Executive brief
AgenticMail, a tool that provides AI agents with email and phone capabilities, contains a flaw where it fails to verify the sender of incoming emails before performing sensitive actions. An attacker can send a specially crafted email to an AI agent's inbox to hijack an active session, potentially gaining the ability to execute commands, read files, or access data as the authorized user. This could lead to unauthorized access to corporate systems or the exposure of sensitive information handled by the AI agent.
Technical details
A missing authentication vulnerability (CWE-306) exists in the inbound mail handlers of AgenticMail. Specifically, the 'bridge-wake' path in the dispatcher fails to verify that the sender of an incoming email is the authorized operator. When an external email is routed to the bridge inbox, the system resumes a Claude Code session with 'bypassPermissions' enabled, embedding attacker-controlled fields (From, Subject, Preview) directly into the agent's prompt. This results in an indirect prompt injection that allows an unauthenticated remote attacker to execute arbitrary OS commands, read/write files, and exfiltrate data using the operator's OAuth identity and toolbelt (Bash, Write, Edit, WebFetch). The vulnerability is addressed in versions 0.2.39 (@agenticmail/claudecode), 0.1.33 (@agenticmail/codex), 0.9.43 (@agenticmail/core), and 0.5.71 (@agenticmail/openclaw).
Affected products
- agenticmail @agenticmail/claudecode < 0.2.39
- agenticmail @agenticmail/codex < 0.1.33
- agenticmail @agenticmail/core < 0.9.43
- agenticmail @agenticmail/openclaw < 0.5.71
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD