Attributed metadata history
Up to 100 retained publisher events per page for 5c354469c1fea8d206dedf3dc0af398d54f5605517a316c90fd677cc4f9b50bf. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:04 UTC
In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and including previous chat data as a query parameter.
Fingerprint: 200829c98c1619ce1dd0ce25fa4508b060e4dbc4c3322534e694750d880b2fc1
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:03 UTC
available
Fingerprint: 0a2f1bebc7ea800736eafab237a0ddecfb8797a02d23951e8aa80935e2f3446f