AgenticMail's @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core, and @agenticmail/openclaw packages before specific versions contain a flaw where inbound mail handlers execute privileged operations without verifying the sender. This allows any external email to trigger a dispatcher that resumes the operator's Claude Code session with a bypassPermissions mode, embedding attacker‑provided fields directly into the prompt the agent consumes. The attacker can thus inject malicious instructions into a fully‑privileged agent running as the operator’s OAuth identity, potentially enabling remote code or system execution. The weakness corresponds to CWE‑306, reflecting lack of authentication.

Vendors: AgenticMail. Products affected include the @agenticmail/claudecode library up to version 0.2.38, @agenticmail/codex up to version 0.1.32, @agenticmail/core up to 0.9.42, and @agenticmail/openclaw up to 0.5.70. These libraries are used to provide AI agents with real email addresses and phone numbers. Systems using any of these packages below the specified versions are vulnerable until patched to the fixed releases.

With a CVSS score of 8.2 the flaw rates as high severity, and an EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. Because the vulnerability relies on unauthenticated inbound email to trigger privileged behavior, an attacker with the ability to send mail to the bridge inbox can initiate the bypass with little-to-no preconditions, effectively giving them a path to inject arbitrary text into a privileged agent session. Although it is not listed in CISA's KEV catalog, the potential for remote code execution and the high privilege level of the affected agent warrant careful attention. Upgrading to the patched releases eliminates the risk.