TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A PYMNTS report on ClawSecure’s testing and recommendations examines how malicious instructions hidden in routine documents could manipulate AI agents connected to business tools and financial accounts. ClawSecure CEO J.D. Salbego urged organizations to monitor agent-to-tool activity and called for clearer provider disclosures and independent safety ratings; the report does not establish a regulatory finding or a confirmed attack on a financial institution.
A PYMNTS report on AI agent security describes ClawSecure testing 14 models across five labs and warns that agents connected to email, storage or financial tools could be manipulated by instructions hidden in ordinary documents. ClawSecure CEO J.D. Salbego called for closer monitoring, clearer disclosures about provider protections and independent ratings, but the report does not identify a confirmed financial loss or regulatory finding.
The attack Salbego described is called indirect prompt injection: someone places instructions in material an agent is asked to process, such as an email, shared document or support ticket. If the agent can act through connected services, the hidden instruction may affect what it does without an employee approving each step. The report presents this as a security risk, not as evidence that a specific bank or business has suffered an incident.
Salbego said ClawSecure tested 14 models across five labs and found a recurring pattern across models and integrations involving Dropbox, Notion and Linear. He said the tests included several providers to examine whether the exposure went beyond one model. The report does not provide model-by-model results, test procedures, dates or independent verification of the findings.
Connected services can widen the potential reach. Salbego gave the example of an agent working through Dropbox that could also connect to Gmail. He said security teams should review the exchanges between models and tools, including requests that may seem harmless when viewed separately. The possible consequences depend on the agent’s permissions: access to payment accounts, credentials, customer information or operational systems could raise the stakes.
Why Connected Agent Access Matters
The core concern is that an agent’s permissions can turn a hidden instruction into an action. A system that can only summarize documents presents a different exposure from one that can send messages, retrieve credentials or interact with financial and business applications. The report does not establish that every agent can perform those actions; the risk depends on its configuration and access.
That distinction matters to organizations deciding how quickly to adopt agents. Employees may not recognize an instruction embedded in routine material, and the agent may have access that extends beyond the task at hand. In Salbego’s hypothetical example, compromised credentials on a developer’s computer or connected server could put corporate cloud systems or customer databases at risk. He listed data extraction, service disruption and ransom demands as possible outcomes, not documented events.
Smaller firms and consumers may have fewer staff to review permissions or monitor agent activity. Salbego said people can connect agents to financial and business applications without a dedicated security team. His warning is that ease of setup does not remove the need to understand what an agent can reach or how its actions are supervised.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
How Agent Safety Is Evaluated
Salbego leads ClawSecure’s team that searches for vulnerabilities and reports them to affected providers, according to the report. The company also sells security services, a commercial interest readers should keep in mind when considering its recommendations. The source does not say that ClawSecure’s tests were conducted by an independent public body.
Salbego said buyers currently encounter a mix of providers’ own evaluations, paid audits and individual research findings. He wants a dedicated program that publishes comparable safety ratings, ideally run by an institution such as the National Institute of Standards and Technology. He described voluntary participation, with purchasers able to take account of both a rating and a provider’s decision not to participate.
He also said he had discussed agent security with congressional offices from both parties and spoken with the Federal Trade Commission. The report does not describe formal government action, a proposed rule or an official position from either the FTC or NIST. Salbego said ClawSecure has developed a framework it is trying to present to Washington, while acknowledging his company should not administer a program because it sells services in the market.
““someone hides an instruction in an email, a shared document or a support ticket””
— J.D. Salbego, ClawSecure founder and CEO, speaking to PYMNTS
What the Tests Do Not Establish
The source does not give the identities of the 14 models, detailed test results, the vulnerabilities found in each system or whether providers have fixed any issues. It also does not identify an affected customer, verified financial loss or confirmed real-world attack tied to the tests. Salbego’s account is attributed to him and ClawSecure; independent confirmation is not described.
It remains unclear what protections each provider offers, how those protections compare, and whether organizations using connected agents have implemented continuous monitoring. The report does not establish a single party as legally or operationally responsible when an agent causes harm. Responsibility could depend on the system’s design, permissions, deployment choices and the conduct of users or providers; the source does not resolve those questions.
The report also provides no formal response from the model providers, the FTC, congressional offices or NIST. Salbego’s proposed ratings program is a recommendation, not an announced government initiative.
Monitoring and Public Ratings
Salbego said ClawSecure is seeking to give its proposed framework to policymakers and wants an institutional testing program that would publish comparable ratings. He acknowledged that establishing such a program will take time. The report names no launch date, funding plan, participating agency or next formal government milestone.
For organizations using agents, his immediate recommendation was to suspend them while arranging security assistance and continuous protection. That is Salbego’s advice, not a directive from a regulator. Any organization assessing its own exposure would need to establish which applications agents can access, what actions they are permitted to take and what monitoring is in place. The source does not say whether providers or institutions have adopted those steps.
Key Questions
What does “indirect prompt injection” mean?
It refers to an instruction hidden in content an agent processes, such as an email or shared document. Salbego warned that the agent could encounter it without the user noticing.
Did ClawSecure report a confirmed attack on a bank?
No confirmed bank attack or financial loss is identified in the supplied report. It describes testing and potential exposure, with claims attributed to ClawSecure CEO J.D. Salbego.
What did ClawSecure test?
Salbego said the company tested 14 models across five labs, including integrations involving Dropbox, Notion and Linear. The report does not list the models or provide detailed results.
Who is responsible if an AI agent causes harm?
The report does not settle that question or establish a legal finding. It argues for clearer explanations of provider protections and customer responsibilities, while the practical allocation may depend on the system and how it was deployed.
Is a public AI agent safety rating program in place?
No. Salbego proposed a public program with comparable ratings and said ClawSecure is trying to present a framework to policymakers. The report gives no launch date or confirmed government sponsor.
Source: pymnts.com
