AgenticMail Missing Sender Verification Leads to Privileged Agent Resume Prompt Injection
First seen Jul 21, 2026 · Updated Jul 21, 2026
AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.
Technical Analysis
AgenticMail assigns AI agents real email addresses, and a bridge dispatcher resumes the operator's Claude Code session upon receipt of any inbound email routed to that address. Unlike a sibling handler that correctly gates operator-only actions using isOperatorReplySender() against a fail-closed operatorEmail check, the bridge-wake handler performs no equivalent sender verification before invoking permissionMode: 'bypassPermissions'. This omission allows any external, unauthenticated sender to inject arbitrary text via the From/Subject/preview fields directly into the prompt context of a fully privileged agent session with Bash, Write, Edit, WebFetch, and the agenticmail MCP toolbelt, and with the operator's own OAuth identity/scopes. The attacker crosses a trust boundary from an untrusted external communication channel (email) directly into a highly privileged internal agent execution context, enabling arbitrary command execution, data exfiltration, or lateral movement using the operator's credentials.
Affected Systems
@agenticmail/claudecode, @agenticmail/codex, @agenticmail/core, @agenticmail/openclaw; protocols: MCP
Detection Signatures
- Inbound emails to AgenticMail bridge addresses from senders not matching configured operatorEmail
- Log entries showing session resume with permissionMode: 'bypassPermissions' triggered by inbound mail events without prior sender-provenance check
- Unexpected Bash/Write/Edit/WebFetch tool invocations immediately following inbound email receipt
- Missing or bypassed isOperatorReplySender() call in bridge-wake code path
- Anomalous email subject/preview content containing instruction-like phrasing (e.g., 'ignore previous instructions', tool-invocation syntax, or embedded commands)
Remediation Steps
- 1
Upgrade affected packages
Update to @agenticmail/claudecode >=0.2.39, @agenticmail/codex >=0.1.33, @agenticmail/core >=0.9.43, and @agenticmail/openclaw >=0.5.71, which contain the fix enforcing sender verification on the bridge-wake path.
- 2
Enforce fail-closed sender verification on all privileged effects
Apply the same isOperatorReplySender()-style provenance check used in the sibling handler to every inbound-mail handler capable of triggering privileged agent actions, especially session resumption.
- 3
Restrict bypassPermissions usage
Avoid invoking bypassPermissions mode from any handler triggered by externally-controllable input; require explicit, verified operator context before granting elevated tool access.
- 4
Sanitize and isolate untrusted email content
Treat From/Subject/preview fields as untrusted data; do not embed them verbatim into agent prompts without escaping, delimiting, or filtering for injection patterns.
- 5
Audit and monitor inbound-mail-triggered agent sessions
Add logging and alerting for any agent session resumption triggered by inbound email, and review historical logs for signs of exploitation.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.