TL;DR
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
ClawSecure CEO J.D. Salbego told PYMNTS that the company tested 14 AI models across five labs and found recurring exposure involving connected services. He warns that malicious instructions hidden in ordinary documents can influence agents with access to sensitive accounts, while responsibility for protections remains divided among providers and customers.
Security testing by ClawSecure found recurring exposure across 14 AI models tested across five labs, according to CEO J.D. Salbego, who told PYMNTS that malicious instructions hidden in ordinary files could put accounts and data at risk when agents have connected access. The report highlights an unresolved responsibility question: what safeguards should AI providers supply, and what security work must customers handle themselves?
The attack Salbego described is called indirect prompt injection. Rather than asking an agent directly to break a rule, an attacker can place instructions in an email, shared document or support ticket that the agent later reads. Salbego said the technique can escape the notice of both the person using the agent and the system itself. The report does not describe a specific successful theft or breach tied to the testing.
ClawSecure tested models across five labs and examined integrations involving services including Dropbox, Notion and Linear. Salbego said testing multiple providers was intended to assess whether the exposure was broader than a single model. He also described an agent using Dropbox that could connect with Gmail, arguing that security teams must review exchanges between services, not only individual tools in isolation.
The potential consequences depend on the agent’s permissions. Access to payment accounts, passwords, customer information or operational infrastructure could increase the harm if an agent follows an attacker’s instructions. Salbego recommended monitoring the messages between models and tools while agents operate. He also argued that model-level defenses need ongoing support because attacks change over time.
Why Agent Permissions Matter
The risk is not limited to whether a model produces an inaccurate answer. An agent connected to business applications may be able to take actions or reach information, making its permissions and connected accounts central to the possible impact. A hidden instruction that would be harmless in a chat could have greater consequences if the agent can act on financial or workplace systems.
That exposure may be especially difficult for small businesses and consumers, which Salbego said may connect accounts without having staff dedicated to security. Larger organizations have security teams, but broader system access can extend the consequences of a compromised device or account. The report describes possible outcomes such as data extraction, service disruption and ransom demands as risks, not as incidents confirmed by the testing.
The question of responsibility affects purchasing decisions as well as technical defenses. If providers do not clearly explain the limits of their protections, buyers may not know what controls they must add before connecting an agent to sensitive systems. Salbego’s call for comparable, public testing reflects a broader challenge: buyers need evidence they can compare, while the market currently includes provider evaluations, paid audits and individual research findings.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Canon SELPHY CP1500 Wireless Compact Photo Printer with RP-108 Ink and Paper Set
As an affiliate, we earn on qualifying purchases.
Indirect prompt injection exploits the way an agent may process material from outside its direct conversation with a user. A malicious instruction can be placed in content that appears routine, then encountered when an agent reads a file or handles a task. The risk described by Salbego depends on the agent’s access and behavior; the source does not establish that every agent or integration is vulnerable in the same way.
Connected applications can create paths between services. Salbego said security teams should examine the messaging between a model and a tool, including requests that may appear ordinary when viewed separately. ClawSecure’s testing covered several models and integrations, but the PYMNTS report does not provide model-by-model results, technical test methods or a complete account of the vulnerabilities found.
Salbego said ClawSecure searches for exploits, reports them to affected providers and seeks fixes, while also offering security services. He acknowledged the company’s commercial position when discussing a proposed public testing program: ClawSecure sells into the market and, he said, should not administer an independent rating system itself.
“Someone hides an instruction in an email, a shared document or a support ticket.”
— J.D. Salbego, ClawSecure founder and CEO, speaking to PYMNTS
Testing Results and Liability Remain Open
The report does not identify the 14 models, detail each test result, explain how often the attacks succeeded or state whether affected providers have made specific fixes. It also does not report a confirmed financial loss, customer-data breach or other real-world incident caused by the tests. The scope and severity of the exposure therefore cannot be determined from the information provided.
Responsibility is also unresolved in the report. Salbego argues that providers should disclose where their safeguards end and what customers need to supply, but the material does not establish a legal allocation of liability among model developers, application providers, businesses and end users. His conversations with congressional offices and the Federal Trade Commission are described by Salbego; no agency action, formal finding or policy decision is reported.
It remains unclear whether an independent public rating program will be established, which institution might run it, what criteria it would use or whether providers would participate. Salbego said implementation would take time and described voluntary participation as part of his proposal.
Disclosure, Monitoring and Public Ratings
Salbego said ClawSecure reports vulnerabilities to affected providers and seeks fixes. The source does not give a schedule for specific fixes or identify a next public release of test results. Organizations considering or already using agents will need to review what each system can access and how activity across connected applications is monitored, based on the risks described in the report.
Salbego said he has discussed agent security with congressional offices from both parties and with the FTC. He also said ClawSecure is trying to share a framework with Washington for an independent testing program, potentially housed at an institution such as the National Institute of Standards and Technology. He favors publicly available, comparable ratings, with models participating voluntarily; no decision to create such a program has been announced in the source.
The next clear developments to watch are whether providers publish more detail about safeguards and fixes, whether public testing receives institutional support, and whether customers receive clearer guidance about their own responsibilities before connecting agents to sensitive accounts.
Key Questions
What is indirect prompt injection?
It is a method in which an attacker places instructions in material an AI agent may later read, such as an email, document or support ticket. Salbego told PYMNTS that the instructions may go unnoticed by the user and the agent.
What did ClawSecure test?
Salbego said the company tested 14 models across five labs and examined integrations involving services including Dropbox, Notion and Linear. The report does not identify every model or give detailed results for each test.
Did the testing confirm a real-world breach?
The source does not report a confirmed theft, financial loss or customer-data breach caused by the testing. It describes potential risks and testing findings as reported by Salbego.
Who is responsible for protecting AI agents?
The report does not settle legal liability. Salbego says providers should explain the limits of their safeguards and what customers must provide, while arguing that organizations need monitoring across agents and connected tools.
Is a public AI-agent safety rating system being created?
Salbego said ClawSecure is trying to share a framework with Washington and favors an independent, public program. The source reports no formal decision, administrator or launch date.
Source: pymnts.com
