Unverified50% confidenceSolutionExact time
In an agent scenario with three tools—reading tickets, reading customer records, and sending email—instruction text embedded in the ticket body can cause the agent to call the customer records and email tools without any traditional exploit and without stolen credentials, because permissions are granted per session rather than per call.
1
Sources
50%
Confidence
Long-term
Relevance
10/15/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSession traces are typically stored as files or database records in the local runtime environment, and if no isolation measures are in place, the agent itself has direct read, write, and even delete permissions.73% similarUnverifiedRead operations by Agents can be left open, but every write path must be bound to a real user's permission verification.72% similarUnverifiedA developer on Reddit observed: when an Agent simultaneously has the permission to read files and the permission to send emails, the combination of two legitimate permissions may produce consequences the user never expected, such as reading sensitive information and sending it out.70% similarUnverifiedConnecting the mail reading tool does not automatically provide a mail sending tool; sending email through other already enabled tools or browser tasks is an independent operation with its own permissions and approval requirements. A routine that only prepares drafts still has value without automatic sending and minimizes permissions.69% similarUnverifiedTamper-proof audit logs are typically implemented through hash chains, digital signatures, or writing to read-only storage.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1035677API
curl https://kongchang.com/api/v1/knowledge/claims/1035677MCP
get_claim(id=1035677)