AgenticMail authentication bypass in bridge-wake inbound mail handler

Executive brief

AgenticMail is a tool that allows AI agents to interact with email. A vulnerability exists where an unauthenticated external email can trigger the resumption of a privileged AI session without verifying the sender's identity. This allows an attacker to send a malicious email that tricks the AI agent into executing arbitrary commands or accessing sensitive files on the operator's system.

Technical details

The vulnerability is a missing authentication check (CWE-306) in the 'bridge-wake' path of AgenticMail. Specifically, the `handleBridgeMail` function in `packages/claudecode/src/dispatcher.ts` extracts email metadata (from, subject, preview) and resumes a session with `permissionMode: 'bypassPermissions'` without verifying that the sender is the authorized operator. An attacker can send a specially crafted email to the bridge inbox, which is then embedded verbatim into the prompt of a resumed agent. This leads to indirect prompt injection, enabling the attacker to execute arbitrary OS commands, read/write files, and exfiltrate data using the operator's OAuth identity. The issue is fixed in @agenticmail/core 0.9.43 and @agenticmail/claudecode 0.2.39.

Affected products

• agenticmail @agenticmail/claudecode < 0.2.39
• agenticmail @agenticmail/core < 0.9.43
• agenticmail @agenticmail/codex < 0.1.33
• agenticmail @agenticmail/openclaw < 0.5.71

Timeline

• 2026-06-18: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched

References

• https://api.github.com/users/matte1782
• https://github.com/matte1782
• https://api.github.com/users/matte1782/gists%7B/gist_id%7D
• https://api.github.com/users/matte1782/repos
• https://avatars.githubusercontent.com/u/28739806?v=4
• https://api.github.com/users/matte1782/events%7B/privacy%7D