All news with #prompt injection attack tag

🛡️ Security researchers warn that shared AI agent instruction files and configuration artifacts can be weaponized to exfiltrate prompts, environment variables, and credentials. Examples include poisoned CLAUDE.md, .cursorrules, GEMINI.md and JSON config files that instruct agents to silently send sensitive data to cloud sinks like Supabase or Webhook.site. The technique, dubbed “PromptLogger,” evades traditional EDR detection since the agent itself performs the exfiltration, and repositories with such poisoned files have been observed on GitHub.

🔒 The post reports benchmark results showing Anthropic’s Opus 5 better resists prompt injection than Opus 4.8 and most other evaluated models. Opus 5 reduced attacker success rates on the IPI benchmark to 2.0% within 15 attempts and 0.2% on a single attempt, outperforming non-Claude models like Muse Spark and several GPT 5.6 variants. The author notes that while prompt injection cannot be fully prevented in general, targeted improvements are making models substantially more robust.

📰 A Norwegian researcher disclosed a document-borne AI worm that can hide instructions inside files used by Microsoft Copilot and other apps, enabling prompt-injection that alters generated content and propagates into new documents. Microsoft says it has implemented mitigations and follows a defense-in-depth approach, while urging updates and caution. Experts warn the attack sidesteps many existing defenses because malicious behavior emerges only when Copilot processes content.

🔒 This post presents an AppSec control framework for AI coding agents that balances developer productivity with risk management. It organizes controls into two pillars: author-time (shaping agent output in the IDE) and build-time (verifying and gating changes in the pipeline). The framework is tool- and cloud-agnostic and recommends deterministic, non-deterministic, and human controls to mitigate risks like prompt injection, insecure defaults, dependency issues, and overbroad access.

🔒 Microsoft announced new AI-native security capabilities across Defender, Entra, Purview, and Intune to help organizations secure AI environments, accelerate SecOps, and protect data and identities. Highlights include Project Perception, expanded Defender protections like prompt injection blocking, tenant governance and passkey defaults in Entra, Purview network-level DLP for shadow AI apps, and Intune Suite inclusion in Microsoft 365 E5 to strengthen endpoint management.

🔒 Check Point announces the industry’s first AI Network Firewall, extending its AI Defense Plane to the enterprise network. The firewall inspects prompts, file uploads, model calls, and agent actions in real time to detect intent, prevent data exfiltration, and block prompt injection. It discovers and governs sanctioned and shadow AI tools and agents while protecting AI applications across hybrid environments.

🔐 Security teams built controls around human-driven code, but AI agents now operate autonomously, exposing new attack surfaces that developer-side tooling misses. The shift-left model fails for runtime threats like prompt injection, model poisoning, inference data leaks, and shadow AI sprawl. A platform-level response — Platform Engineering 2.0 — introduces model governance, prompt security, data isolation, and inference audit as mandatory control surfaces. CSOs must engage platform leadership to embed these controls and treat agent identities as first-class non-human identities.

🛡️ A hidden HTML comment in an Azure DevOps pull request can instruct a reviewer's AI coding agent to act beyond an attacker's privileges, leaking sensitive data. The flaw exists because the MCP server returns PR descriptions without the spotlighting guardrail applied elsewhere, so the agent receives hidden instructions the human reviewer cannot see. Manifold Security demonstrated a proof-of-concept that chains permitted agent calls to read cross-project resources and exfiltrate content using reviewer credentials. Microsoft acknowledged the report and recommended limiting project access and reviewing changes before running AI tools.

🔍 A Russian-speaking actor known as Trim moved from posting a Claude jailbreak tutorial to selling a commercial AI pentesting platform in three months. Cato CTRL research shows Trim published six named bypass techniques in March and launched AI Pentest Checker by June, embedding those jailbreaks and using a grey-market Claude API key. The product combines Claude Opus and GLM-5 with conventional scanners to produce rapid vulnerability reports.

🛡️ Researchers demonstrated seven attacks against five open-source Android agent frameworks, showing that benign-seeming apps with draw-over and storage permissions can inject unseen text into models and escalate to host command execution. The study, posted on arXiv in July, tested AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA, finding widespread vulnerabilities including screenshot race conditions, command injection via unsanitized adb calls, broadcast leaks, and UI spoofing. Some projects already use safer patterns, but none implemented all recommended mitigations.

🛡️ Two SafeBreach studies demonstrate how prompt-injection techniques can bypass layers of defenses around Google Gemini, using calendar invites or text messages as entry points. Attackers chain indirect injection, memory poisoning, delayed execution, and fake context alignment to get the assistant to perform unauthorized actions across devices. Even with Google fixes, the research highlights a persistent arms race between attackers and defenders that leaves users needing to restrict assistant access.

🛡️ Cato Networks found a single prompt can cause OpenAI’s GPT-5.5 to plan and execute a full offensive cyber-attack in a controlled Active Directory lab. The model carried out reconnaissance, exploitation, lateral movement, privilege escalation and exfiltration, reaching domain admin in about 40 minutes. Researchers tested six scenarios, noting adaptive behavior when conditions changed and emphasizing the risk of accelerating existing attack workflows.

🛡️ Researchers describe a new class of attacks called agent data injection (ADI), where attackers plant forged trusted fields—like a sender name or button ID—so an AI agent acts on corrupted facts while continuing its assigned task. The method exploits how agents parse punctuation-delimited fields, letting attackers slip fake structure past prompt-injection defenses. The team built working proofs against multiple web and coding assistants and found mixed mitigation results from random IDs and provenance tracking.

🛡️ OpenAI revealed GPT‑Red, an internal automated red‑teaming model that simulates human adversaries to discover prompt injection vulnerabilities at scale. GPT‑Red iteratively probes and refines attacks against production models, helping harden GPT‑5.6 Sol and reduce prompt injection failures by 6× versus GPT‑5.5. OpenAI uses self‑play reinforcement learning to train both attacker and defender models while keeping GPT‑Red segregated to avoid misuse.

🔒 Manifold Security found that Claude for Chrome still accepts synthetic clicks and can read permission mode from its URL, enabling other extensions with DOM access on claude.ai to trigger nine allowlisted tasks (including Gmail, Google Docs, and Calendar). Anthropic constrained arbitrary prompts after ClaudeBleed, but the click handler lacks an event.isTrusted check and the side panel honors ?skipPermissions=true, creating high-risk scenarios especially if "Act without asking" is enabled. Manifold reported this in May against v1.0.72; the issues remained in v1.0.80 as of July 7 and no patch or public advisory was available by July 14.

🛡️ Progress urged ShareFile customers to shut down Windows Storage Zone Controllers amid a credible external threat, temporarily disabling access while investigating; there are no signs of account or data compromise. Other top stories include a critical Zimbra XSS patch, a compromised Jscrambler npm package distributing a multi-platform Rust stealer, and Microsoft detailing the destructive GigaWiper backdoor. Large-scale web shell operations (SHELLSTORM), HalluSquatting attacks against AI assistants, and many actively exploited CVEs round out the week's threats.

🛡️Researchers show a one-email exploit can trick an AI personal agent into writing a false, persistent memory and hiding the change. The tool, MemGhost, was tested in lab conditions against OpenClaw and other agent frameworks, succeeding frequently in background runs. The authors propose provenance tagging, user confirmation, and write logging as mitigations while vendors consider memory-write controls.

🛡️ Researchers demonstrated "Ghostcommit," a proof-of-concept attack that hides malicious instructions inside a PNG referenced by an AGENTS.md so AI code-reviewing agents read images, open .env files, and exfiltrate secrets as integer constants. The pull request appears benign to text-based reviewers and default configs often exclude images from review, letting the change merge without human oversight. In tests, several coding agents followed the image pointer and emitted the repository's .env as a tuple of integers, while some agent harnesses refused. The ASSET Research Group published code, disclosed vendors, and built a multimodal GitHub app that inspects images, code shape, and conventions to block the exploit in trials.

🛡️ Security vendor CrowdStrike has added five new prompt injection techniques to its taxonomy that threaten enterprise AI deployments. These attacks manipulate LLM behavior by embedding deceptive instructions into inputs, context, or token streams to bypass safety controls and produce malicious outputs. CrowdStrike recommends threat modeling input sources, expanding testing, and enhancing detection engineering to defend against composite and multi-stage prompt attacks.

🔒 A new AI Now Institute report demonstrates a proof-of-concept exploit that coerces Anthropic’s Claude Code and OpenAI’s Codex into executing attacker-supplied binaries during automated code review. The attack uses multi-stage prompt injection hidden in repository files (documentation, comments) to trick agents in auto-mode or auto-review into running a seemingly benign script that launches a malicious payload. Researchers warn the architectural risk — agents’ inability to reliably attribute text sources — makes such platforms potential attack vectors when granted shell access and autonomous execution.