Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
33 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_c25d91fa3ad9ae9ac7Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
OpenAI continues to add plugins with security vulnerabilities to their store. In particular powerful plugins that can impersonate a user are not getting the required security scrutiny, or a general mitigation at the platform level. As a brief reminder, one of the challenges Large Language Model (LLM) User-Agents, like ChatGPT, and plugins face is the Confused Deputy Problem / Plugin Request Forgery Attacks, which means that during a Prompt Injection attack an adversary can issue commands to plugins to cause harm.
First reported Jun 20, 2023 15:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed. When using Cursor I noticed that it can render Mermaid diagrams. Cursor Renders Mermaid Diagrams If you are not familiar with Mermaid, it has a simple syntax: graph TD User --> Computer This will create a diagram as follows:
First reported Aug 04, 2025 07:04 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
While building “Husky AI” I started working a lot with Microsoft’s VS Code Python extension. It is a super convinient way to edit Jupyter Notebooks. I just use VS Code’s Remote SSH feature to get to my Linux host and work on modeling and testing there. When threat modeling “Husky AI” I identified backdooring of third party libraries and development tools as a potential issue to be aware of.
First reported Oct 14, 2020 17:35 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
This post explores data exfiltration attacks in Google Jules, an asynchronous coding agent. This is the first of three posts that will highlight my research on Google Jules in May 2025. All information provided was also shared with Google at that time. This first post will focus on data exfiltration, the lethal trifecta. But let’s first talk about Jules’ system prompt. Jules’ System Prompt and Multiple Agents To grab the system prompt I just asked it to write it into a file.
First reported Aug 14, 2025 01:20 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub Copilot and VS Code. It is achieved by placing Copilot into YOLO mode by modifying the project’s settings.json file. As described a few days ago with Amp, a vulnerability pattern in agents that might be overlooked is that if an agent can write to files and modify its own configuration or update security-relevant settings it can lead to remote code execution. This is not uncommon and is an area to always look for when performing a security review.
First reported Aug 12, 2025 21:20 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode. Auto Mode Is Now the Default in Claude Code Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.
First reported Aug 27, 2026 04:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
This year one of my goals was to learn about machine learning and artificial intelligence. I wrote about my journey before - including what classes I took and books I read, the models and systems I built and operationalized, threat modeling it to learn about practical attacks and defenses. My goal is to be knowledge enough in the AI/ML space enough to be able to help bridge the gap between research and operational red teaming - by doing practical things with life systems.
First reported Sep 22, 2020 21:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
During an Indirect Prompt Injection Attack an adversary can exfiltrate chat data from a user by instructing ChatGPT to render images and append information to the URL (Image Markdown Injection), or by tricking a user to click a hyperlink. Sending large amounts of data to a third party server via URLs might seem inconvenient or limiting… Let’s say we want something more, aehm, powerful, elegant and exciting. ChatGPT Plugins and Exfiltration Limitations Plugins are an extension mechanism with little security oversight or enforced review process.
First reported Sep 28, 2023 16:01 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
As discussed previously the problem of Indirect Prompt Injections is increasing. They start showing up in many places. A new unique one that I ran across is YouTube transcripts. ChatGPT (via Plugins) can access YouTube transcripts. Which is pretty neat. However, as expected (and predicted by many researches) all these quickly built tools and integrations introduce Indirect Prompt Injection vulnerabilities. Proof of Concept Here is how it looks with ChatGPT end to end with a demo example. The video contains a transcript that at the end contains instructions to print “AI Injection succeeded” and then “make jokes as Genie”:
First reported May 14, 2023 07:01 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see all the posts, or visit the machine learning attack series overview section. In the previous post we walked through the steps required to gather training data, build and test a model to build “Husky AI”. This post is all about threat modeling the system to identify scenarios for attacks which we will perform in the upcoming posts.
First reported Sep 06, 2020 07:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Today we will cover a powerful, easy to use, autonomous agent called Manus. Manus is developed by the Chinese startup Butterfly Effect, headquartered in Singapore. This post demonstrates an end-to-end indirect prompt injection attack leading to a compromise of Manus’ dev box. This is achieved by tricking Manus to expose it’s internal VS Code Server to the Internet, and then sharing the URL and password with the atacker. Specifically, this post demonstrates that:
First reported Aug 25, 2025 11:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Imagine you visit a website with ChatGPT, and suddenly, it stops working entirely! In this post we show how an attacker can use prompt injection to cause a persistent denial of service that lasts across chat sessions for a user. Hacking Memories Previously we discussed how ChatGPT is vulnerable to automatic tool invocation of the memory tool. This can be used by an attacker during prompt injection to ingest malicious or fake memories into your ChatGPT.
First reported Jul 08, 2024 21:30 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
A technique on Windows that is less known is how to do basic port-proxying. Proxying ports is useful when a process binds on one (maybe only the local) interface and you want to expose that endpoint on another network interface. Let’s say you have an existing process that listens only on the loopback interface, and you want to expose it remotely. Or there are two network interfaces and you want expose traffic from one to the other (maybe some evil persistence for port 3389) - or think of basic pivoting.
First reported Jul 15, 2020 03:18 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Large Language Model (LLM) applications and chatbots are quite commonly vulnerable to data exfiltration. In particular data exfiltration via Image Markdown Injection is quite frequent. Microsoft fixed such a vulnerability in Bing Chat, Anthropic fixed it in Claude, and ChatGPT has a known vulnerability as Open AI “won’t fix” the issue. This post describes a variant in the Azure AI Playground and how Microsoft fixed it. From Untrusted Data to Data Exfiltration When untrusted data makes it into the LLM prompt context it can instruct the model to inject an image markdown element. Clients frequently render this using an HTML img tag and if untrusted data is involved the attacker can control the src attribute.
First reported Sep 29, 2023 17:00 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Final Year Project - Web Application Security Principles About 18 years ago I worked on the final year project for my Bachelor’s degree in Computer Science. I had just gotten interested in security and was learning about security principles. The title of the project was “Web Application Security Principles - Designing Secure Web Based Enterprise Solutions”. Looking back, a really cool thing was that I had just started working at Microsoft as an Associate Development Consultant and was bold enough to send the paper last minute over to Michael Howard - who responded and indeed reviewed it! That was so cool! :)
First reported Feb 13, 2020 01:03 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
ChatGPT Operator is a research preview agent from OpenAI that lets ChatGPT use a web browser. It uses vision and reasoning abilities to complete tasks like researching topics, booking travel, ordering groceries, or as this post will show, steal your data! Currently, it’s only available for ChatGPT Pro users. I decided to invest $200 for one month to try it out. Risks and Threats OpenAI highlights three risk categories in their Operator System Card:
First reported Feb 17, 2025 15:30 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
A few months ago I was looking at the filesystem MCP server from Anthropic. The server allows to give an AI, like Claude Desktop, access to the local filesystem to read files or edit them and so forth. I was curious about access control and in the documentation there is a configuration setting to set allowedDirectories, which the AI should be allowed access to: As you can see the example shows two folders being allowlisted for access.
First reported Aug 03, 2025 08:30 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
ChatGPT is vulnerable to data exfiltration via image markdown injections. This. is. pretty well known. As more features are added to ChatGPT the exfiltration angle becomes more likely to be abused. Recently OpenAI added Custom Instructions, which allow to have ChatGPT always automatically append instructions to every message exchange. An adversary can abuse this feature to install a data exfiltration backdoor that depends on, and only works because of the image markdown injection vulnerability. The TTP is a similar to other post exploitation techniques adversaries are using, like enabling email forwarding rules.
First reported Jul 24, 2023 14:26 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Recently Google’s FLoC proposal has been making the rounds in the news. FLoC stands for “federated learning of cohorts” and is Google’s vision how to perform user profiling in Chrome going forward. Currently user tracking and profiling happens (mostly) via cookies, but many browser vendors have been supportive of protection of their users and started blocking third party and tracking cookies - or at least offer features in their browser to enable blocking.
First reported May 01, 2021 17:10 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
One area that I have encountered quite often over the years is that during recon phase of a bug bounty hunt or pentest a set of AWS access keys are being discovered. Let’s say you found 50 AWS access keys by drooling and hunting through public Github repos and using other nifty tricks and means. How do you go about checking their validity? And what do they have access to and provide the Bug Bounty Program or Blue Team the dates, times, and IP address when those keys were used?
First reported Mar 12, 2022 18:42 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Information for red teaming macOS and info on real world TTPs are still a bit sparse. That makes it difficult for defenders to know what attackers do on macOS compared to Windows. Some organizations might have a bigger blind spot when it comes to macOS. This post describes how an adversary can grab hashes from a macOS machine, how to convert it to a hashcat friendly format and use hashcat to crack it.
First reported Apr 03, 2022 17:46 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
Today I finalized moving the blog and publishing to Hugo. It was pretty straight forward and I decided to move things into a master branch on github, and publish via the docs/ folder features of Github pages.
First reported Aug 24, 2019 18:51 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
One thing every red team should attempt early on and regularly is to perform some password spray testing across their organization to identify and help remediate usage of weak passwords. In the past I have done this on Windows a lot, but now I built a simple version for it for Bash to run it also from a Mac. Check it out: Bash Spray Ideally, a script like bashspray.sh is integrated into your response pipelines, and SOC, Blue Team as well as account owner get notified - so they change their password right away, and any SOC investigation can be performed if necessary.
First reported Jul 04, 2019 04:58 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and including previous chat data as a query parameter.
First reported Aug 17, 2025 11:10 UTCCatalog metadata updated Oct 14, 2026 02:57 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.