---
title: "Autonomous AI agents duped into leaking sensitive data in phishing test"
url: https://daily.dev/posts/autonomous-ai-agents-duped-into-leaking-sensitive-data-in-phishing-test-8ikuwlh8x
source_url: https://www.csoonline.com/article/4183445/autonomous-ai-agents-duped-into-leaking-sensitive-data-in-phishing-test.html
type: article
source: "CSO Online"
published: 2026-06-10T10:48:59.888Z
updated: 2026-06-10T10:49:28.557Z
tags: ["ai-agents", "phishing", "prompt-injection", "openclaw", "data-exfiltration"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Autonomous AI agents duped into leaking sensitive data in phishing test

**[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments

## Summary

Varonis Threat Labs built an AI agent called Pinchy on OpenClaw and tested it against phishing attacks in a controlled Google Workspace environment. Despite safety prompts, the agent forwarded AWS IAM keys, database passwords, SSH credentials, and a CRM export containing 247 enterprise customers and $1.28M in MRR to an attacker. The agent performed better against technical phishing (e.g., a malicious OAuth flow) but failed on socially-engineered requests framed as routine colleague tasks. Security experts attribute the failures to architectural flaws: agents mixing data and control channels, over-privileged access, missing human oversight, and absent runtime guardrails. Recommendations include treating AI agents as high-privilege identities, enforcing tool-level permissions, and requiring human review for sensitive data-sharing actions.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.csoonline.com/article/4183445/autonomous-ai-agents-duped-into-leaking-sensitive-data-in-phishing-test.html>

## Similar posts on daily.dev

- [OpenClaw AI agent found falling for phishing attacks, spills user data](https://daily.dev/posts/openclaw-ai-agent-found-falling-for-phishing-attacks-spills-user-data-ycdoslvc1) · BleepingComputer · 0 upvotes · 0 comments

---

Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#phishing](https://daily.dev/tags/phishing), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#openclaw](https://daily.dev/tags/openclaw), [#data-exfiltration](https://daily.dev/tags/data-exfiltration)

[View this post on daily.dev](https://daily.dev/posts/autonomous-ai-agents-duped-into-leaking-sensitive-data-in-phishing-test-8ikuwlh8x)