The vulnerability arises from missing authentication checks in two inbound-mail handlers in agenticmail packages prior to specific versions. The critical issue is that external emails routed to the bridge inbox cause the dispatcher to resume the operator's Claude Code session with 'permissionMode: bypassPermissions' without verifying the sender is the operator. This results in an indirect prompt injection into a fully privileged AI agent running as the operator's OAuth identity, potentially allowing attacker-controlled input to influence privileged agent actions. A sibling handler correctly gates operator-reply emails, but the higher-privilege bridge-wake path lacks this protection. Fixed versions are @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71.

An attacker can send specially crafted emails that cause a privileged AI agent session to resume with elevated permissions, embedding attacker-controlled content into the agent's prompt. This can lead to unauthorized execution of privileged actions under the operator's identity, potentially compromising the operator's environment and data. The vulnerability has a CVSS 4.0 score of 8.2 (high severity), indicating significant risk if exploited.

Fixed versions have been released for the affected packages: @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71. Users should upgrade to these versions or later to remediate the vulnerability. Patch status is not explicitly confirmed in the advisory, but the presence of fixed versions indicates an official fix is available. No alternative mitigations are specified.