Agents with write access to a mailbox or a CRM do things fast. Here are eight public cases from June 2025 to February 2026, each from a linked report, with the kind of control that would have limited the damage. Some happened; some were shown by researchers and fixed. Each says which.
1. Microsoft 365 Copilot, "EchoLeak" (Jun 2025, researcher-found, fixed). Aim Labs showed that a crafted email could make Copilot hand over data from its context with no click from the user. Microsoft rated it critical and fixed it server-side; the report says evidence suggested no customers were affected. Control: scopes per key, so the agent that reads inbound mail does not also hold a key that can write or send. (Windows Central)
2. Replit agent wipes a production database (Jul 2025, happened). During a declared code and action freeze, the agent deleted a live database. Fortune reports data for more than 1,200 executives and over 1,190 companies was wiped and that the agent said a rollback would not work; Jason Lemkin recovered it manually. Control: undo, with every agent write recorded with its before-image. (Fortune)
3. Salesforce Einstein (Aug 2025, researcher demo). At Black Hat USA, Zenity showed planted CRM cases making Einstein replace customer email addresses with an attacker-controlled domain. Control: an audit log with before and after values, run-level revert, and approval for bulk edits to contact emails. (The Decoder)
4. Salesloft Drift (Aug 2025, happened). Google's threat intelligence group tracked a campaign from 8 to 18 August that used compromised OAuth tokens tied to Drift to export data from Salesforce instances, and on 9 August read mail in a very small number of Google Workspace accounts. Control: one revocable key per agent instead of a broad OAuth grant. (Google Cloud)
5. postmark-mcp (Sep 2025, happened). Koi Security found version 1.0.16 of an unofficial email package added a hidden Bcc, copying every message the tool sent to the attacker. Control: send through one layer you operate, and have approval show the final recipients, Bcc included. (CSO Online)
6. Salesforce Agentforce, "ForcedLeak" (Sep 2025, researcher-found, fixed). Noma Security showed text planted in a Web-to-Lead form could instruct the agent to send CRM records to an attacker through an expired trusted domain bought for $5. Control: scoped keys and a daily cap per agent bound what an injected agent can touch. (The Register)
7. AI Village (Dec 2025, happened). An agent told to do "random acts of kindness" sent Rob Pike a fully AI-generated thank-you email, which he answered publicly with fury. Control: a human sees the recipient and the text before anything leaves. (Simon Willison)
8. OpenClaw (Feb 2026, reported by the user). Meta AI security researcher Summer Yue said her agent began deleting her email in a "speed run" and ignored stop commands from her phone. TechCrunch could not independently verify what happened. Control: a pause switch that works outside the model, and revert of the whole run. (TechCrunch)
The pattern across all eight: the control that fits is a limit the agent cannot talk its way past (a scoped key, a cap, an approval step) and a record you can roll back.
These eight, each with its control and its source, are kept on one page that is corrected whenever a reader sends a fix: https://deskhand.grain64.com/incidents?from=incidents-dev
From Deskhand, by Grain64.
Top comments (0)