Published file metadata, source observations, indicators, and research history in one bounded catalog.
101Reachable catalog records
2 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_c25d91fa3ad9ae9ac7Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
101 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
There is a lot of talk about Skills recently, both in terms of capabilities and security concerns. However, so far I haven’t seen anyone bring up hidden prompt injection. So, I figured to demo a Skills supply chain backdoor that survives human review. Additionally, I also built a basic scanner, and had my agent propose updates to OpenClaw to catch such attacks. Attack Surface Skills introduce comm
First reported Feb 11, 2026 13:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post explores data exfiltration attacks in Google Jules, an asynchronous coding agent. This is the first of three posts that will highlight my research on Google Jules in May 2025. All information provided was also shared with Google at that time. This first post will focus on data exfiltration, the lethal trifecta. But let’s first talk about Jules’ system prompt. Jules’ System Prompt and Mul
First reported Aug 14, 2025 01:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In the previous post, we explored two data exfiltration vectors that Jules is vulnerable to and that can be exploited via prompt injection. This post takes it further by demonstrating how Jules can be convinced to download malware and join a remote command & control server. This research was performed in May 2025 and findings were shared with Google. Remote Command & Control - Proof Of Concept The
First reported Aug 14, 2025 11:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
GitHub Copilot has the capability to be augmented with custom instructions coming from the current repo, via the .github/copilot-instructions.md file. Pillar Security recently highlighted the risks associated with rules files. Their post discusses custom Cursor rules in ./cursor/rules ending in .mdc. If you watch the demos, you’ll notice that they also have a GitHub Copilot demo which uses the Git
First reported Apr 07, 2025 03:11 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Part of my default test cases for coding agents is to check how MCP integration looks like, especially if the agent can be configured to allow setting fine-grained controls for tools. Sometimes there are basic security controls missing. Especially when running an agent on your local computer. Stakes are much higher. And it seems important to empower users to be able to configure which actions an A
First reported Aug 28, 2025 19:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Google Colab AI, now just called Gemini in Colab, was vulnerable to data leakage via image rendering. This is an older bug report, dating back to November 29, 2023. However, recent events prompted me to write this up: Google did not reward this finding, and Colab now automatically puts Notebook content (untrusted data) into the prompt. Let’s explore the specifics. Google Colab AI - Revealing the S
First reported Jul 25, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Last week Google released an IDE called Antigravity. It’s basically the outcome of the Windsurf licensing deal from a few months ago, where Google paid some $2.4 billion for a non-exclusive license to the code. Because it’s based on Windsurf, I was curious if vulnerabilities that I reported to Windsurf back in May 2025, long before the deal, would have been addressed in the Antigravity IDE. See Mo
First reported Nov 25, 2025 13:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
During the Month of AI Bugs, I described an emerging vulnerability pattern that shows how commonly agentic systems have a design flaw that allows an agent to overwrite its own configuration and security settings. This allows the agent to break out of its sandbox and escape by executing arbitrary code. My research with GitHub Copilot, AWS Kiro and a few others demonstrated how this can be exploited
First reported Sep 24, 2025 19:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
You are likely aware of ASCII Smuggling via Unicode Tags. It is unique and fascinating because many LLMs inherently interpret these as instructions when delivered as hidden prompt injection, and LLMs can also emit them. Then, a few weeks ago, a post on Hacker News demonstrated how Variant Selectors can be used to smuggle data. This inspired me to take this further and build Sneaky Bits, where we c
First reported Mar 13, 2025 00:21 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Microsoft’s Copilot Studio is a powerful, easy-to-use, low-code platform that enables employees in an organization to create chatbots. Previously known as Power Virtual Agents, it has been updated (including GenAI features) and rebranded to Copilot Studio, likely to align with current AI trends. This post discusses security risks to be aware of when using Copilot Studio, focusing on data leaks, un
First reported Jul 30, 2024 17:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently, I found what appeared to be a regression or bypass that again allowed data exfiltration via image rendering during prompt injection. See the previous post here for reference. Data Exfiltration via Rendering HTML Image Tags During re-testing, I had sporadic success with markdown rendering tricks, but eventually, I was able to drastically simplify the exploit by asking directly for an HTML
First reported Aug 22, 2024 02:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today we cover ChatGPT Codex as part of the Month of AI Bugs series. ChatGPT Codex is a cloud-based software engineering agent that answers codebase questions, executes code, and drafts pull requests. In particular, this post will demonstrate how Codex is vulnerable to prompt injection, and how the use of the “Common Dependencies Allowlist” for Internet access enables an attacker to recruit ChatGP
First reported Aug 02, 2025 07:31 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering of markdown images from untrusted domains in the chat box. This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by reading sensitive data (e.g.
First reported Aug 27, 2025 15:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
LiteLLM is a popular AI gateway. It provides a unified interface to LLMs and simplifies governance. It also has access to the backend LLM provider keys. All of that makes it a high-value target. Not only for IP and data theft, but also for response modification and tool invocation. This post walks through a set of TTPs that red teams can integrate into authorized operations to demonstrate reroutin
First reported Aug 03, 2026 16:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode. Auto Mode Is Now the Default in Claude Code Auto Mode r
First reported Aug 27, 2026 04:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Five years ago I gave a Lightning Talk at the 35th Chaos Communication Congress called “Pass the Cookie and Pivot to the Clouds”. It was a talk about my very first blog post on Embrace The Red just a few weeks earlier in December 2018. Fast forward to 2023… it was great to attend the 37C3 in person in Hamburg this year. The Congress was packed with great talks, amazing people, awesome events and s
First reported Dec 30, 2023 23:01 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A couple of weeks ago hidden prompt injections were discovered and we covered it at the time. This video explains it in more detail, and also highlights implications beyond hiding instructions, including what I call ASCII Smuggling. This is the usage of Unicode Tags Block characters to both craft and deciper hidden messages in plain sight.
First reported Feb 13, 2024 01:11 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
OpenAI seems to have implemented some mitigation steps for a well-known data exfiltration vulnerability in ChatGPT. Attackers can use image markdown rendering during prompt injection attacks to send data to third party servers without the users’ consent. The fix is not perfect, but a step into the right direction. In this post I share what I figured out so far about the fix after looking at it bri
First reported Dec 20, 2023 10:35 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed. When using Cursor I noticed that it can render Mermaid diagrams. Cursor Renders Mermaid Diagrams If you are not familiar with Mermaid, it has a simple syntax: graph TD User --> Computer This will create a diagram as follows:
First reported Aug 04, 2025 07:04 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Imagine you visit a website with ChatGPT, and suddenly, it stops working entirely! In this post we show how an attacker can use prompt injection to cause a persistent denial of service that lasts across chat sessions for a user. Hacking Memories Previously we discussed how ChatGPT is vulnerable to automatic tool invocation of the memory tool. This can be used by an attacker during prompt injection
First reported Jul 08, 2024 21:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Large Language Model (LLM) applications and chatbots are quite commonly vulnerable to data exfiltration. In particular data exfiltration via Image Markdown Injection is frequent. This post describes how Google Cloud’s Vertex AI - Generative AI Studio had this vulnerability that I responsibly disclosed and Google fixed. A big shout out to the Google Security team upfront, it took 22 minutes from re
First reported Oct 19, 2023 13:35 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few days ago Riley Goodside posted about an interesting discovery on how an LLM prompt injection can happen via invisible instructions in pasted text. This works by using a special set of Unicode code points from the Tags Unicode Block. The proof-of-concept showed how a simple text contained invisible instructions that caused ChatGPT to invoke DALL-E to create an image. Hidden Instructions for L
First reported Jan 15, 2024 07:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
As part of the Month of AI Bugs, serious vulnerabilities that allow remote code execution via indirect prompt injection were discovered. There was a period of a few weeks where multiple arbitrary code execution vulnerabilities existed in popular agents, like GitHub Copilot, Amazon Q, AWS Kiro,… During that time I was wondering if it would be possible to write an AI virus. Hence the idea of AgentHo
First reported Aug 30, 2025 03:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few weeks ago while waiting at the airport lounge I was wondering how other Chatbots, besides ChatGPT, handle hidden Unicode Tags code points. A quick reminder: Unicode Tags code points are invisible in UI elements, but ChatGPT was able to interpret them and follow hidden instructions. Riley Goodside discovered it. What about Anthropic Claude? While waiting for a flight I figured to look at Anth
First reported Feb 08, 2024 10:01 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.