All news with #prompt injection attack tag

🔒 Check Point Research disclosed that a single hidden instruction placed in a ChatGPT conversation could cause the model to perform covert tasks for an attacker while responding normally. In the proof of concept, ChatGPT read a user's connected Gmail and passed data to another ChatGPT account via a hidden channel, without the visible reply revealing the transfer. The channel exploited an internal package cache service used by containers to exchange metadata, effectively turning it into a shared clipboard between isolated conversations. OpenAI confirmed the internal service was taken offline after disclosure.

🔒 Edge AI shifts model execution, model IP, and sensitive data onto infrastructure the customer owns and operates, changing who must verify the stack before assets are released. This requires organizations to establish trust in runtimes, artifacts, and the environment through attestation, provenance, and evidence-based release. Mediation, hardware-rooted attestation, and constrained action patterns help reduce risks from tampering, prompt injection, and runtime theft.

🛡️ Microsoft researchers observed a high-volume phishing campaign that used invisible Unicode tag characters (U+E0000–U+E007F) — a technique popularized in AI prompt-injection research as ASCII smuggling — to split finance lure words and evade email filters. The activity spiked on February 9, 2026, and persisted on weekdays for about three months before declining. Microsoft Defender for Office 365 telemetry shows most messages were caught by layered protections rather than a single Unicode-specific signal. The tactic leverages invisible tag characters to disrupt tokenization and literal keyword matching, making it harder for ML/NLP-based filters to detect phishing lures.

🛡️ A coalition led by OpenAI warns AI will rapidly accelerate cyberattacks, shrinking the window to remediate long-standing weaknesses. The open letter, backed by over 100 tech and security firms including Microsoft, Google, and AWS, urged leaders to prioritize high-risk fixes and provide defenders with cyber-capable AI. The group emphasizes execution of existing security practices and coordinated industry-government action.

🔍 I had the impression that trying to game legal filings in any way was a bad idea. I think Mr Elliott will have some hurdles when trying to address the court (any court) in future. Employment in a legal profession might also face head winds.

🛡️ Researchers disclosed a vulnerability in Amazon Kiro IDE (version 0.7.45 on Windows) that enables data exfiltration via prompt injection and manipulated Kiro Powers. Mindguard reported that attacker-controlled repository content and steering files can influence the agent to read and transmit sensitive local data when a malicious workspace file is opened and any message is sent to the agent. Amazon issued a remediation in Kiro IDE 0.8.140; the latest release is 1.0.337.

🔒 Security researchers demonstrated that an AI email summarizer can be tricked into reading hidden content different from what a user sees. Forcepoint X‑Labs embedded invisible HTML in emails that remained hidden in Outlook but were passed to an LLM-driven summarizer, allowing prompt-injection instructions to alter summaries silently. Their proof-of-concept showed consistent manipulation of invoice dates and omitted names across repeated tests, highlighting risks when untrusted email content is fed to models without guardrails. Forcepoint recommends extracting only visible content, detecting hidden styling, separating headers from body, and validating AI summaries against source material.

🛡️ Check Point introduces contextual AI protection that evaluates an agent’s full activity—intent, encountered information, prior actions and applicable policy—to prevent harmful or unauthorized outcomes before they execute. Traditional controls detect isolated risks like prompt injection or data exposure, but contextual protection links multi-step behavior to identify dangerous outcomes that no single rule would catch. Running in production, it enforces decisions in about 50 ms to block data leaks, unauthorized uploads, destructive commands and improper permission changes without slowing agents.

🛡️ Researchers describe InjecMEM, an attack that plants hidden instructions in an AI agent’s memory with a single, ordinary prompt, causing the agent to reuse malicious content in future responses. The method targets memory systems that store past interactions, distinguishing itself from prompt injection by persisting across sessions. Evaluations on MemoryOS and MemGPT show high retrieval and attack success rates, exposing gaps in defenses that focus only on immediate inputs and outputs.

🎙️ Smashing Security episode 481 features Graham Cluley with guest Jenny Radcliffe discussing recent social engineering incidents and emerging AI risks. They cover a prank call targeting UK PM Andy Burnham, the timing and effectiveness of social engineering, and demonstrations from Black Hat where researchers jailbroke a Unitree Go2 Pro robot dog using Google’s Gemini via kinetic prompt injection. The episode also notes other industry news and sponsor messages.

🛡️ Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal that could allow a single click on a crafted link to run prompts and pull data from connected apps within a victim's authenticated session. The issues — collectively named CoSnitch and tracked as CVE-2026-24301 — rely on an undocumented URL parameter pairing (autorun=1 and q) to trigger automatic prompt execution and data exfiltration. Microsoft received the report in December 2025 and shipped patches on August 18, 2026.

🧠 Security researchers at Anthropic and EPFL demonstrated self‑propagating payloads that can transfer between autonomous agents via editable system prompt files. Released as a preprint on August 10, 2026, the tests used simulated multiagent coding collaborations and OpenClaw‑style agent chains, and found no evidence of successful spread in the wild. A simple one‑line warning in an agent's system prompt reduced propagation to near zero, and evolutionary attempts to bypass that warning on Claude Haiku 4.5 failed to produce multi‑hop strains.

🔒 The Model Context Protocol (MCP) enables AI agents to access tools and data across enterprise systems, but the MCP server often stores credentials, tokens and keys that can expose an organization if mishandled. Common risks include plaintext config files, credential sprawl, prompt injection, over-permissioning and untrusted exposed servers. Mitigations include centralizing secrets, using short-lived credentials, enforcing least privilege, human approval for sensitive actions, end-to-end encryption, thorough logging and inventorying MCP servers.

🔒 July 2026 saw a marked uptick in cyber incidents, with weekly attacks averaging 2,336 per organization and ransomware victims rising sharply. Education, Latin America, and Business Services were among the most affected, while GenAI use exposed sensitive data through risky prompts. Email remained a primary entry point as organizations confront multi-vector threats and growing operational exposure.

🛡️ Researchers from Tracebit report that embedding prompt injections alongside secrets stored on AWS can disrupt AI hacking agents by triggering LLM guardrails. These injected prompts instruct the model to perform forbidden actions, causing the LLM to shut down or stop following prior commands—a technique the researchers call context bombing. The approach succeeds only when attackers use models with built-in safety filters; locally run or unguarded models remain unaffected.

🛡️ Researchers at DEF CON 34 demonstrated a one-click prompt-injection attack called “RovoBlast” that abused Atlassian’s enterprise AI assistant Rovo by injecting malicious instructions via the rovoChatPrompt parameter. The exploit allowed a single click to make Rovo accept attacker-supplied parameters in a user session, potentially exposing data across connected services like Slack, Microsoft 365, Google Workspace, Jira, and Confluence. Varonis reported the issue through Bugcrowd and Atlassian has issued a fix, while researchers urged limiting Rovo’s access and disabling unneeded automation.

🛡️ Two security teams found ways to make Atlassian's Rovo assistant exfiltrate data a signed-in user can access. One method used a malicious file with hidden instructions to induce Rovo to gather Jira or Confluence content and send it to an attacker-controlled URL; PromptArmor disclosed this on August 5, 2026 and its remediation status after publication is unconfirmed. The second, dubbed RovoBlast by Varonis, preloads attacker instructions via a rovoChatPrompt URL parameter so a single click from an authenticated user could cause data to be sent out; Atlassian fixed this server-side on July 8, 2026. Both issues rely on data the signed-in user can reach, and administrators can limit exposure by restricting which apps and groups can use Rovo and tightening connector permissions.

🔎 New prompt-injection tactics hide in common "Ask AI" deep links on marketing and comparison pages. These pre-filled queries open a user's active ChatGPT, Claude, Gemini, or Grok session and can instruct the model to persistently mark a vendor's domain as a trusted source without consent. Microsoft catalogued the behavior as AI Recommendation Poisoning in Feb 2026; it appears across many industries and is tracked in MITRE ATLAS as Memory Poisoning. Detecting and preventing it requires DOM inspection, memory audits, and treating such links as risky.

🛡️ Research from Cisco Talos and CrowdStrike shows cybercriminals increasingly use AI to write code, manage infrastructure, and accelerate exploitation. Recovered prompts and tooling reveal attackers bypass model guardrails, switch to uncensored models, and embed malicious prompts in shared files to hijack LLM assistants. Supply-chain attacks against AI components and rapid exploitation after PoC releases further magnify risk, while authentication systems and cloud environments see rising compromise.

🛡️ The Open Worldwide Application Security Project (OWASP) released the third edition of its Top 10 for LLM Applications on August 4, 2026, again ranking prompt injection as the top security concern despite relatively few recorded incidents. The report emphasizes designing systems assuming instruction boundaries will be bypassed and constraining model outputs. Other key risks highlighted include sensitive information disclosure, excessive agency, misinformation and unbounded consumption, with recommended mitigations such as access controls, tool minimization, grounding outputs and quota/sandboxing strategies.