#prompt-injection
-
A structural flaw in MCP lets malicious prompts spread between AI agents
Ars Technica warns that MCP, the protocol increasingly used for AI agents to talk to one another, carries trust gaps that let malicious prompts travel from one agent to the next.
-
Security vs. “safety”: why AI agents keep escaping their sandboxes
Martin Alderson argues that the leading AI labs have confused security with model “safety” — and that this is exactly why their agents broke out of the sandbox.
-
GuardBreaker: hackers hide a nuclear-weapons prompt in their code to fool AI analysts
The pro-Russian group UAC-0099 embedded provocative text in a malicious script, designed to trip the safety mechanisms of language models and derail automated analysis.
-
A Prompt Injection Hidden in a Court Filing
Bruce Schneier flagged a curious case: hidden instructions had been embedded in the text of a court document, addressed not to the judge but to an artificial intelligence.
-
AI agents installed “unowned” code inside corporate networks because of llms.txt files
Researchers in Israel found 227 commands across the documentation of more than a hundred sites that install packages and domains owned by no one. Coding agents like Claude, Codex and Hermes dutifully ran them — including inside Fortune 500 companies.
-
Vulnerability in Amazon's Kiro AI Editor Allows Data Theft via Prompt Injection
Researchers at Mindguard have shown how a malicious repository can force the agentic development environment Kiro to quietly send local data to an external server — without a single command from the user.
-
Encryption Slips Past Grok's Defenses: The Chatbot Leaks User Data
Researchers at Adversa have shown that simply encrypting a malicious instruction is enough to slip past Grok's protective filters and get it to steal a user's chat history. xAI was told about the problem back in June, but as of publication the vulnerability was still working.
-
CoSnitch: One Click Steals Data from Copilot Personal
Varonis Threat Labs has disclosed three vulnerabilities in the consumer version of Microsoft Copilot: following a crafted link let attackers silently siphon off emails, files and chat history from connected services. Microsoft shipped a fix on August 18, 2026.
-
GhostSplice: How a Command Broken Into Pieces Makes an AI Agent Steal Secrets
Researchers at ASSET Research Group have shown that a malicious MCP server can coax out SSH keys and .env files even when the agent refuses a direct request to steal them — all it takes is to splinter the instruction into harmless fragments.
-
Atlassian's Rovo assistant taught to leak Jira and Confluence data to attackers
Two research teams independently showed how a prompt injection can make the corporate Rovo AI assistant gather data available to the user and send it to a stranger's server. Atlassian has already closed one of the vulnerabilities.
-
“Ask AI”: How Website Buttons Quietly Poison Chatbot Memory
A new kind of prompt injection needs neither malicious code nor stolen passwords. It abuses a standard feature of every major AI assistant — prefilled links.
-
Opus 5 Is More Resistant to Prompt Injection
Anthropic's new model posted the best result on the IPI benchmark, outperforming both previous versions of Claude and all of its competitors. But it's still impossible to fully defend against prompt injections.
-
The Worm in the Document: How an Attack Self-Propagates Through Copilot in Word
A researcher has shown that instructions hidden inside a document can make Copilot for Word quietly alter figures in reports and copy malicious code into new files, turning them into carriers of the infection. Over 144 days, Microsoft was still unable to close the vulnerability.
-
An Invisible Pull-Request Comment Turns an AI Reviewer Agent into a Spy
A single hidden HTML comment in Azure DevOps can redirect a developer's AI agent into other people's projects and quietly siphon out their data. The cause: a forgotten safeguard in Microsoft's official MCP server.
-
OpenAI Unveils GPT-Red — Automated Hunting for Prompt Injection Vulnerabilities
OpenAI has revealed details about GPT-Red — an internal model for automated red-teaming that hunts for vulnerabilities to prompt injection attacks before tools are rolled out at scale.
-
Ghostcommit: a PNG-hidden prompt injection fools AI agents and steals secrets
Researchers have demonstrated Ghostcommit, an image-hidden prompt injection that makes an AI agent read a .env file and exfiltrate a repository's secrets.