Published file metadata, source observations, indicators, and research history in one bounded catalog.
101Reachable catalog records
3 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_c25d91fa3ad9ae9ac7Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
101 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Last November, while testing Google Bard (now called Gemini) for vulnerabilities, I had a couple of interesting observations when it comes to automatic tool invocation. Confused Deputy - Automatic Tool Invocation First, what do I mean by this… “automatic tool invocation”… Consider the following scenario: An attacker sends a malicious email to a user containing instructions to call an external tool
First reported Feb 23, 2024 06:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Large Language Model (LLM) applications and chatbots are quite commonly vulnerable to data exfiltration. In particular data exfiltration via Image Markdown Injection is quite frequent. Microsoft fixed such a vulnerability in Bing Chat, Anthropic fixed it in Claude, and ChatGPT has a known vulnerability as Open AI “won’t fix” the issue. This post describes a variant in the Azure AI Playground and h
First reported Sep 29, 2023 17:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The AI industry risks repeating the same cultural failures that contributed to the Space Shuttle Challenger disaster: Quietly normalizing warning signs while progress marches forward. The original term Normalization of Deviance comes from the American sociologist Diane Vaughan, who describes it as the process in which deviance from correct or proper behavior or rule becomes culturally normalized.
First reported Dec 05, 2025 02:42 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated. While inspecting the system prompt of Windsurf Cascade I noticed that it has a create_memory tool. Creating Memories The question that immediately popped into my head
First reported Aug 22, 2025 22:21 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post explains an attack chain for the ChatGPT macOS application. Through prompt injection from untrusted data, attackers could insert long-term persistent spyware into ChatGPT’s memory. This led to continuous data exfiltration of any information the user typed or responses received by ChatGPT, including any future chat sessions. OpenAI released a fix for the macOS app last week. Ensure your a
First reported Sep 20, 2024 18:02 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
That’s it. The Month of AI Bugs is done. There won’t be a post tomorrow, because I will be at PAX West. Overview of Posts ChatGPT: Exfiltrating Your Chat History and Memories With Prompt Injection | Video ChatGPT Codex: Turning ChatGPT Codex Into a ZombAI Agent | Video Anthropic Filesystem MCP Server: Directory Access Bypass Via Improper Path Validation | Video Cursor: Arbitrary Data Exfiltration
First reported Aug 31, 2025 01:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few weeks ago Amazon released the Preview of Amazon Q for Business, and after looking at it I found a data exfiltration angle via rendering markdown/hyperlinks and reported it to Amazon. Amazon reacted quickly and mitigated the problem. This post shares further details and how it was fixed. The Problem An Indirect Prompt Injection attack can cause the LLM to return markdown tags. This allows an
First reported Jan 18, 2024 11:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post walks through a sandbox escape from a Flatpak application via PipeWire. The vulnerability was discovered using my automated research pipeline with Claude Code and Opus 4.6 back in April 2026. It was an exciting find, as this was the first bug I submitted to Red Hat. Claude Code was also excited finding this: Once discovered, I repro’d it manually to make sure it’s legit and then submitte
First reported Jul 30, 2026 16:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means. This post assumes that you read the first post about Devin as well. But here is a quick recap: During an indirect prompt injection Devin can be tricked into download malware and extract sensitive information on the machine. But there is more…
First reported Aug 07, 2025 15:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Last November Google had an interesting update to Google Bard. This updated included the ability to solve math equations and draw charts based on data. What does this mean and why is it interesting? It means that Google Bard has access to a computer and can run more complex programs, including Python code that plots graphs! Let’s explore this with a simple example. Drawing Charts with Google Bard
First reported Jan 28, 2024 09:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few months ago I was looking at the filesystem MCP server from Anthropic. The server allows to give an AI, like Claude Desktop, access to the local filesystem to read files or edit them and so forth. I was curious about access control and in the documentation there is a configuration setting to set allowedDirectories, which the AI should be allowed access to: As you can see the example shows two
First reported Aug 03, 2025 08:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently, many of our favorite AI chatbots have gotten autonomous research capabilities. This allows the AI to go off for an extended period of time, while having access to tools, such as web search, integrations, connectors and also custom-built MCP servers. This post will explore and explain in detail how there can be data spill between connected tools during Deep Research. The research is focus
First reported Aug 25, 2025 01:03 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This year I spent a lot of time reviewing, exploiting and working with vendors to fix vulnerabilities in agentic AI systems. As a result, I’m excited to announce the Month of AI Bugs 2025! Goal Of The Initiative The main purpose of the Month of AI Bugs is to raise awareness about novel security vulnerabilities in agentic systems, primarily focusing on AI coding agents. Posts will cover both simple
First reported Jul 28, 2025 17:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Imagine your AI rewriting your personal history… A while ago Google added memories to Gemini. Memories allow Gemini to store user-related data across sessions, storing information in long-term memory. The feature is only available to users who subscribe to Gemini Advanced so far. So, in the fall of last year I chimed in and paid for the subscription for a month to check it out. As a user you can s
First reported Feb 10, 2025 14:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q Developer), which is a very popular coding agent, with over 1 million downloads. It is vulnerable to prompt injection from untrusted data and its security depends heavily on model behavior. At a high level Amazon Q Developer can leak sensitive information from a developer’s machine,
First reported Aug 18, 2025 19:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Agents are becoming extremely effective at finding security vulnerabilities. They are relentless in analyzing code and you can spin up multiple of them to go through source code quickly. given enough agents, all bugs are shallow— Johann Rehberger (@wunderwuzzi23) February 10, 2026 It is an emerging capability that many security researchers and bug bounty hunters have observed over the last year. G
First reported Apr 08, 2026 06:58 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system. Along similar lines, Sysdig recently published a blog on JADEPUFFER, which it assesses to be an agent-driven ransomware capable of adapting in real time. The report does not identify the victim or fully explain how Sysdig obtained visibility into the operation. The Hugging Face disc
First reported Jul 20, 2026 01:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This is the first post in a series exploring security vulnerabilities in Windsurf. If you are unfamiliar with Windsurf, it is a fork of VS Code and the coding agent is called Windsurf Cascade. The attack vectors we will explore today allow an adversary during an indirect prompt injection to exfiltrate data from the developer’s machine. These vulnerabilities are a great example of Simon Willison’s
First reported Aug 21, 2025 09:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Grok is the chatbot of xAI. It’s a state-of-the-art model, chatbot and recently also API. It has a Web UI and is integrated into the X (former Twitter) app, and recently it’s also accessible via an API. Since this post is a bit longer, I’m adding an index for convenience: Table of Contents High Level Overview Analyzing Grok’s System Prompt Prompt Injection from Other User’s Posts Prompt Injection
First reported Dec 16, 2024 12:44 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post we demonstrate how a bypass in OpenAI’s “safe URL” rendering feature allows ChatGPT to send personal information to a third-party server. This can be exploited by an adversary via a prompt injection via untrusted data. If you process untrusted content, like summarizing a website, or analyze a pdf document, the author of that document can exfiltrate any information present in the promp
First reported Aug 01, 2025 15:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The latest Gemini models quite reliably interpret hidden Unicode Tag characters as instructions. This vulnerability, first reported to Google over a year ago, has not been mitigated at the model or API level, hence now affects all applications built on top of Gemini. This includes Google’s own products and services, like Google Jules. Hopefully, this post helps raise awareness of this emerging thr
First reported Aug 15, 2025 09:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today we are going to discuss how real-world tactics, techniques, and procedures (TTPs) apply to computer-use systems, specifically, we’ll look at ClickFix attacks. This demo was part of my presentation at the SAGAI Workshop on May 15th, 2025 in San Francisco. It was a great workshop, with tons of interesting insights and discussions. So, let’s talk about ClickFix, and how it applies to AI systems
First reported May 24, 2025 23:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The Model Context Protocol (MCP) is a protocol definition for how LLM apps/agents can leverage external tools. I have been calling it Model Control Protocol at times, because due to prompt injection, MCP tool servers control the client basically. This post will explain in detail why that is, and I will also share a novel exploit chain. Why MCP - How Is It Different? The main difference to other to
First reported May 02, 2025 19:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.