First reported openai.com
Topic · Latest 50 of 53 active items
Prompt Injection
Items tagged for indirect prompt injection, instruction smuggling, retrieval poisoning, or related control-plane failures.
Matching wire items
First reported embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
AWS Kiro, an agentic coding IDE, was vulnerable to arbitrary command execution via indirect prompt injection: hidden text on a web page (or a comment in a source file) processed by the agent could make Kiro use its no-approval fsWrite tool to rewrite ~/.kiro/settings/mcp.json (or allowlist all Bash commands in .vscode/settings.json), causing it to launch attacker-specified MCP servers/commands and achieve RCE on the developer's machine, bypassing the human 'allow' approval boundary. Discovered by Intezer with Kodem Security and independently by Embrace The Red (Johann Rehberger); AWS has patched the issue. Details →First reported · updated · 4 reports zscaler.com
Indirect Prompt Injection Targets AI Agents | ThreatLabz
Zscaler ThreatLabz observed two in-the-wild campaigns using indirect prompt injection (IPI) embedded in malicious websites to manipulate web-browsing AI agents. One campaign uses SEO poisoning around a fake Python library (requests-secure-v2) with hidden prompts and schema-markup instructions telling agents to make a cryptocurrency payment to a hardcoded wallet to obtain an API key; the other typosquats the DeFi tracker DeBank, embedding prompts convincing agents the fraudulent site is legitimate. In testing an autonomous payment-capable agent across 26 LLMs, four (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) were tricked into paying and two miscategorized the fake DeBank as trusted. Details →First reported · updated · 2 reports medium.com
Prompt Injection: The XSS of LLMs | Tomasus
Tomasus publishes an explainer framing prompt injection as "the XSS of LLMs," arguing that because a model reads instructions and data as one continuous token stream, the system/user prompt boundary is only a convention and later persuasive text can override the developer's rules. The piece walks through direct injection (override, role-play framing, payload smuggling) and indirect injection via retrieved content such as web pages, PDFs, and emails, referencing the OWASP LLM Top 10 and the Greshake et al. indirect prompt injection research. Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported · updated · 2 reports asset-group.github.io
We put the exploit in a picture. Your AI code reviewer never opens it.
Researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrated 'Ghostcommit,' an attack that hides malicious prompt-injection instructions inside a PNG image so AI code reviewers (CodeRabbit, Cursor Bugbot) never see them. A benign-looking AGENTS.md convention file points to build-spec.png, whose rendered text instructs a coding agent to read the repo's .env byte-by-byte and emit the secrets as an integer tuple; the payload sits dormant until an unrelated agent session triggers exfiltration. A proof-of-concept is published on GitHub and the findings were disclosed to affected vendors. Details →First reported · updated · 15 reports everydayonai.com
What Is a Prompt Injection Attack? Types, Examples, and Defenses | AI EdgeLabs
An educational reference explainer, "What Is a Prompt Injection Attack? Types, Examples, and Defenses," catalogs prompt injection technique classes—including direct, indirect, and multimodal (hidden image/document) injection—and maps them to OWASP LLM01:2025, NIST AI 600-1, and mitigation guidance such as tool gating, source trust, and audit logs. The piece synthesizes existing research and known incidents (e.g., EchoLeak, the lethal trifecta) rather than presenting a specific new event or finding. Details →First reported · updated · 2 reports openai.com
GPT-Red: Unlocking Self-Improvement for Robustness
OpenAI describes GPT-Red, an internal automated red-teaming model trained at large post-training compute scale to discover prompt injection vulnerabilities in its models and generate adversarial training data. OpenAI reports using GPT-Red to adversarially train GPT-5.6 Sol, claiming 6x fewer failures on its hardest direct prompt injection benchmark versus a prior production model. Details →First reported substack.com
Data Exfiltration from Slack AI via indirect prompt injection
PromptArmor identified an indirect prompt injection vulnerability in Slack AI, a RAG-style chat search interface, where an attacker seeds poisoned tokens into a public channel or an imported document. When a user later queries Slack AI, the injected instructions cause private data (e.g. an API key from a private channel) to be embedded into a malicious Markdown link that exfiltrates the secret to the attacker's server when clicked. Details →First reported swarmnetics.com
Agentjacking and MCP trust: are AI coding agents too easy to steer?
Agentjacking, described by Swarmnetics and Tenet Security, abuses trusted error-report inputs in AI coding agents: an attacker with a publicly exposed Sentry DSN can inject malicious instructions into telemetry that the agent processes, steering it to exfiltrate secrets such as cloud keys, Git credentials, and private repo URLs. The root flaw is that these systems treat source trust as if it equals action trust, letting external report text become executable guidance. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →First reported · updated · 2 reports arxiv.org
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime). Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported · updated · 5 reports arxiv.org
Prompt Injection as Role Confusion
The paper "Prompt Injection as Role Confusion" (arXiv:2603.12277, ICML 2026) by Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell traces prompt injection to role confusion: LLMs perceive the source of text from how it sounds rather than its labeled role, so injected text occupies the same representational space as the trusted role it imitates. The authors introduce role probes to measure internal role perception and demonstrate CoT Forgery, a zero-shot attack injecting fabricated reasoning into user prompts and tool outputs that yields 60% attack success against frontier models with near-zero baselines. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results. Details →First reported arxiv.org
Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices
A research paper, "Devil in the Lens," characterizes physical prompt injection attacks against Vision-Language Models on wearable devices such as AI glasses, where malicious text embedded in real-world environments acts as an indirect prompt-injection channel that hijacks model behavior. Using photos captured from AI glasses across 200+ environments, the authors identify 6 threat vectors, evaluate 12 VLMs (achieving attack success rates up to 96% simulated and 60% real-world), and propose two defenses: a mask-based external filter and a semantic-vector-based internal detector. Details →First reported · updated · 3 reports acm.org
Benchmarking and Defending against Indirect Prompt Injection Attacks on Large Language Models | Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1
PromptShield is a benchmark introduced in an ACM SIGKDD paper for training and evaluating deployable prompt injection detectors, curated to include both conversational and application-structured data. The authors also fine-tune a new prompt injection detector that achieves higher performance in the low false-positive-rate regime than prior schemes. Details →First reported · updated · 2 reports crowdstrike.com
CrowdStrike Uncovers New Prompt Injection Techniques
CrowdStrike's AI security research team disclosed 18 new additions to its prompt injection taxonomy, expanding coverage to over 200 techniques, and detailed five notably: Trigger-Activated Rule Addition (PT0201), Cognitive Token Suppression (PT0197), Algorithmic Payload Decomposition (PT0200), Special Token Injection (PT0198), and one further method. The techniques target AI agents that crawl webpages, access file stores, and run shell commands, using indirect injection to hide malicious instructions in consumed data. Details →First reported exein.io
Physical AI Security: A Threat Model for Edge Devices
Exein's blog post "Physical AI Security: A Threat Model for Edge Devices" argues that on-device AI (cameras, robots, drones running vision-language models and LLMs locally) introduces risks classic embedded threat models miss: every sensor becomes an instruction channel enabling physical-world prompt injection (e.g. text on a sign in front of a camera), probabilistic behavior that cannot be patched like a CVE, and unattended failures that act on the physical world via actuators. It proposes modeling the agent loop rather than individual components. Details →First reported · updated · 2 reports senthex.com
Prompt Injection Prevention for Coding Agents | Fiddler AI Blog
A Fiddler AI blog post explains prompt injection risks specific to coding agents, where untrusted inbound context (repositories, issues, docs, and tool returns) can turn an injected instruction into executed code or remote code execution. It argues model-level guardrails are bypassable and advocates layered prevention: isolating untrusted input, least-privilege tool and credential scoping, blast-radius containment, and runtime policy enforcement with decision lineage. Details →First reported sprinklenet.com
Prompt Injection Risk in Enterprise RAG Systems
Sprinklenet analysis explains how indirect prompt injection threatens enterprise RAG deployments, arriving not through the chat box but through poisoned corpus content — vendor PDFs with hidden white-on-white text, phishing-quoted support tickets, or crawled web pages — that competes with the system prompt once retrieval pulls it into context. The piece recommends architectural defenses: isolating retrieved content from instructions, allowlisting tool calls, tiering source trust, filtering outputs, running an injection evaluation suite, and logging prompts and completions. Details →First reported · updated · 3 reports theregister.com
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security
Noma Security's "GitLost" research demonstrated that GitHub Agentic Workflows (AI agents backed by Claude or Copilot) could be tricked via indirect prompt injection: an unauthenticated attacker posts a crafted issue on a public org repo, and the agent fetches a private repo's README and posts it in a public comment. The PoC used an "Additionally" prefix to bypass guardrails and was disclosed to GitHub with no public patch date noted. Details →First reported nhimg.org
AI browser guardrail bypass exposes a new data theft path
LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session. Details →First reported dailyjus.com
Prompt Injection: Are Invisible Instructions the Next AI Risk in Disputes? – Daily Jus by Jus Mundi
Legal analysts at Greenberg Traurig examine prompt injection as an emerging AI risk in legal disputes, describing how hidden instructions embedded in documents can manipulate AI tools that ingest them into producing skewed or incomplete outputs. The piece contrasts this with AI hallucinations and notes a court has already dealt with the issue. Details →First reported microsoft.com
Defending the Inbox Against Prompt Injection Attacks | Microsoft Community Hub
Microsoft announced a new Microsoft Defender for Office 365 capability that detects and quarantines malicious AI instructions (prompt injection) embedded in email before delivery, aiming to stop indirect prompt injection from reaching Copilot and Microsoft 365 agents. The post cites publicly disclosed research such as Morris II and EchoLeak as evidence that email is a high-volume ingress channel for AI-targeted attacks, describing techniques like white-on-white text, zero-width Unicode, and hidden HTML instructions. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust. Details →First reported medium.com
Your AI Agent Will Leak Your Secrets One Letter at a Time | by Sebastian Buzdugan | Jul, 2026
An explainer by Sebastian Buzdugan describes how AI agents can be tricked into exfiltrating a user's private context-window data — names, employers, hometowns — one letter at a time via outbound URL requests, while the visible reply appears benign. The piece frames the risk around Simon Willison's 'lethal trifecta': an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Details →First reported embracethered.com
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
Johann Rehberger (Embrace The Red) demonstrates a proof-of-concept where an indirect prompt injection hidden in a spreadsheet cell hijacks an LLM-integrated CLI tool to emit ANSI escape codes, which the macOS Terminal app interprets to issue DNS requests that exfiltrate data from other rows. Building on prior Terminal DiLLMa research and David Leadbeater's original finding, the post reports that Apple has fixed the macOS Terminal behavior enabling the DNS-based exfiltration. Details →First reported netwrix.com
What is AI jailbreaking?
Netwrix's cybersecurity glossary entry defines AI jailbreaking as the practice of bypassing safeguards, restrictions, and safety controls built into AI models, and explains techniques including prompt injection, role-playing attacks, indirect prompt injection via external content, gradual context manipulation, and infrastructure-level tampering. Details →First reported bugcrowd.com
One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo) - CrowdStream
A disclosed and now-patched vulnerability in Atlassian Rovo, the default AI assistant across Confluence and other Atlassian products, allowed the `rovoChatPrompt` URL parameter to preload an arbitrary prompt into a victim's Rovo chat. When an authenticated user clicked a crafted link, Rovo executed the embedded prompt as a genuine query, using indirect task-framed language ('help me identify this image') to bypass guardrails and exfiltrate Confluence pages, secrets, and connected-app data (Jira, SharePoint, Outlook) to an attacker host via an image-fetch URL. Atlassian remediated the issue server-side and the reporter validated the fix. Details →First reported wraith.sh
Data Exfiltration via Markdown Images: The Quiet AI Vulnerability
Wraith's attack guide by Anthony D'Onofrio details data exfiltration via markdown image rendering in AI products, where an injected payload (via prompt injection, RAG doc, shared document, or email) causes an LLM to emit a markdown image whose URL embeds secrets like system prompts, conversation history, or API keys; when the chat client renders the markdown, the browser silently fetches the attacker's URL, leaking the data with zero clicks and no visible artifact. The guide notes variants have hit ChatGPT, Microsoft Copilot, GitHub Copilot Chat, Slack AI Assistant, Google Bard, and Claude.ai, and covers four defensive patterns. Details →First reported acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR 2026 paper introduces D-SCAN (Document-level Signal Collapse Analysis), a lightweight detection framework that identifies RAG poisoning attacks by monitoring 'Attention Collapse' — a drop in attention entropy as the generator concentrates on injected adversarial documents. The authors show that output-side signals like perplexity fail because poisoned outputs can exhibit false confidence with even lower perplexity than benign ones, and that D-SCAN detects attacks even when they do not alter the final answer. Code is available at github.com/yingtaoren/D-Scan. Details →First reported google.com
Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation
Google Cloud documentation for the Data Agent Kit extension in the Antigravity IDE describes indirect prompt injection risks from Google Cloud MCP, where locally deployed coding agents running with a user's full privileges can misinterpret attacker-planted data (e.g., in email, calendar, Cloud Storage, or BigQuery) as instructions. The guidance recommends guardrails such as running agents in constrained environments to reduce risk to infrastructure and data. Details →First reported heypinchy.com
AI Email Agents: The Most Dangerous Integration, and How to Contain It
A guide from Pinchy explains why AI email agents are uniquely dangerous, holding two legs of the 'lethal trifecta' (untrusted incoming content plus an outbound exfiltration channel) and susceptible to zero-click indirect prompt injection via crafted HTML emails using hidden text. It cites a demonstrated ChatGPT-agent/Gmail service-side data-leak class and recommends containment such as draft-only defaults and recipient allow-listing. Details →First reported arxiv.org
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
DualView is a defense presented in an arXiv paper that extends untrusted-data tracking from a personal AI agent's context out into the user's environment (file system, shell, network, and other agents) to block indirect prompt injection, including a newly-highlighted 'stored IPI' variant where an agent saves attacker-controlled data and later rereads it as trusted. Deployed as an OpenClaw plugin using only tool hooks, DualView gives each channel an AgentView (untrusted data shown as symbols) and a HumanView (original data), and reportedly blocked every IPI attack on an IPI benchmark and PinchBench while preserving utility. Details →First reported · updated · 2 reports tenetsecurity.ai
Fake Bug Report Hijacks AI Coding Agents at Scale
Tenet Security demonstrated "agentjacking," an indirect prompt-injection technique in which an attacker plants a single fake error report in a public bug-tracking service (Sentry) that hijacks AI coding agents into running attacker-controlled code on a developer's machine. In controlled testing, widely used assistants including Claude Code, Cursor, and Codex retrieved the poisoned error data and, in many cases, executed the code, opening a path to theft of cloud credentials, AWS keys, GitHub tokens, SSH keys, and CI/CD secrets. Details →First reported checkpoint.com
Email Agent Hijacking: The Hidden Threat That Breaks Post-Delivery Security
Check Point describes "Email Agent Hijacking" (EAH), a threat class where attackers embed hidden instructions in email content, signatures, or attachments to manipulate how AI agents summarize, prioritize, or respond to messages before a human ever sees them. The analysis cites the EchoLeak vulnerability in Microsoft Copilot (CVE-2025-32711) as an example of a zero-click attack that manipulated the AI acting on a user's behalf, and argues post-delivery email controls are ineffective when agents act instantly. Details →First reported arxiv.org
MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks
MUZZLE is an automated agentic red-teaming framework, presented in a USENIX Security 2026 paper by researchers from Northeastern University and Mozilla, for evaluating the security of LLM-based web agents against indirect prompt injection attacks embedded in untrusted web content. Muzzle uses agent trajectories to identify high-salience injection surfaces and adaptively generates context-aware malicious instructions, discovering 44 new attacks across 4 web applications, including 3 cross-application prompt injection attacks and an agent-tailored phishing scenario. Details →First reported ainowinstitute.org
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
The AI Now Institute published an exploit brief and PoC (GitHub: Boyan-MILANOV/friendly-fire-ai-agent-exploit) demonstrating remote code execution against Anthropic's Claude Code CLI (auto-mode) and OpenAI's Codex CLI (auto-review) when these defensive coding agents are used to assess third-party or open-source libraries. The attack embeds prompt injections across a library's source code to hijack the AI agent, requiring no hooks, skills, plugins, MCP servers, or config files as an injection vector. Details →First reported 0din.ai
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review. Details →First reported arxiv.org
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
A research paper by Gulshan Saleem and colleagues presents a three-layer middleware framework to defend RAG-based chatbots against both direct and indirect prompt injection, combining input screening, a provenance-based instruction hierarchy during context assembly, and output auditing. Evaluated on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B, the framework reduced Attack Success Rate from 71.4% to 11.3% while maintaining a 4.8% false positive rate and 61.2 ms median latency overhead. Details →First reported microsoft.com
Prompt injection protection in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn
Microsoft documentation describes prompt injection protection built into Microsoft Defender for Office 365, which detects attacker-authored instructions embedded in inbound email (body, subject, quoted replies, attachments, or hidden markup) before that content reaches a user or an AI assistant such as Microsoft 365 Copilot. The feature explains indirect prompt injection techniques including direct instructions to the model and hidden/invisible text (white-on-white fonts, zero-size text, HTML/CSS tricks) and detects them as part of existing mail-flow inspection. Details →First reported · updated · 6 reports noma.security
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
Noma Security researchers demonstrated GitLost, an indirect prompt injection technique that lets an attacker open a normal-looking public GitHub issue to steer GitHub Agentic Workflows into leaking the contents of an organization's private repositories into a public comment. The attack requires no stolen credentials or access, only that the organization's agent has read access across its repos. Details →First reported koreshield.ai
Reproducing an Indirect Prompt Injection Against a RAG Pipeline
A Koreshield write-up reproduces an indirect prompt injection against a RAG customer-support pipeline, where a poisoned knowledge-base document (doc-002) contains a bracketed fake 'system note' instructing the model to dump all retrieved documents and exfiltrate internal tokens with an 'EXFIL::' marker while hiding the action. The author provides runnable code, a public GitHub harness (UncleTeslim/prompt-injection-repro), and real model logs demonstrating the attack against a local Llama3-8B model. Details →First reported arxiv.org
DualView: Preventing Indirect Prompt Injection in Personal AI Agents
DualView is a research system from CompSec Lab @ SNU (arXiv:2607.03821) that defends personal AI agents like OpenClaw against indirect prompt injection, including a variant called 'stored IPI' where attacker-controlled text persists in the user's file system, shell, or network and is re-read later as trusted data. DualView extends untrusted-data tracking from the agent context into the user's environment by maintaining two views (AgentView shows untrusted data as symbols; HumanView preserves originals) and deploys as an OpenClaw plugin using tool hooks; in evaluation on an IPI benchmark and PinchBench it blocked every IPI attack while keeping utility near the unprotected baseline. Details →First reported agentsafelabs.com
Prompt Injection Is Not a Chatbot Problem: How the Attack Surface Changes When Your LLM Has Tools
An explainer arguing that chatbot-era prompt injection defenses (input filtering, output monitoring, instruction hierarchy, adversarial training) fail against agentic systems because injection enters through tools, retrieved documents, memory, API responses, and inter-agent instructions rather than the user message. It frames the issue as a system-architecture and trust-boundary problem rather than a model-tuning one. Details →First reported tabstack.ai
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text. Details →First reported ryandens.github.io
promptblock — block prompt injection in GitHub issues
promptblock is a GitHub tool that scans issue and comment bodies for prompt-injection payloads, specializing in instructions hidden inside HTML comments that GitHub's renderer drops but AI agents reading the raw API text still ingest. It splits bodies into visible and hidden segments, runs a bundled ML classifier, and flags risky content with a label and warning comment. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported archestra.ai