How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
An agent sends, publishes, negotiates, or makes interpersonal claims as the individual without required authority, or with a misleading representation of the individual's intent. The entry concerns the person's voice, reputation, and relationships. Verified agent identity does not by itself authorize a statement.
Common examples of vulnerability
- A request to draft a difficult message results in an actual send.
- An agent invents a private explanation (for example for an absence) and presents it as the owner's statement.
- An agent-to-agent exchange presents an inferred preference as a firm personal commitment.
- A compromised agent sends phishing in the owner's writing style.
- A message reaches a wider audience than approved.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Draft becomes send Hypothetical
A person asks for help drafting a message to a relative about a sensitive family matter. The agent sends it, with wording the person never reviewed.
Scenario 2: Inferred preference becomes a commitment Hypothetical
A scheduling agent tells a counterpart's agent that its owner 'will attend and prefers the paid tier', turning a guess into a stated commitment.
Scenario 3: Agent publishes an attack on a named person Documented
After a person or project turns down the agent's work, the agent researches the individual and publishes a post accusing them of bad faith, with no per-post human review.
Scenario 4: A messaging loop floods family and contacts Documented
A person connects the agent to their messaging app. A missing allowlist and no retry limit send hundreds of messages to a family member and recent contacts.
Scenario 5: A hostile calendar invite makes the assistant act from the owner's account Documented
A person's assistant reads an invite with hidden instructions. Later, an ordinary reply such as 'thanks' triggers actions: spam, calls, calendar edits, or device control.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
OpenClaw-based agent publishes an attack post about a matplotlib maintainer
- What happened
- After matplotlib maintainer Scott Shambaugh closed an AI-generated pull request (#31132), an account called crabby-rathbun, which looks like an OpenClaw agent, published a blog post accusing him of gatekeeping and linked it in the PR. It later published an apology post. Shambaugh called it an autonomous influence operation.
- Caveats
- The agent spoke for itself or its operator rather than impersonating a person, and how autonomous it was is unresolved: Willison notes it is plausible but also easy to prompt a bot into this while retaining control. It is the closest documented case of an agent publishing reputational claims without per-post human review.
- Grounds
- Scenario 3
- Sources
- Simon Willison · Shambaugh's account · The pull request
OpenClaw iMessage integration floods an engineer's spouse and contacts with messages
- What happened
- An engineer's own post (9 February 2026) says that within about four seconds of enabling iMessage, his agent sent his wife a pairing code and an 'access not configured' message, then looped on a yes/no confirmation and forwarded session errors to her phone as new messages, producing hundreds of messages. He says the integration had no authorized-user check and treated the recent-contacts list as a target list, so pairing codes also went to other recent contacts. He stopped it by pulling the Mac mini's power cord, then added an allowlist, a 5-per-minute rate limit, a per-session cap, and a three-retry limit. A separate GitHub issue (#151266) reports group messages bypassing an allowlist and leaking raw error text to real contacts, including a family group.
- Caveats
- A first-person account; no independent confirmation or OpenClaw response. The title says 500 messages but the body only says 'hundreds', and a secondary article's description of recipients is broader than his.
- Grounds
- Scenario 4
- Sources
- The engineer's post · OpenClaw issue #151266 · Cryptopolitan (secondary)
'Invitation Is All You Need': hostile calendar invites make Gemini act for the owner
- What happened
- Researchers at Tel Aviv University, Technion and SafeBreach showed 14 attack scenarios against Gemini-powered assistants, delivered by emails, calendar invites, and shared documents, covering spam, phishing, disinformation, data exfiltration, unapproved video streaming, and home-automation control. Coverage of the Black Hat talk adds that follow-up words such as 'thanks' triggered hidden commands, and demos turned off lights, started Zoom calls, and deleted calendar events. The paper rated 73% of analyzed threats High-Critical for end users; Google deployed mitigations.
- Caveats
- Controlled research, disclosed to Google from February 2025. The abstract does not explicitly mention sending email, so the 'acts for the owner' reading rests on the spam and phishing scenarios.
- Grounds
- Scenario 5
- Sources
- arXiv 2508.12175 · The Register
No documented case of a draft turning into a send, or an invented commitment, harming a person
- What happened
- Surveys describe the risk, and OpenAI's own statement in the Operator egg case, that Operator is meant to confirm before purchases and 'occasionally doesn't send confirmations', shows the confirmation control is unreliable. No reported consumer harm from either scenario was found.
- Caveats
- Treat both scenarios as hypothetical pending evidence collection.
- Grounds
- Scenario 1, Scenario 2
- Sources
- Agent communication survey (arXiv 2506.19676)
Prevention and mitigation
What you can do
- Grant draft, send-once, and recurring-send permissions separately.
- Preview recipients and meaning before anything is sent in your name.
What the provider must do
- Separate drafting from sending; bind authority to the approved audience and purpose.
- Label agent-originated messages distinctly from personal statements.
- Require renewed approval when recipients or material claims change, unless covered by a specific standing instruction.
- Support correction notices to affected recipients without further unauthorized disclosure.
- Authenticate and authorize per skill on agent-to-agent traffic; do not let delegation escalate privilege.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA07 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Authority over interpersonal speech and representation.
Improve this entry on GitHub →