Published file metadata, source observations, indicators, and research history in one bounded catalog.
101Reachable catalog records
5 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_c25d91fa3ad9ae9ac7Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
101 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
This is a writeup of my DEF CON Singapore talk that walks through vulnerabilities and exploits in M365 Copilot and Consumer Copilot. I disclosed these to Microsoft last year. MSRC assigned CVE-2026-24299 and the issues are now patched. Contents This turned out to be a long post, covering the 45 minute talk. I added an index page, so you know what’s in here. The talk had a more demos by the way, bu
First reported May 04, 2026 13:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This is a security advisory for a data leakage and exfiltration vulnerability in a popular, but now deprecated and unmaintained, Slack MCP Server from Anthropic. If you are using this MCP server, or run an “MCP Store” that hosts it, it is advised that you analyze how this threat applies to your use case and apply a patch as needed. Anthropic’s Slack MCP Server When Anthropic introduced MCP they pu
First reported Jun 24, 2025 23:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently Google Bard got some powerful updates, including Extensions. Extensions allow Bard to access YouTube, search for flights and hotels, and also to access a user’s personal documents and emails. So, Bard can now access and analyze your Drive, Docs and Gmail! This means that it analyzes untrusted data and will be susceptible to Indirect Prompt Injection. I was able to quickly validate that Pr
First reported Nov 03, 2023 19:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post we will look at Amp, a coding agent from Sourcegraph. The other day we discussed how invisible instructions impact Google Jules. Turns out that many client applications are vulnerable to these kinds of attacks when they use models that support invisible instructions, like Claude. Invisible Unicode Tag Characters Interpreted as Instructions We have talked about hidden prompt injections
First reported Aug 16, 2025 19:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today let’s explore Devin’s system prompt a bit more. Specifically, an interesing tool that I discovered when reading through it. Hidden in Devin’s capabilities is a tool that can open any local port to the public Internet. That means, with the right indirect prompt injection nudge, Devin can be tricked into publishing sensitive files or services for anyone to access.
First reported Aug 08, 2025 07:02 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.