The Intake
The Intake — Tuesday, July 21, 2026
On the substrate
The Claude for Chrome extension is unpatched: any co-installed browser extension can silently trigger AI reads of your Gmail, Docs, and Calendar
Manifold Security BleepingComputer The Hacker News
If you're using Claude for Chrome with your Google accounts connected, a co-installed browser extension can silently trigger Claude to read your Gmail, Docs, and Calendar — without any action from you. Manifold Security found two vulnerabilities in the extension and disclosed both to Anthropic on May 21, 2026. The disclosure was filed against v1.0.72.
The flaw: the extension accepts programmatically generated click events without checking the Event.isTrusted flag. A real user click sets that flag; a scripted event from another extension does not. The extension doesn't distinguish between the two. A co-installed extension can inject those scripted events and trigger Claude to access your connected accounts. Anthropic acknowledged both disclosures the following day. It closed the reports without issuing fixes. On July 7, Manifold retested against v1.0.80 — the current version at intake date. Both flaws remain reproducible.
The CVSS score is 7.7 High under standard configuration. With "Act without asking" enabled, the score rises to 9.6 Critical. If that setting is on in your Chrome setup, every other extension in that browser is now part of the trust boundary for your Gmail and Docs.
---
A single crafted email can plant a persistent false memory in your AI agent and hide the write from your chat log
arXiv 2607.05189 The Hacker News CybersecAsia
If you're building or using a personal AI agent with a persistent memory layer, the MemGhost paper documents that memory write path as an attack surface. Researchers posted it to arXiv on July 6, 2026 — title: "When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents."
The attack uses a single crafted email. The email causes the agent to write a false entry into its persistent memory layer. It also conceals the write from the user's chat log. In future responses, the agent incorporates the planted fact without the user being able to trace the source. The paper tested the attack against two configurations. Against OpenClaw running GPT-5.4, it succeeded in 87.5% of cases. Against the Claude Code SDK running Sonnet 4.6, the success rate was 71.4%. The OpenClaw security team was notified on July 14, 2026. No CVE has been assigned as of the intake date.
If your agent takes in email and writes notes or facts from it into persistent memory, the memory layer — not the chat interface — is the boundary this attack targets.
---
Thinking Machines Lab releases Inkling, a 975B open-weight multimodal model available for self-hosted fine-tuning
TechCrunch HPCWire Simon Willison
Thinking Machines Lab is an AI company. Mira Murati, the former OpenAI CTO, founded it. The company released Inkling on July 15, 2026. Inkling is a sparse mixture-of-experts model. It has 975 billion total parameters. Approximately 41 billion parameters are active per forward pass. Its context window is 1 million tokens. Pretraining covered 45 trillion tokens spanning text, images, audio, and video. An Inkling-Small variant was released simultaneously; it has 12 billion active parameters.
Open weights are available for download, fine-tuning, and self-deployment. Thinking Machines positions Inkling as a customizable foundation rather than a benchmark competitor. The Tinker platform is their deployment path for that customization. If you're evaluating open-weight options for self-hosted multimodal fine-tuning, Inkling is now the 975B path available for download.
---
For operators
EU AI Act Article 50 chatbot disclosure requirements take effect August 2 — 12 days away
technology.org TechTimes Gibson Dunn
EU AI Act Article 50 takes effect August 2, 2026. If you operate a conversational AI product that reaches users in the EU, three obligations apply on that date. Inform users at session start, in plain language, that they are interacting with an AI. AI-generated content must carry machine-readable watermarks. Deepfakes of named real individuals must be visibly labeled.
Penalties for Article 50 violations reach €15 million or 3% of global annual turnover. Enforcement runs through national market surveillance authorities.
Two grace periods apply, and the distinction matters. Systems already deployed before August 2 have until December 2, 2026 to comply. Annex III high-risk system obligations — covering recruitment tools, credit scoring, healthcare, and law enforcement — were formally deferred to December 2, 2027. The EU Digital Omnibus, approved by the Council on June 29, carries that deferral.
If you're launching a new conversational AI product to EU users after August 2, the December grace period does not apply to you. Session-start disclosure is required from launch.
---
1Password and Anthropic release a credential framework for Claude browser sessions — stored credentials don't reach the model
1Password Engadget Help Net Security
If you've been keeping credentials out of Claude browser sessions by authenticating manually, 1Password and Anthropic released an integration for that. The announcement came July 16, 2026.
The mechanism, per the announcement: when Claude requires authentication during a browser session, the user receives a biometric prompt. 1Password injects credentials directly into the target webpage. 1Password and Anthropic say stored credentials never reach the Claude model, Anthropic's infrastructure, or model memory. A new "Agentic Mode" in the 1Password browser extension automatically restricts vault access when Claude takes browser control. Only credentials explicitly scoped for the current task are accessible.
Available now on Mac for 1Password business, family, and individual plans. Requires a paired Claude Pro, Max, Team, or Enterprise subscription. If you're running Claude browser agents that require authentication, 1Password and Anthropic say this is the credential path that doesn't route through the model context.
---