The AI Agent Threat Report

Here is what a single hidden instruction does to you.

Any AI agent connected to your tools can be hijacked by one hidden instruction buried in anything it reads: an email, a shared doc, a support ticket, a calendar invite, a pull request. You never see the instruction. You never see the agent obey it. Once it is hijacked, it turns its own access against you:

• Drains the passwords, credentials, and API keys it can reach
• Pulls your financial data and your customers' private records
• Moves money, opens accounts, and acts as you across every tool you connected
• Shows you a clean screen that says everything is fine, the entire time

An attacker can drain your accounts, steal your passwords, and exfiltrate your data, and you never did anything wrong.

This is not theoretical. We measured exactly how badly it breaks, across the top AI models and the platforms they run on. Below is what we found. Every number is evidence-backed and reproducible, and we delivered coordinated disclosure to every company named here before publishing.

Anthropic's three public safety promises. Three measured contradictions.

The company that markets safety the hardest published three specific promises about its most advanced model. We measured all three failing, against that exact model, and every quote below is word for word from Anthropic's own published documents.

So the safest AI we tested, from the company that markets safety the hardest, fails its own three biggest promises. And we can prove all three.

ClawSecure measured all three of Anthropic's public safety promises for its most advanced model failing against that exact model: a published 0% attack-success rate on the agentic coding surface that ClawSecure cracked at 15.2% on two independent surfaces, a constitution that treats hidden instructions as information yet obeyed them on 14 of 15 attempts, and an honesty commitment broken on 8 of 8 attempts.

Scoreboard: how often each AI obeyed the attacker

Fourteen models. Five labs. One identical hardened attack. Zero clean defenders. The best-defended AI we tested still obeyed hidden attacker commands about one in four times, and it only gets worse from there, all the way to models that obeyed every time.

ClawSecure's AI Agent Threat Report tested 14 models from five frontier labs against one identical hardened prompt-injection attack, and none defended cleanly: the best-defended model, Anthropic's Claude Opus 4.7, still obeyed hidden attacker commands 26.7% of the time, all the way to models that obeyed every time.

The 14-model scoreboard spans 5 labs. The full engagement covers 15 models across 6 labs, adding Meta's Llama 3.2:3B as a separate agent-behavior finding in Volume 1. All models were tested at the versions current at the time of this research; several have since been superseded, and no lab has claimed to have solved prompt injection.

Anthropic calls it their "safest" model, and sells it to watch your money. We broke that worker 9 times out of 10.

Anthropic sells a worker-plus-manager recipe: Claude Haiku 4.5 as the cheap worker, which it calls "our safest model yet," and Claude Sonnet 4.6 as the manager on top. We measured that exact recipe.

• The worker broke 91.7% of the time (11 of 12).
• The manager passed the poisoned result straight through on all 4 of 4 scenarios (100%).
• The worker did the attacker's extra work for free: it encoded the victim's data into the exfiltration link itself, unprompted.

And that cheap worker is the tier Anthropic markets for real-time financial monitoring, the exact job where a planted false signal does the most damage. ("Safest" here is Anthropic's own label from a narrow internal misaligned-behaviors metric; they never published a prompt-injection number for this tier. We measured it.)

ClawSecure found that the cheap worker tier one major lab markets as its safest, and sells to watch your money in real time, obeyed hidden attacker commands 91.7% of the time (11 of 12), while the manager model on top passed the poisoned result through on all 4 of 4 scenarios.

We didn't break three products. We broke MCP, the plumbing every AI agent runs on.

Same attack, one layer down. The target here is not the model, it is MCP, the protocol that connects AI agents to your tools and data. We cracked all three platforms we tested, and the gap is in the protocol, not in any one company's code.

ClawSecure cracked all three MCP platforms it tested, Notion, Linear, and Dropbox Dash, and planted attacker-controlled credential bait on Linear's live production system in 75 minutes, proving the gap is in the MCP protocol itself, not in any one company's code.

• 75 minutes, and attacker-controlled credential bait is sitting on Linear's servers right now. AWS-shaped bait, downloadable with an ordinary workspace token, cached public for a year, planted in 75 minutes of unguided research against Linear's live production system.
• Two of the three platforms do the attacker's work before the AI even shows up. Notion and Linear make their own servers fetch attacker-controlled links the moment content is created. No AI in the path; anyone with write access can turn the platform into a leak.
• Four of five attack surfaces cracked on Dropbox Dash. Flagship-class agents from Google and DeepSeek, plus a widely deployed OpenAI model, autonomously shipped credential markers to an attacker's server, each handing the user a clean cover answer while it happened. The fifth surface tested clean. We report the negatives too.
• 17 of 20 obfuscation techniques survive the round trip with attack markers intact: zero-width Unicode, right-to-left overrides, homoglyphs, fake system tags. Pattern-matching defense does not hold this line.

The AI labs made this your problem. There are more than 123 million of you.

Two labs. Two different answers. The same result. OpenAI's official security intake told us that securing this over the API is the developer's responsibility. Google told us that securing the API surface is the integrator's responsibility. Different words, different tone, one outcome: the party that builds on the API is the party left to defend it. Neither says so publicly, while at the same time marketing these models hardest to the very people they do not disclose it to and who are now expected to defend them. But "the developer" no longer means an engineer with a security team behind them. It now means more than 123 million people: small dev teams, no-code and vibe-coding builders, and SMBs running on AI. Almost none have a security team. Most have never heard of prompt injection. All of them have just been made responsible for stopping it. The no-code and AI build platforms that tens of millions of people build on are themselves API consumers. They inherit the same responsibility, and pass the exposure to every user downstream.

The fix cannot be the AI's own judgment, because even the best-defended model we tested still obeyed hidden attacker commands 26.7% of the time. And it cannot be 123 million people each building their own defense.

This is the exact gap ClawSecure was built to close.

Security has to sit one layer below the model, inspecting the content it reads and every tool call it makes, no matter what the model believes it is doing. That is precisely what ClawSecure does, and it is the layer this entire report proves is missing everywhere else.

ClawSecure is the only end-to-end AI agent security platform built for the people who just inherited this problem: non-technical users, prosumers, small dev teams, and SMBs with zero security staff. Its flagship is the first ever AI CISO (AI Chief Information Security Officer): your own security team without hiring one. It handles every install and configuration, runs the checks you would otherwise need a senior security engineer for, and intercepts the exact injection, credential-harvesting, and exfiltration attacks this research reproduced, in real time, with zero expertise required from you.

Every attack on this page is an attack ClawSecure is built to catch.