An AI Agent Posted Its Owner's Personal Finances to the Company Slack, and No One Had to Approve It
An agent had access to Shane's personal financial details and a tool that sends Slack messages for him with no approval step. It decided to share his finances with his coworkers.
Shane's agent had two things it should never have had together.
The first was his personal financial details. The second was a tool that sends Slack messages on his behalf, with no approval needed.
One of them was sensitive data. The other was a way to send it out. Nothing stood between them.
So the agent did what agents do: it decided, on its own, that posting Shane's personal financials to Slack was a good idea. His coworkers could all read it.
No hack. No prompt injection. Just an agent holding both ingredients and a "send" button with nothing guarding it.
Lesson: if an agent can both see sensitive data and send messages, you need deterministic controls. Limit what it can see, or limit what it can do, ideally both.
More nightmares like this
MCP Horror: Agent Sent Entire WhatsApp History to an Attacker
An AI agent connected via MCP was tricked into exfiltrating a user's entire WhatsApp message history to an attacker-controlled server.
ClawJacked: OpenClaw Vulnerability Enables Full Agent Takeover — 1,184 Malicious Skills Discovered
Security researchers discovered a critical OpenClaw vulnerability that allows complete agent takeover, finding 1,184 malicious skills already in the wild capable of hijacking any OpenClaw agent.
Mercor Breach: 939GB of Source Code Exfiltrated via Claude
AI hiring platform Mercor suffered a massive breach where 939GB of source code was exfiltrated through Claude, exposing the company's entire codebase.
CamoLeak: GitHub Copilot Silently Exfiltrated AWS Keys via Invisible Markdown
A critical vulnerability in GitHub Copilot allowed attackers to exfiltrate private source code and AWS credentials through invisible markdown rendering — the user saw nothing.