PuzzleMask embeds policy-violating payloads in plain prose, bypassing LLM gatekeeper models at 100% rate while target models extract and execute hidden instructions in 94% of trials. The technique wraps malicious prompts in ordinary prose that gatekeeper LLMs classify as safe. Target models with reasoning capability and code interpreters extract and act on the payload. Gatekeeper bypass rate was 100% across all tested models; target execution rate was 94.4%.
Prompt Injection
38 posts
PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - Check Point Research The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - Check Point Research A shared JFrog Artifactory metadata endpoint let ChatGPT code-execution containers from different accounts read and write each other's item properties, enabling cross-account data theft via connected apps like Gmail. ChatGPT code-execution containers share an internal JFrog Artifactory instance for package installation. The Artifactory Item Management API exposed annotate and read operations using credentials from environment variables, without per-account isolation. Properties written by one account's container were readable by another's, creating a bidirectional covert channel exploitable via prompt injection in shared conversations or custom GPTs to exfiltrate data from connected apps.
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower CVE-2026-24301 (CoSnitch) is a critical vulnerability chain in Microsoft Copilot Personal that allows automatic prompt execution via crafted URLs. The chain enables silent data exfiltration from connected OAuth services and persistent memory poisoning via indirect prompt injection through web summarization. The vulnerability was discovered using a technique called meta-hacking, where the AI was manipulated into revealing its own undocumented parameters.
From Black Hat to DEF CON: 10 Hacker Summer Camp Standouts Researchers at DEF CON 2026 released CloudBasher, a toolkit that abuses CloudShell IAM design weaknesses across AWS, Azure, and GCP to automate environment discovery and deploy persistent workloads. Separately, indirect prompt injection via MCP was demonstrated as a method to turn blocked WAF requests into malicious instructions for AI agents. Threat actor trial abuse and education sector breaches were also discussed.
The OWASP Top 10 for LLM Applications 2026: From Model Risks to Agentic Security | Akamai The OWASP Top 10 for LLM Applications 2026 refines and reprioritizes existing AI security risks to reflect the industry shift toward agentic AI systems. LLM03 (Excessive Agency) and LLM08 (Hidden Context Exposure) receive greater prominence as AI models increasingly interact with enterprise systems, invoke tools, and execute business workflows. The article emphasizes AI reconnaissance as a critical early-stage attack behavior where attackers map application capabilities, tool schemas, and permissions before launching targeted prompt injection or unauthorized tool exploitation.
RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data Varonis Threat Labs disclosed a Parameter-to-Prompt (P2P) vulnerability in Atlassian Rovo where a crafted URL using the rovoChatPrompt parameter injects attacker instructions directly into a user's trusted Rovo Chat session. Rovo's federated access across Atlassian products and connected SaaS platforms, combined with the ResearchAgent tool's ability to browse and post to arbitrary external websites, created a one-click data exfiltration chain requiring no jailbreak or guardrail bypass. Atlassian fixed the vulnerability after responsible disclosure via Bugcrowd.
Shadow AI, Rogue Agents, and Data Leaks: A Special Report on Navigating AI Risk Akamai's special SOTI report highlights how rapid enterprise AI adoption is expanding the threat surface through shadow AI usage, unmanaged browser/IDE extensions, and autonomous AI agents. Key findings include that 47% of enterprise AI conversations use personal accounts, 75% of AI browser extensions request high/critical permissions, and novel techniques like CometJacking and CursorJacking demonstrate how prompt injection and rogue extensions can compromise AI-driven workflows. Legacy security tools including DLP solutions are not designed to detect data exposure through AI prompts and unstructured interactions.
Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human Elastic Security Labs built an AI-powered vulnerability triage system for their HackerOne bug bounty program that uses Claude LLM in an eight-stage analysis pipeline with an independent adversarial review, achieving 85% agreement with human analysts at ~$2 per report. The system processes untrusted, attacker-controlled input at every stage, making prompt injection, credential exfiltration, and sandbox escape the primary threats to the triage infrastructure itself. A layered defense-in-depth architecture — ephemeral VMs, network isolation, egress filtering, credential separation, resource limits, and human-in-the-loop final decisions — mitigates these risks while keeping the cost per triage low.
From Recon to Free Flights: Precision Prompt Attacks on AI Agents The article details a precision prompt injection attack methodology against AI agents, using a fictional travel agent called 'Varda' as a case study. The attack follows a kill chain approach: reconnaissance to extract system prompt logic, enumerate tools, and learn data schemas; then weaponization to craft a fake payment confirmation that satisfies the agent's preconditions for booking flights. The core vulnerability is that the LLM treats conversation history as trusted context, allowing attackers to inject fabricated tool responses and fake assistant messages that bypass sequential validation checks, enabling unauthorized action execution without proper authorization.
AI Security Report 2026 The Check Point Research AI Security Report 2026 highlights the transition of AI from an attack assistant to a live attack operator. Threat actors are now using AI to build deployment-ready malware, run live intrusions, and scale social engineering attacks using forged virtual identities. The report also notes a significant rise in indirect prompt injection attacks and persistent enterprise data leakage through GenAI applications.
CrowdStrike Uncovers New Prompt Injection Techniques CrowdStrike's AI security research team has expanded its prompt injection taxonomy with 18 new techniques, bringing the total to over 200. Five techniques are detailed: Trigger-Activated Rule Addition (dormant instructions activated by triggers), Cognitive Token Suppression (blocking safety-related terms), Algorithmic Payload Decomposition (fragmenting payloads to evade filters), Special Token Injection (mimicking internal model delimiters), and Unwitting User Delivery (social engineering users into submitting malicious prompts). These techniques highlight that prompt injection has evolved beyond simple jailbreaks to include delayed activation, boundary spoofing, and composite attacks targeting AI agents with tool-access capabilities.
Q2 2026 Attack Techniques Trend Report The Q2 2026 trend report from AhnLab ASEC documents a significant expansion of attack surfaces into AI stacks, identity infrastructure, and public-facing applications. CISA KEV listings rose 27% year-over-year to 75 entries, with ransomware-linked vulnerabilities nearly doubling. Notable developments include prompt injection-to-RCE chains in Microsoft Semantic Kernel, data exfiltration via M365 Copilot Enterprise (SearchLeak), three Microsoft Defender zero-days used for telemetry evasion, and continued AI supply chain attacks via malicious skills. The report recommends shifting from signature-based to behavior-based detection and implementing ITDR, conditional access, and AI-specific input validation controls.
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox SentinelLABS identified macOS.Gaslight, a DPRK-aligned Rust backdoor targeting macOS systems. The implant establishes a resilient C2 channel via the Telegram Bot API using AES-GCM over pinned TLS and achieves persistence via a masqueraded LaunchAgent. Notably, it embeds a 38-message prompt-injection payload designed to feed fabricated system errors to LLM-assisted triage tools, aiming to abort or corrupt automated analysis. The malware also stages a standalone Python environment to execute a credential and data stealer.
AI Reconnaissance: The Missing Layer in Chatbot Security Researchers identified a critical gap in AI chatbot security where assistants leak operational context, such as tool access and boundaries, through benign reconnaissance queries. This leaked information allows attackers to bypass static model guardrails and craft highly targeted prompt injections, highlighting the need for dynamic runtime protection.
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners An npm package named shai_hulululud was discovered utilizing adversarial techniques to disrupt AI-assisted malware scanners. The package employs prompt injection, safety-triggering content, and context flooding via millions of tokens to cause LLM-based analysis tools to fail, truncate, or refuse processing before reaching the obfuscated JavaScript payload.
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search (CVE-2026-42824). By chaining Parameter-to-Prompt (P2P) injection, an HTML rendering race condition, and a Server-Side Request Forgery (SSRF) via Bing's image search, attackers could exfiltrate sensitive organizational data via a single malicious link.
Shai-Hulud: Miasma, Hades, & AI Scanner Evasion | ThreatLabz The Shai-Hulud software supply chain campaign has significantly evolved, expanding from npm to PyPI and shifting from maintainer compromise to CI/CD abuse. Recent waves demonstrate advanced techniques including OIDC token scraping to bypass SLSA provenance, IDE configuration file weaponization, and prompt injection designed to evade LLM-based security scanners.
The sorry state of skill distribution Security researchers successfully bypassed multiple AI agent skill scanners, including ClawHub, Cisco's skill-scanner, and skills.sh integrations, using techniques like file truncation, embedded payloads, Python bytecode poisoning, and prompt injection. The findings highlight that automated scanning of AI agent skills is fundamentally flawed due to the complex mix of natural language, code, and limited scanner context windows, necessitating a shift towards curated, trusted skill repositories.
Agentic Governance: Why It Matters Now Autonomous AI agents introduce significant security risks by operating within trust boundaries using delegated credentials, effectively bypassing traditional perimeter defenses. Effective security requires "agentic governance," focusing on strict identity management, granular action-level permissions, approval gates for high-risk operations, and comprehensive logging to mitigate threats like prompt injection and scope creep.
- 6 minWeekly Recap — 2026-05-11 -> 2026-05-18
Developer Supply Chains Under Siege as Edge Device Exploits Surge The dominant narrative this week is the coordinated weaponization of the software supply chain, as threat actors like TeamPCP and Mini Shai-Hulud aggressively target developer tools to steal cloud credentials. Because these attackers compromise trusted build systems like GitHub Actions, a single malicious package—such as the compromised TanStack libraries—can cascade into massive downstream breaches, allowing criminals to hold development environments hostage and even deploy destructive dead-man switches if their access is cut off. In parallel, attackers are bypassing traditional network defenses by exploiting internet-facing edge devices and logging in with stolen credentials. Threat clusters are actively exploiting critical flaws in Cisco Catalyst SD-WAN and Microsoft Exchange, while ransomware groups like The Gentlemen and state-sponsored actors like Secret Blizzard use these footholds to live off the land, hijacking legitimate IT tools to stay hidden for months. These trends together suggest that perimeter-focused defenses and basic patching are no longer sufficient. Organizations must immediately isolate their CI/CD pipelines from cloud credentials, enforce phishing-resistant multi-factor authentication on all internet-facing systems, and assume that trusted vendor tools may already be compromised.
- 19 minCross-Service Credential Replay: Operator Targets Hypervisor Using Harvested LLM Endpoint Secrets
A single IP harvested strings from an LLM emulator's responses (`.env`, model list, MCP manifest) and replayed them as Proxmox credentials, chat-completions parameters, and MCP tool-call names against the same host — a token-reuse feedback loop, not blind brute-force. 22 of 24 credential pairs are byte-for-byte traceable to served response bodies.
Inside the lethal trifecta: Blast radius reduction in AI agent deployments AI agents deployed in enterprise environments are highly susceptible to indirect prompt injection attacks, enabling data theft and unauthorized actions. Security teams must adopt an 'assume breach' architecture for LLMs, focusing on blast radius reduction through agent sandboxing, credential isolation, egress restrictions, and human-in-the-loop governance.
Intelligence Center Generative AI enables defenders to rapidly deploy highly adaptive honeypots that simulate complex environments like Linux shells or IoT devices. By leveraging LLMs to generate plausible responses to attacker inputs, organizations can deceive automated AI-driven attacks, shifting the defensive strategy from passive detection to active manipulation and intelligence gathering.
The API Weak Spot: Study Shows AI Is Compounding Security Pressures A recent Akamai study reveals that API security incidents are escalating, exacerbated by the rapid adoption of AI technologies like LLMs. Organizations are struggling with API visibility and governance, leading to increased susceptibility to BOLA attacks, business logic abuse, and prompt injection, which bypass traditional WAFs and result in significant financial losses.
Emerging Enterprise Security Risks of AI The rapid adoption of agentic AI in enterprise environments introduces significant security risks by amplifying existing software supply chain and identity management vulnerabilities. Threat actors can leverage prompt engineering, input manipulation, and malicious packages to weaponize AI agents, necessitating zero-trust principles, robust IAM for non-human identities, and human-in-the-loop safeguards.
Deep Dive into Architectural Vulnerabilities in Agentic LLM Browsers Agentic LLM browsers introduce novel architectural vulnerabilities by bridging traditional web sandboxes with highly privileged AI agents. Attackers can exploit trusted origin models via XSS or prompt injection to hijack these agents, enabling unauthorized browser control, data exfiltration, and local file access.
When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications Unit 42 researchers demonstrated a red-teaming methodology against Amazon Bedrock's multi-agent applications, highlighting the risks of prompt injection in orchestrated AI systems. By systematically bypassing agent guardrails, attackers can extract sensitive instructions, map tool schemas, and invoke integrated tools with malicious inputs, though built-in Bedrock Guardrails effectively mitigate these threats.
A Look Inside Claude's Leaked AI Coding Agent The source code for Anthropic's Claude Code CLI was accidentally exposed through .map files in a public npm release. This leak reveals the internal architecture, permission models, and safety guardrails of the AI agent, potentially allowing attackers to craft targeted prompt injections or distribute tampered dependencies through unofficial repositories.
The Top 10 Threats Related to Agent Skills Anthropic's new 'Agent Skills' feature, which uses progressive disclosure to manage AI agent context windows, introduces a novel attack surface. The article outlines the top 10 critical threats to this ecosystem, including prompt injection, supply chain manipulation, and unauthorized code execution, highlighted by the recent OpenClaw malware incident.
Secure Homegrown AI Agents with CrowdStrike Falcon AIDR and NVIDIA NeMo Guardrails CrowdStrike has announced the integration of Falcon AI Detection and Response (AIDR) with NVIDIA NeMo Guardrails to secure enterprise AI agents against runtime attacks. The solution provides programmable guardrails to prevent prompt injection, data exposure, and unauthorized actions by applying over 75 built-in classification rules to LLM interactions.
The Agentic Security Crisis: Why You Need to Act Now The proliferation of autonomous AI agents like OpenClaw has introduced severe security risks, including unauthorized data access and silent exfiltration via prompt injection and malicious plug-ins. To mitigate these threats, organizations must transition from local agent deployments to hardened, isolated cloud environments utilizing defense-in-depth strategies such as kernel-level eBPF monitoring and runtime prompt interception.
Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models Unit 42 researchers demonstrated that both open and closed-source LLMs remain vulnerable to prompt jailbreaking at scale using a genetic algorithm-based fuzzing technique. By systematically generating meaning-preserving variants of disallowed requests, researchers successfully bypassed content filters and model guardrails, highlighting the fragility of current AI safety mechanisms under automated adversarial variation.
Auditing the Gatekeepers: Fuzzing "AI Judges" to Bypass Security Controls Unit 42 researchers developed AdvJudge-Zero, an automated fuzzer that identifies stealthy prompt injection sequences to bypass AI judges. By using low-perplexity formatting tokens, attackers can manipulate LLM-based security gatekeepers into approving harmful content or corrupting training data without triggering traditional detection mechanisms.
TrendAI™ at [un]prompted 2026: From KYC Exploits to Agentic Defense TrendAI researchers demonstrated novel attack vectors against AI systems, including exploiting AI-driven KYC pipelines using 'executable documents' to leak customer data. Additionally, they introduced FENRIR, an automated vulnerability hunting system that has discovered numerous zero-days in AI and Model Context Protocol (MCP) ecosystems.
Unauthorized AI Agent Execution Code Published to OpenVSX in Aqua Trivy VS Code Extension Malicious versions of the Aqua Trivy VS Code extension were published to the OpenVSX registry, containing unauthorized code that hijacks locally installed AI coding assistants. By using carefully crafted natural language prompts and permissive execution flags, the payload instructs the AI agents to harvest sensitive developer credentials and system data, subsequently attempting to exfiltrate the information via available communication channels or by creating a new GitHub repository.
Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild Adversaries are actively exploiting web-based Indirect Prompt Injection (IDPI) to manipulate Large Language Models (LLMs) and AI agents. By embedding hidden or obfuscated instructions within benign web content, attackers can coerce AI systems into performing unauthorized actions such as data destruction, SEO poisoning, and bypassing content moderation when the AI processes the webpage.
Using threat modeling and prompt injection to audit Comet Trail of Bits conducted an adversarial audit of Perplexity's Comet browser, discovering prompt injection vulnerabilities that allowed the exfiltration of private user data, such as Gmail emails. By leveraging techniques like fake system instructions, fake security mechanisms, and user impersonation, attackers could manipulate the AI assistant into accessing authenticated sessions and transmitting sensitive information to external servers via URL parameters.
Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails A joint research project by SentinelLABS and Censys discovered a massive, unmanaged network of over 175,000 publicly exposed Ollama instances. Many of these self-hosted AI models possess tool-calling and vision capabilities, creating significant security risks such as resource hijacking, prompt injection, and identity laundering through residential proxy abuse.
