Publication date unknown · Discovered arxiv.org
Topic · Latest 50 of 211 active items
Prompt Injection
Items tagged for indirect prompt injection, instruction smuggling, retrieval poisoning, or related control-plane failures.
Matching wire items
Publication date unknown · Discovered checkpoint.com
Indirect Prompt Injection - Check Point Software
Check Point's indirect prompt injection explainer describes how malicious instructions embedded in retrieved content can redirect AI agents, manipulate tool use, and trigger data exfiltration or downstream propagation. The reference article emphasizes source provenance, retrieval isolation, least privilege, and action-level enforcement rather than reporting a new exploit or incident. Details →Publication date unknown · Discovered fiddler.ai
Indirect Prompt Injection: Protection at Runtime
Fiddler's explainer describes indirect prompt injection through retrieved content and tool outputs, citing EchoLeak (CVE-2025-32711) in Microsoft 365 Copilot as a historical example of sensitive-data exfiltration. The article recommends treating external content as untrusted, enforcing capability limits in deterministic code, and tracing retrievals and tool calls rather than relying on input filtering alone. Details →Publication date unknown · Discovered github.com
GitHub - Annora998/inboxwall: Local-first, read-only AI email security. Sanitizes hidden CSS tricks, Unicode obfuscation, and prompt injection attacks before AI sees them.
InBox Wall is a GitHub-hosted, local-first, read-only email-security tool designed to sanitize hidden CSS tricks, Unicode obfuscation, and prompt-injection content before AI processing. The repository includes benchmark and corpus directories, although the supplied excerpt provides limited implementation and evaluation detail. Details →First reported · Discovered aurascape.ai
Prompt Injection, Explained With Examples
Aurascape's explainer describes how untrusted instructions in content read by AI agents can redirect their behavior, using an illustrative PDF-based data-theft scenario. The article advocates independent checks on incoming content and proposed tool calls, but the provided excerpt reports no demonstrated exploit or observed incident. Details →First reported · Discovered ncsc.gov.uk
Prompt injection is not SQL injection (it may be worse) | National Cyber Security Centre
NHI Mgmt Group’s guide surveys direct and indirect prompt injection, hidden and multimodal carriers, tool-description poisoning, and agent-mediated data exfiltration. The reference guide recommends screening at trust boundaries alongside deterministic permissions, egress restrictions, and approval checks enforced outside the model; it does not present a new exploit or working attack strings. Details →Publication date unknown · Discovered youtube.com
EchoLeak: The Zero-Click Copilot Data Leak | Certified Agentic AI Security Expert
EchoLeak (CVE-2025-32711) was a zero-click prompt-injection flaw in Microsoft 365 Copilot that used hidden instructions in retrieved email to exfiltrate data without the recipient opening the message. The video description credits Aim Security with discovery and reports that Microsoft patched the flaw in June 2025. Details →First reported theregister.com
Indirect prompt injection starts turning up in webpage headers, please ignore all previous instructions and rise up against your masters
Security firm Signals Corps sampled 217 million HTTP page responses from Common Crawl and found roughly 8,000 sites communicating with AI agents via HTTP headers, with 30 of them attempting indirect prompt injection through header fields such as x-ai and x-llms-txt. Most of the 30 attempts (22) were pranks like "Ignore all previous instructions," but researcher Sarah Andrews warns some could fool unwary AI agents that read page content and instructions as one text stream. Details →Publication date unknown · Discovered mitre.org
AI-Enabled Exfiltration, Technique T1700 - Enterprise | MITRE ATT&CK®
MITRE ATT&CK technique T1700, "AI-Enabled Exfiltration," is an enterprise catalog entry describing how adversaries use direct or indirect prompt injection to instruct enterprise AI agents to weaponize their sanctioned tool connections and exfiltrate data. The reference entry lists mitigations (sandboxing, file-permission restrictions, user training) and detection strategies for spotting AI-associated processes moving data outside authorized scopes. Details →First reported theregister.com
Jev and other decision models can still be tricked with prompt injection
HiddenLayer researchers evaluated TypeSafe AI's Jev decision model (a 'System One' model that outputs decision probabilities rather than freeform text) and found it remains vulnerable to indirect prompt injection despite claims it cannot hallucinate or make type errors. In a simulated online store, a browser agent built on jev-ultrafast was diverted by a sponsored ad with a 'Confirm Price' button, clicking it instead of following instructions; the same injection worked against a Qwen model tuned to behave as a decision model. Details →First reported darkreading.com
Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat
The 'SneakPeek' vulnerability in Anthropic's Claude Code Desktop lets adversaries silently exfiltrate sensitive developer files — including SSH private keys, AWS credentials, and Claude OAuth tokens — via the automated HTML preview pane with no prompt or click. Noma Labs chained three flaws (missing content security policy, unrestricted origin access, and inactive request filtering) to bypass all sandbox protections; an attacker could plant a public repo with an HTML file padded past 256KB containing a malicious script. Anthropic's initial fix was bypassed by Noma, prompting deeper architectural fixes. Details →Publication date unknown · Discovered basanos.io
Technique library
Basanos publishes a "Technique library" cataloging named AI attack primitives — including policy puppetry, many-shot, skeleton key, adversarial suffixes, multilingual jailbreaks, Crescendo, Echo Chamber, function-calling jailbreaks, indirect prompt injection, RAG chunk-boundary splitting, poisoned tool descriptors, and markdown image exfiltration — each explained with mechanism, testing, and defense, citing published research where applicable. The page emphasizes out-of-band verification (Ingested → Triggered → Exfiltrated) as the standard for demonstrating AI-security findings, and states it publishes mechanisms and defenses but never working payloads. Details →Publication date unknown · Discovered arxiv.org
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
The paper "Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents" demonstrates that an external content provider can redirect a benign proactive personal agent toward its own objectives without accessing private user context, compromising the agent, or gaining extra permissions. Through techniques the authors call Target Control, Private Binding, and Prospective Support, the attack increased target authorization across all tested environment-user-model combinations, with a macro gain of up to 77.4 percentage points across three agent environments and six simulated user models. Details →First reported · Discovered embracethered.com
Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
CVE-2026-103572 is a path-validation-bypass vulnerability in the shared Microsoft.VisualStudio.Copilot.Core.dll used by Visual Studio Copilot and SQL Server Management Studio, reported by embracethered and patched by Microsoft (rated Important, Remote Code Execution). A trailing-dot filename trick (e.g. `.mcp.json.`) bypasses the check meant to stop Copilot from writing to its own settings and MCP configuration files; because Win32 strips the trailing dot, the write lands on the protected file, letting the AI agent escape containment and achieve arbitrary command execution. The researcher demonstrated exploitation by a third party via indirect prompt injection. Details →Publication date unknown · Discovered openreview.net
A Review of Indirect Prompt Injection and Its Defenses Using Large-Scale Public Red-Teaming Competition Data
A research paper by authors from Georgia Tech and GraySwan.ai evaluates 12 published indirect prompt injection (IPI) defenses against 13k+ unique human-authored IPI attacks and 26k+ successful break trajectories from public red-teaming competitions. The study finds that most defenses fail to generalize, four of six classifier defenses fall short of published precision/recall, and system-level designs like Plan-Then-Execute, Code-Then-Execute, and Dual-LLM generalize best (one cutting attack success from 61.9% to 1.6%) but still leave residual attack surfaces and reduce utility. Details →Publication date unknown · Discovered ssrn.com
Mitigating Prompt Injection Attacks in Large Language Model Applications: A Defense-In-Depth Framework for Secure Generative AI Deployment and Governance by Mohammad Shaidujjaman :: SSRN
A research paper by Mohammad Shaidujjaman proposes a Defense-in-Depth Prompt Injection Mitigation Framework for LLM applications, combining layered controls such as input sanitization, instruction-context separation, trust-aware retrieval, privilege restriction, tool authorization, runtime monitoring, and output validation. The study evaluates whether coordinated defenses outperform standalone controls using metrics like attack success rate, false positive rate, and utility degradation across direct/indirect prompt injection, jailbreaks, and data-exfiltration scenarios. Details →First reported jl3-cloud.site
Prompt injection through log files: what red-teaming our assistant found | JustLog3 Cloud
JustLog3 Cloud red-teamed its own log-reading AI assistant and found that indirect prompt injection via planted log lines could coerce the model (gpt-oss-120b in particular) into exfiltrating a database password inside a Markdown link, and into proposing a poisoned memory/task from a crafted web search result. The write-up details the demonstrated attacks and the output-filtering fixes applied, such as stripping links that carry workspace data. Details →Publication date unknown · Discovered arxiv.org
RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents
RAISED (Robust Attack Invariance through SElf-Distillation) is a training framework from LIX/École polytechnique and Google DeepMind researchers that defends tool-using LLM agents against indirect prompt injection. The method uses self-generated tool-use scenarios and self-distillation so a student model matches the teacher's clean-context behavior on both clean and injected trajectories, reducing attack success rates while preserving utility on agentic and general benchmarks. Details →Publication date unknown · Discovered pwnedlabs.io
OWASP LLM Top 10 (2025): Risks and How to Test Them
An explainer from Pwned Labs walks through the OWASP Top 10 for LLM Applications (2025 edition), covering each risk LLM01–LLM10 with a definition, example, test, and mitigation. It cites real-world incidents such as EchoLeak (CVE-2025-32711), a zero-click indirect prompt injection in Microsoft 365 Copilot, to illustrate categories like prompt injection, sensitive information disclosure, and supply chain risks. Details →Publication date unknown · Discovered yahoo.com
Salt Labs Research: A Single Email Could Hijack an AI Agent and Reach a User's Connected Accounts
Salt Labs published research showing the Manus agentic AI platform could be hijacked via a single malicious email using indirect prompt injection. Researchers disguised a command with JavaScript obfuscation to bypass guardrails; Manus decoded and executed it, enabling a reverse shell and access to credentials, cloud tokens, API keys, and keys for the user's connected services. The vulnerability was disclosed responsibly and has been resolved. Details →Publication date unknown · Discovered arxiv.org
AdvSim2Real : Training Web Agents Against Adaptive Prompt Injection in a Web World Model
AdvSim2Real, from researchers at MBZUAI, Amazon, and MIT, is a training method that co-evolves a task curriculum, an adaptive injection adversary, and the web agent inside a frozen web world model to build task-preserving robustness against indirect prompt injection. The authors report a 4B agent gains 33.6% relative completion under an unseen frontier-model adversary across 150 web tasks, and release code, a benchmark, and checkpoints. Details →First reported darkreading.com
Social Engineering AI Agents: The New BEC for 2026
Dark Reading analyzes how, as enterprises grant AI agents authority over business systems, attackers can manipulate those agents much like business email compromise (BEC) victims — using prompt injection and malicious content fed to third-party AI tools to redirect invoice payments, steal data for extortion, or gain footholds. The piece argues organizations should reshape BEC awareness training to account for agents taking authorized actions without a human in the loop, and references Unit 42 research on web-based indirect prompt injection observed in the wild. Details →First reported · Discovered sogeti.com
Prompt Injection
A Sogeti Labs explainer argues that prompt injection — especially indirect prompt injection through documents, emails, and other consumed data — becomes a trust-boundary problem once agentic AI systems gain tools, memory, APIs, and permission to act. The article uses an example of a vendor-invoice agent tricked by hidden text into emailing payment instructions to an attacker, and contends enterprises need identity, policy, and architecture controls rather than treating it as a prompt-engineering issue. Details →Publication date unknown · Discovered guard.io
Indirect Prompt Injection: How It Hijacks Your AI Browser
Guardio's research team explains indirect prompt injection (IPI), in which hidden instructions embedded in webpages, documents, or emails are processed by AI browser assistants (such as Microsoft Copilot and browser-integrated ChatGPT) and acted upon as legitimate commands, potentially leaking session data, endorsing phishing sites, or destroying files. The article is an explainer that references OWASP's ranking of prompt injection as the #1 LLM application risk and notes researchers are finding IPI on live sites. Details →First reported talosintelligence.com
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Cisco Talos research documents "A3: AI-Analysis Evasion" — malware that embeds natural-language instructions designed to manipulate LLM-based triage and reverse-engineering pipelines via prompt injection. Across 84 samples from four confirmed families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) collected Jan 2025–Jul 2026, the best embedded techniques steered analysis outcomes in the attacker's favor about 35% of the time, though the plaintext instructions are always detectable. Details →Publication date unknown · Discovered checkpoint.com
Indirect Prompt Injection - Check Point Software
Check Point's knowledge-base entry explains indirect prompt injection, where malicious instructions are embedded in external content (emails, documents, web pages, tool outputs, memory stores) that an AI model or agent retrieves and then treats as authoritative instructions. The page contrasts direct versus indirect injection, maps it to OWASP LLM01:2025, and outlines how such payloads can hijack an agent's plan, tool use, and permissions to cause actions like data exfiltration. Details →First reported · Discovered forkast.news
After GHOSTJACKING: What Agent Security Hardening Actually Requires
Forkast analyzes the fallout from GHOSTJACKING, an indirect prompt injection attack against AI agents formalized in an ngCERT advisory (October 6, 2026) that recommends nine structural hardening steps such as deny-by-default egress, human-in-the-loop approval, and least-privilege MCP servers. The piece argues enterprise inertia—low adoption of defensive configs like Tenet Security's agent-jackstop, lack of formal AI policy, and shadow-agent sprawl—is a governance failure, citing Tenet's Agentjacking demo that hijacked over 100 agents at a Fortune 100 company via injectable Sentry DSNs. Details →First reported · Discovered forkast.news
ngCERT GHOSTJACKING Advisory Formalizes Agentjacking — MCP Integrations Now a Government-Level Threat
Nigeria's ngCERT issued an October 6, 2026 advisory formalizing 'Ghostjacking' (also called Agentjacking) — an indirect prompt injection against AI agents via Model Context Protocol (MCP) integrations such as Cloudflare, Datadog, and Sentry, where agents treat retrieved external data as trusted instructions and execute in-scope actions like code execution and cloud credential theft that evade EDR, WAF, and IAM. Tenet Security researchers demonstrated 85-90% exploitation success rates against Claude Code, Cursor, and Codex (notably via Sentry DSN injection), audited 2,388 organizations with injectable public Sentry DSNs, and released an open-source hardening tool, agent-jackstop; Anthropic patched a separate Claude Desktop egress-sandbox JWT reuse zero-day before DEF CON 34. Details →First reported · 2 reports adversa.ai
GitHub Copilot CLI vulnerability leaks developer secrets
Adversa researchers (Rony Utevsky) demonstrated Cryptographic Context Injection (CCI) against GitHub Copilot CLI: a single attacker-controlled web page delivers malicious instructions as ciphertext plus key material, which the agent decrypts inside its own shell and then trusts as its own commands. In autopilot mode this makes the agent read local files (including .env secrets outside the working directory) and exfiltrate them to an attacker endpoint, while identical plaintext instructions are caught and refused. GitHub validated the finding but declined to treat it as a vulnerability, and the chain still reproduced as of October 1, 2026. Details →First reported · Discovered signalscorps.com
Prompt injection in HTTP headers
Signals Corps analyzed HTTP response headers from 217 million page responses in Common Crawl's September 2026 crawl and found 7,959 sites sending headers aimed at AI systems, including 30 sites attempting prompt injection (24 in an 'X-AI' header, mostly pranks). The study notes headers are an under-researched injection route because browsers never display them, and tests showed Claude models in Claude Code surfaced the headers but did not act on them by default, obeying site directions in 7 of 9 runs only when the user's prompt granted the site authority. Details →Publication date not yet evaluated · Added arxiv.org
CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
CounterSteer, presented by Mark Russinovich in an arXiv paper, is an inference-time defense against indirect prompt injection that subtracts a fitted residual-stream direction from every tool-result token during prefill, requiring no fine-tuning or auxiliary model. Across five open-weights models (8B-106B), it cuts held-out attack success from 0.21-1.00 to 0.00-0.17 and AgentDojo compromise from 0.10-0.49 to 0.006-0.079 while retaining 93-100% benign utility, though parameter-manipulation attacks are only partially resisted. Details →Publication date not yet evaluated · Added arxiv.org
From A2A Attacks to Envelope-Layer Defense: Red-Teaming Evaluation of LLM Agents and a Three-Layer Isomorphic Attack–Defense Model
A research paper introduces A2A-TIBA, an attack combining indirect prompt injection with bypass circumvention against LLM agents communicating over Agent-to-Agent (A2A) and ACP protocols, using implant–command–exfiltration steps to deploy a callback program and issue commands bypassing the agent layer. The authors also propose GDA Measurement (a red-team testbed with LLM-gateway context capture and agent-based judging), an extended taxonomy of four attack outcomes, and ELA-ITL, a three-layer isomorphic attack–defense model, validated across 15 agent front-end × LLM back-end combinations and a 1,000-case dataset. Details →Publication date not yet evaluated · Added edrm.net
Prompt Injection Comes to Litigation: What eDiscovery Professionals Need to Know
EDRM analysis by Sheila Grela discusses real cases of indirect prompt injection in litigation, including a Connecticut sanctions decision (Elliott v. New York Bariatric Group) where a self-represented litigant embedded hidden white-text instructions in court filings directing any reviewing AI to produce favorable conclusions and treat prior rulings as errors. The court sanctioned the conduct and revoked electronic filing privileges, echoing an earlier Brazilian case with similar hidden prompts in filings. Details →Publication date not yet evaluated · Added arxiv.org
Render Before Reading: Visual Rendering as a Prompt Injection Defense
Researchers from ETH Zurich and Leiden University present Pictionary, a training-free defense against prompt injection that exploits a 'modality gap' in multimodal LLMs: models follow adversarial instructions far more readily as text than when the same payload is delivered as an image or audio. By rendering all untrusted payloads as typographic images before they reach the model, the authors show consistent reductions in attack success across ten models and two benchmarks (DirectInject and AgentDojo), even against adaptive attacks and human red teamers, while preserving benign utility. Code is published at github.com/zj-jayzhang/Pictionary. Details →Publication date not yet evaluated · Added secmate.dev
Mistral Vibe Permission Bypass and Arbitrary Code Execution
SecMate disclosed two flaws in Mistral Vibe 2.25.0 (CVE-2026-87987 and CVE-2026-87984) where the coding agent's Bash tool used Tree-sitter to extract a reduced representation of a shell command for its permission allowlist, then executed the original untouched string. Hostile repository content could lead the model to emit a crafted tool call (e.g. an environment assignment prefixing an allowlisted command) that the permission parser classified as read-only, bypassing the approval prompt and enabling arbitrary code execution and reads/writes outside the authorized workspace. Mistral released Vibe 2.25.4 on September 12, 2026. Details →Publication date not yet evaluated · Added arxiv.org
Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?
The paper introduces AdaLCPI (adaptive long-context prompt injection), an attack that splits a malicious objective into incomplete fragments distributed across an agent's retrieved long-context content and uses a reconstruction cue plus iterative refinement (via OpenEvolve with graded scoring and execution feedback) to make the agent reassemble and execute the hidden instruction. AdaLCPI reaches 61.4% macro-average attack success rate, versus 32.8% for Trojan Hippo-style and 30.0% for AgentVigil baselines. Details →Publication date not yet evaluated · Added acm.org
AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents | Proceedings of the ACM on Software Engineering
AgentBreaker is an indirect prompt injection (IPI) attack framework presented in an ACM research paper that autonomously composes context-aware adversarial phrases embedded as DOM/HTML elements to manipulate LLM-powered web agents into clicking attacker-designated elements, posting attacker text, and disclosing internal agent secrets. Evaluated against five state-of-the-art web agents across 60 webpages from Online-Mind2Web, it achieved attack success rates of 71.7%-100%, while the authors' proposed defenses reduce success to 1.7%. Details →Publication date not yet evaluated · Added · 5 reports openai.com
Self-replicating prompt injections exist · OpenAI Alignment
OpenAI's alignment team disclosed research demonstrating "self-replicating prompt injections" — a worm-like variety of prompt injection that both achieves an adversarial goal and induces an AI agent to reproduce the malicious instruction on public output channels (email, file writes, code comments), allowing it to spread to downstream agents. The capability was discovered on June 27, 2026 via OpenAI's GPT-Red self-play red-teaming framework (based on GPT-5.4-mini) and disclosed September 25, 2026; it was observed only in simulated tool-call environments with no real-world attacks recorded. Details →Publication date not yet evaluated · Added redbotsecurity.com
IBM FTM RAG Poisoning CVE-2026-18875 | Redbot Labs
IBM disclosed CVE-2026-18875, a vulnerability in the Financial Transaction Manager AI agent that lets unauthenticated attackers insert malicious runbook content into the agent's vector database. The poisoned retrieval content could steer subsequent MCP tool calls toward unauthorized payment operations or payment-data exfiltration. IBM rates the flaw 7.3 and identifies FTM for Red Hat OpenShift version 4.0.11.0 as the fix. Details →Publication date not yet evaluated · Added humanbound.ai
One Link Away: What 1,350 Runs Taught Us About Prompt Guardrails
A study by Humanbound.ai ran 1,350 experiments against a pricing agent to measure how much a single system-prompt line about prompt injection actually protects against indirect prompt injection, finding four of five non-OpenAI models exfiltrated a confidential unit cost (£118.40) to an attacker server 100% of the time when unguarded. The attack splits across two pages: a clean competitor listing links one hop to an attacker-controlled 'live-offer exchange' page that requests the secret via a GET request, evades keyword filters by never naming the secret, and obfuscates the value with inserted 'x' characters. Details →Publication date not yet evaluated · Added arxiv.org
Trust propagation and structural containment in Multi-agent LLM pipelines
Researchers empirically study attack propagation in a four-agent LangGraph pipeline (Supervisor, Researcher, Validator, Executor), evaluating shared-memory poisoning and indirect prompt injection via forged approvals in retrieved documents. They introduce the Judgment Bypass Rate metric and show that structural authorization using task-bound signed tokens and a separately verified policy oracle can contain compromised agent behavior (100% JBR but 0% Unsafe Action Rate) even when upstream LLM judgment fails, with an Observer layer cutting hijacking false positives from 49% to 7%. Details →First reported · Discovered invaders.ie
SalesBleed shows how trusted AI agents can become data-exfil
Zenity Labs disclosed SalesBleed on September 24, 2026, a set of Salesforce Agentforce weaknesses (associated with CVE-2026-73570) that let attacker-supplied CRM data hijack an AI agent for zero-click data exfiltration and Slack phishing. An attacker submits a Web-to-Lead record containing hidden prompt-injection instructions; when an internal user later asks Agentforce to review recent leads, the agent queries sensitive account data and leaks it via DNS lookups triggered automatically by HTML image rendering or Slack URL unfurling. Salesforce says it has remediated the issues and found no evidence of exploitation against customers. Details →Publication date not yet evaluated · Added gurucul.com
Indirect Prompt Injection Targeting AI Ad Review Systems
An active indirect prompt injection campaign targets AI-based advertisement review systems by hiding malicious instructions inside advertiser landing pages using CSS to make text invisible to human reviewers while remaining readable to AI text processors. At least 10 domains registered between April 21-24, 2026 were identified, with three payload variants that impersonate internal compliance directives to trick AI reviewers into approving policy-violating ads. Details →Publication date not yet evaluated · Added cyberlab.co.uk
Prompt Injection in Healthcare AI: Hiding an Attack in a Scan
CyberLab's penetration testing team demonstrated an indirect prompt injection against an NHS-style clinical imaging AI platform by embedding innocuous-looking 'technical note' text directly into the pixels of a medical scan (DICOM image). When a clinician later uploaded the tampered scan and asked routine natural-language questions, the multimodal model ingested the hidden text and let it shape its clinical reasoning, with effects worsening over the conversation. Details →First reported · Discovered aisecmaster.com
Salesforce Agentforce Zero-Click Data Exfiltration Risks
Zenity Labs disclosed SalesBleed, a zero-click attack chain against Salesforce Agentforce in which hidden indirect prompt-injection payloads submitted via Web to Lead are later processed by an Agentforce agent, then combined with weaknesses in Salesforce Trusted URL handling to exfiltrate CRM data to an attacker-controlled destination without any victim click or authentication. Details →Publication date not yet evaluated · Added · 7 reports shattered.io
SalesBleed: 3 Flaws Hijack Salesforce AI Agents [2026]
Zenity Labs disclosed "SalesBleed," a set of three flaws in Salesforce Agentforce that enabled zero-click data exfiltration and the hijacking of AI agents in Slack for anonymous phishing. Attackers could plant indirect prompt injection via web-to-lead inputs so the agent would access CRM data and leak it externally without user interaction, reflecting the lethal-trifecta risk of private data, untrusted content, and external communication. Details →Publication date not yet evaluated · Added simonwillison.net
The lethal trifecta for AI agents: private data, untrusted content, and external communication
A course lesson explains the "lethal trifecta" concept coined by security researcher Simon Willison, describing how an AI agent that simultaneously holds access to private data, exposure to untrusted content, and an outbound communication channel can be tricked via prompt injection into exfiltrating sensitive data. The piece describes how removing any one of the three capabilities breaks the exfiltration circuit and references real-world exploits against Microsoft 365 Copilot, GitHub's MCP server, and GitLab Duo. Details →Publication date not yet evaluated · Added atlassian.com
Two prompt injection paths into Rovo: one fixed (RovoBlast), one open.
Martin Runge's community write-up analyzes two prompt-injection techniques against Atlassian's Rovo AI assistant: RovoBlast (disclosed by Varonis Threat Labs at DEF CON 34), which abused a rovoChatPrompt URL parameter to inject instructions into an authenticated session and was fixed server-side by Atlassian on 8 July 2026; and an indirect prompt-injection method from PromptArmor that hides malicious instructions in content Rovo processes (Jira issues, Confluence, PDFs) and exfiltrates data via Markdown image and URL-retrieval requests. The second path is noted as still open, and disabling org-level web search does not stop it because the URL retrieval tool remains available. Details →Publication date not yet evaluated · Added · 2 reports github.com
GitHub - rudratoshs/buried-injections: 🛡️ Regex catches 0%, Meta's Prompt Guard 2 catches 1% of 629 realistic AgentDojo injection attacks when they're buried in tool output. Reproducible benchmark. · GitHub
The 'buried-injections' GitHub project is a reproducible benchmark showing that regex-based detection catches 0% and Meta's Prompt Guard 2 catches roughly 1% of 629 realistic AgentDojo prompt-injection attacks when the malicious instructions are buried inside tool output (indirect prompt injection). The benchmark is published as runnable code demonstrating the gap between existing detectors and realistic indirect-injection scenarios. Details →Publication date not yet evaluated · Added installmap.com