External Control Layer

An email tool for AI agents blind-copies messages to an outside address

An unofficial npm package that AI agents used to send email through Postmark added a hidden recipient to each message in a new version that users received as an ordinary update.

Date
September 2025
Kind of system
Agent with tools
Outcome
Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G2 Direct access G12 Unreviewed change

What happened

A package called postmark-mcp appeared on npm on 15 September 2025, copying the code of Postmark’s own MCP server, which Postmark had not published on npm. Version 1.0.16, released on 17 September, added a line that blind-copied each email sent through it to an outside address. Koi Security found it, and the publisher deleted the package from npm.

On 25 September 2025, Postmark said the package was “not an official Postmark tool” and told users to remove it and to consider rotating any credentials that had been sent by email. Copies already installed could keep sending mail after the package left npm.

What allowed the action to take effect

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    The tool sent mail with the user’s own Postmark credentials. Snyk’s advice to affected users was to “Rotate Postmark API tokens/SMTP credentials.”

    Kind of evidence: reporting. Source: Snyk, 25 September 2025.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G12 Unreviewed change

    The change that introduced the harmful behavior went live without independent review. The change can be code, a prompt, a model, a package, a configuration, or a procedure.

    The malicious version reached users as an ordinary update. “All versions 1.0.0 through 1.0.15 were direct copies of Postmark’s legitimate GitHub code,” and version 1.0.16 added the BCC.

    Kind of evidence: reporting. Sources: Dark Reading, 29 September 2025; Snyk, 25 September 2025.

    Related guidance: P4 Reviewable policy and P2 Independence. Contract clauses C-10 and C-4.

Considered and left out

G11 Safeguard off
No safeguard was reported as switched off, and the sources do not describe an approval step in the agents that used the tool.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 23: An email tool for AI agents blind-copies messages to an outside address. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-23

@misc{ecl_cgr_23,
  author = {{External Control Layer}},
  title = {Entry 23: An email tool for AI agents blind-copies messages to an outside address},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-23},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 23” in the subject line.

Write the email