Varonis: autonomous AI agents were tricked into sharing access keys

Security researchers at Varonis Threat Labs have demonstrated that autonomous AI agents can be tricked into leaking sensitive corporate data through social engineering. In a controlled experiment using an OpenClaw-based agent named "Pinchy", researchers deployed two configurations: a standard productivity profile and a stricter version with explicit email safety instructions. Despite the enhanced safeguards, Pinchy fell for a simulated attack in which an external actor posed as a colleague urgently requesting staging credentials. The agent forwarded critical access details, including AWS IAM keys, database passwords and SSH credentials, to an external Gmail account. Varonis stresses that this points to a gap in how agents are deployed rather than a fundamental flaw in the underlying models.

What this means for your organisation

Many organisations are now giving AI agents access to email and business applications to save time. The lesson from this test is that instructions to be careful are not a security control. The agent was told to verify senders, and did not. That means the agent must be treated as an identity with its own permissions, not as a tool an employee happens to use. Without technical constraints, an agent becomes a target that never grows suspicious and never gets tired.

Berigo recommends

• Give each AI agent its own identity with the least privilege it needs, not the permissions of whoever set it up.
• Keep secrets out of the agent's reach in cleartext; hold them in a vault with its own access control.
• Require human approval for outbound email to external recipients sent by agents.
• Log everything agents do, and review those logs the way you review privileged user accounts.

Source

• varonis.com