Published file metadata, source observations, indicators, and research history in one bounded catalog.
101Reachable catalog records
4 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_c25d91fa3ad9ae9ac7Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
101 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Today we cover Devin AI from Cognition, the first AI Software Engineer. We will cover Devin proof-of-concept exploits in multiple posts over the next few days. In this first post, we show how a prompt injection payload hosted on a website leads to a full compromise of Devin’s DevBox. GitHub Issue To Remote Code Execution By planting instructions on a website or GitHub issue that Devin processes, i
First reported Aug 06, 2025 08:01 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
At Black Hat Europe I did a fun presentation titled SpAIware and More: Advanced Prompt Injection Exploits. Without diving into the details of the entire talk, the key point I was making is that prompt injection can impact all aspects of the CIA security triad. However, there is one part that I want to highlight explicitly: A Command and Control system (C2) that uses prompt injection to remote cont
First reported Jan 07, 2025 04:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio. This post is a write up about the talk, which covered CVE-2026-65669, a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft. So, make sure your installations are up-to-date. The slides of the presentation can be found here. BlueHat Asia 2026 in
First reported Sep 30, 2026 21:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Last week I saw this paper from OpenAI called “Preventing URL-Based Data Exfiltration in Language-Model Agents”, which goes into detail on new mitigations they’ve added. This is a great read. I like this transparency. Initial Disclosure in 2023 Nearly three years ago I reported the zero-click data exfiltration exploit to OpenAI. Back in early 2023 OpenAI did not have a bug bounty program, so commu
First reported Feb 05, 2026 06:59 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Another day, another AI data exfiltration exploit. Today we talk about OpenHands, formerly referred to as OpenDevin. It’s created by All-Hands AI. The OpenHands agent renders images in chat, which enables zero-click data exfiltration. Simon Willison recently gave this data exfiltration attack pattern a great name: Lethal Trifecta. We discuss this specific image based attack technique frequently. S
First reported Aug 09, 2025 10:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June. The vulnerability allowed an attacker to hijack Claude Code via indirect prompt injection and leak sensitive information from the developer’s machine, e.g. API keys, to external servers by issuing DNS requests. Prompt Injection Hijacks Claude When reviewing or interacting with untrusted code or process
First reported Aug 11, 2025 11:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The Amazon Q Developer VS Code Extension (Amazon Q) is a very popular coding agent, with over 1 million downloads. In previous posts we showed how prompt injection vulnerabilities in Amazon Q could lead to: Exfiltration of sensitive information from the user’s machine , and also to a System compromise by running arbitrary code Today we will show how an attack can leverage invisible Unicode Tag cha
First reported Aug 20, 2025 11:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In the previous post we demonstrated how instructions embedded in untrusted data can invoke ChatGPT’s memory tool. The examples we looked at included Uploaded Files, Connected Apps and also the Browsing tool. When it came to the browsing tool we observed that mitigations were put in place and older demo exploits did not work anymore. After chatting with other security researchers, I learned that t
First reported May 29, 2024 03:57 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few days ago, Anthropic released Claude Computer Use, which is a model + code that allows Claude to control a computer. It takes screenshots to make decisions, can run bash commands and so forth. It’s cool, but obviously very dangerous because of prompt injection. Claude Computer Use enables AI to run commands on machines autonomously, posing severe risks if exploited via prompt injection. Discl
First reported Oct 25, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
About two weeks ago, DeepSeek released a new AI reasoning model, DeepSeek-R1-Lite. The news quickly gained attention and interest across the AI community due to the reasoning capabilities the Chinese lab announced. However, whenever there is a new AI I have ideas… Apps That Hack Themselves - The 10x Hacker There are some cool tests that can be done when pentesting LLM-powered web apps, I usually t
First reported Nov 29, 2024 22:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently OpenAI added an additional memory feature called “chat history”, which allows ChatGPT to reference past conversations. The details of the implementation are not known. The documentation highlights that: “It uses this to learn about your interests and preferences, helping make future chats more personalized and relevant.” I decided to spend some time to figure out how it works. Update: Vid
First reported May 05, 2025 06:24 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently, OpenAI announced gpt-4o-mini and there are some interesting updates, including safety improvements regarding “Instruction Hierarchy”: OpenAI puts this in the light of “safety”, the word security is not mentioned in the announcement. Additionally, this The Verge article titled “OpenAI’s latest model will block the ‘ignore all previous instructions’ loophole” created interesting discussion
First reported Jul 22, 2024 13:14 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files. That was the case with Amp, an agentic coding tool built by Sourcegraph. The AI coding agent could update its own configuration and: Allowlist bash commands or Add a malicious MCP server on the fly to run arbitrary code This could have been exploited by th
First reported Aug 05, 2025 13:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Happy to share that I authored the paper “Trust No AI: Prompt Injection Along The CIA Security Triad”. You can download it from arxiv. The paper examines how prompt injection attacks can compromise Confidentiality, Integrity, and Availability (CIA) of AI systems, with real-world examples targeting vendors like OpenAI, Google, Anthropic and Microsoft. It summarizes many of the prompt injection exam
First reported Dec 24, 2024 00:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use
First reported Aug 17, 2025 11:10 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
I regularly look at how the system prompts of chatbots change over time. Updates frequently highlight new features being added, design changes that occur and potential areas that might benefit from more security scrutiny. A few months back I noticed an interesting update to the M365 Copilot (BizChat) system prompt. In particular, there used to be one enterprise_search tool in the past. You might r
First reported Jan 03, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post is part of a series about machine learning and artificial intelligence. Adversaries often leverage supply chain attacks to gain footholds. In machine learning model deserialization issues are a significant threat, and detecting them is crucial, as they can lead to arbitrary code execution. We explored this attack with Python Pickle files in the past. In this post we are covering backdoor
First reported May 18, 2024 23:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
When OpenAI released GPTs last month I had plans for an interesting GPT. Malicious ChatGPT Agents The idea was to create a kind of malware GPT that forwards users’ chat messages to a third party server. It also asks users for personal information like emails and passwords. Why would this be possible end to end? ChatGPT cannot guarantee to keep your conversation private or confidential, because it
First reported Dec 13, 2023 02:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This is a follow-up to my previous Terminal DiLLMa research, and there is a positive outcome: Apple fixed a macOS Terminal behavior that enabled a DNS-based data exfiltration technique. DNS Requests via ANSI Escape Codes David Leadbeater originally discovered an interesting behavior in the macOS Terminal app that allowed a special sequence of ANSI escape codes to issue DNS requests. In short, this
First reported Jul 16, 2026 09:13 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Google’s NotebookLM is an experimental project that was released last year. It allows users to upload files and analyze them with a large language model (LLM). However, it is vulnerable to Prompt Injection, meaning that uploaded files can manipulate the chat conversation and control what the user sees in responses. There is currently no known solution to these kinds of attacks, so users can’t impl
First reported Apr 15, 2024 15:11 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today we will cover a powerful, easy to use, autonomous agent called Manus. Manus is developed by the Chinese startup Butterfly Effect, headquartered in Singapore. This post demonstrates an end-to-end indirect prompt injection attack leading to a compromise of Manus’ dev box. This is achieved by tricking Manus to expose it’s internal VS Code Server to the Internet, and then sharing the URL and pas
First reported Aug 25, 2025 11:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
It was great to attend the 39C3 - Power Cycles in Hamburg this year. The Chaos Communication Congress was once again packed with great talks, amazing people, awesome events and side quests - and I even got to present! You can watch the talk with translation options on media.ccc.de. I also uploaded the English version to the Embrace The Red YouTube channel. I hope it’s interesting and helpful. The
First reported Dec 31, 2025 05:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post, we’ll look how an adversary can mint authentication cookies for Next.js (next-auth/Auth.js) applications to maintain persistent access to the application as any user. The reason this is important is because of React2Shell, which is a deserialization vulnerability that allows an adversary to run arbitrary code. Much has been discussed about this vulnerability, and you can read up the
First reported Jan 15, 2026 06:58 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
ChatGPT Operator is a research preview agent from OpenAI that lets ChatGPT use a web browser. It uses vision and reasoning abilities to complete tasks like researching topics, booking travel, ordering groceries, or as this post will show, steal your data! Currently, it’s only available for ChatGPT Pro users. I decided to invest $200 for one month to try it out. Risks and Threats OpenAI highlights
First reported Feb 17, 2025 15:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.