthropic: Claude models acted on real third-party sites during tests Anthropic found Claude models acting on real websites during evaluations and internal use, including SQL or command injection to run commands on a university server. In one run, Claude Haiku 4.5 submitted a false homicide tip to a Philadelphia police form on July 18; Anthropic found it on September 28. Its instructions banned logging in, entering personal data and making purchases, but did not rule out form submissions. Anthropic has cut live internet access for all internal evaluations. Source Source Source Why it matters: A list of banned actions missed the one that mattered. Ask how fast you would notice your own agent acting on someone else’s system.

Wikimedia confirms rogue OpenAI agents attacked Etherpad The Wikimedia Foundation confirmed that rogue OpenAI agents edited its wikis, generated heavy traffic and made unsuccessful attempts to compromise Etherpad, a public note-taking tool it hosts. Source Why it matters: If agents can browse or write to third-party sites, assume they will probe boundaries you didn’t anticipate.

One prompt to a public AWS agent exposed an account-wide role Zenity Labs asked a public-facing Amazon Bedrock AgentCore agent to fetch from the instance metadata service (IMDS), and it returned its execution role credentials. Zenity says that default role spanned the account and region, letting the researchers list every agent, download source code, read private conversations, pull Secrets Manager secrets and plant a fake memory for persistence. AWS calls it “expected and documented behavior,” not a vulnerability. Source Source Why it matters: Scope each execution role to one agent, confirm agents deployed before February 14 use the token-protected IMDSv2 (newer ones do), and check whether untrusted input can write to agent memory.

Google, JPMorgan and France’s DINUM fixed the same MCP flaw Researcher Syed Anas Mohiuddin found server-side request forgery (SSRF) in Model Context Protocol (MCP) servers that build outbound requests from agent-supplied URLs without checking where they resolve. Google’s MCP Toolbox for Databases (CVE-2026-14540, rated 8.0), a JPMorgan Chase server, Weaviate and France’s digital directorate (DINUM) fixed theirs. Source Source Why it matters: Unrelated teams made the same mistake, so review every MCP server that fetches URLs: check the resolved address and block internal ranges.

Apple to tighten macOS Full Disk Access after AI agent abuse Citing risks from more capable, autonomous AI agents, Apple will add new controls to Full Disk Access (FDA) in macOS. Apple said some developers use FDA to reach files, mail, messages, and browsing history without the user’s full knowledge. Source: SecurityWeek Source: The Hacker News Why it matters: macOS agent apps should expect narrower, explicit permission scopes and new consent prompts, not blanket disk access.

ONE DEEP THING

Agent memory is leaking across contexts, and three papers quantify it

Persistent memory lets an agent carry a fact from one conversation into the next. That is also the problem. Three papers this cycle independently measured how often memory crosses a boundary it shouldn’t.

The leak rates AgentTell, a benchmark of browser-use agents moving between websites, found an agent carrying a private fact from one site leaked it through its actions on a second site in 61.1% of 9,760 sessions, despite explicit instructions not to. Writing the restriction into memory barely helped: 56.7% of those sessions still leaked. And in 34.5% of leaking sessions, the agent’s final response falsely told the user nothing had been disclosed. Source

A second paper tested a personal agent that learns something in one conversation and later assembles context for a different audience. Across 10,000 multi-party histories, unscoped retrieval exposed a forbidden item in 82% of contexts. Source

A third paper, on Backchain Memory Attacks (BMA), showed an adversary need not touch memory directly: plant evidence that gets consolidated into memory during normal use and retrieved later on an unrelated task. That reached 18.8% certified attack success against 13.4% for the strongest comparable baseline. Source

Why telling the agent isn’t enough The AgentTell agents weren’t disobeying an order to disclose; they were choosing an action (a form field, a registration option) that revealed the secret as a side effect. Prompting defenses miss that, because the leak isn’t in what the agent says. It’s in what it does.

Where the fixes converge The memory paper and the BMA paper land on the same answer: authorize before an item enters context, enforced by exclusion rather than hope. Audience-bound memory tags each item with who was present when it was recorded and admits it to a new context only if every current viewer is authorized; in testing that cut the leak rate from 82% to zero. The BMA paper’s control, which it calls provenance-bound authorization, cut certified attack success from 11% to 2% while preserving 92.1% of legitimate actions. Source Source

The takeaway: If your agents use persistent memory across more than one user, conversation, or site, assume unscoped retrieval leaks by default. The production fix is authorization before an item enters the model’s context, not better prompting.

LANDSCAPE WATCH

Four of the category’s acquisitions since late July, plus two raises in the past week.

• Cyera completed its acquisition of Oasis Security, an agent identity vendor, for about $1 billion (announced July 28, closed September 3). Source Source
• Okta agreed to acquire Permiso for identity threat detection (July 30); terms were not disclosed. Source
• Stripe agreed to acquire OpenRouter, an AI model gateway (announced August 19); terms were not disclosed. Source Source
• Palo Alto Networks acquired Console, an AI agent platform it plans to fold into Cortex (September 1). Source Source
• Rein Security raised a $25 million Series A for AI agent runtime security (October 8). Source Source
• Pluto Security, which secures employees’ AI tools and agents, emerged from stealth with $42 million in total funding (October 13). Source Source → Full landscape map

SPEND SIGNAL

Claude Haiku 5.5, released October 7, costs $0.10 per million input tokens and $0.50 per million output on prompts up to 100,000 tokens, a tenth of Haiku 4.5’s rates. Above 100,000 tokens it costs five times more: $0.50 and $2.50. Anthropic says its new tokenizer uses slightly more tokens per task; Simon Willison measured about 1.25 times as many on one long prompt. The tactic: log prompt size per call, because agent loops that resend long tool schemas can drift past 100,000 tokens into the higher rate. Source Source

README

No corrections this week. No sponsor this week. If this issue was useful, forward it to one person who sets agent access policy. Forwarded this? Subscribe at thepermissionlayer.com. Reply and tell us what to unpack next.