Published file metadata, source observations, indicators, and research history in one bounded catalog.
101Reachable catalog records
1 / 5Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_c25d91fa3ad9ae9ac7Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
101 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
During an Indirect Prompt Injection Attack an adversary can exfiltrate chat data from a user by instructing ChatGPT to render images and append information to the URL (Image Markdown Injection), or by tricking a user to click a hyperlink. Sending large amounts of data to a third party server via URLs might seem inconvenient or limiting… Let’s say we want something more, aehm, powerful, elegant and
First reported Sep 28, 2023 16:01 UTCCatalog metadata updated Oct 08, 2026 03:55 UTCOpen evidence record
Recently Google published a blog about detecting browser data theft using Windows Event Logs. There are some good points in the post for defenders on how to detect misuse of DPAPI calls attempting to grab sensitive browser data. But, what about the Remote Debugging feature? This made me curious to revisit the state of the remote debugging feature of browsers for grabbing sensitive information, inc
First reported May 16, 2024 08:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents. AWS Kiro was vulnerable to arbitrary command execution via indirect prompt injection. This means that a remote attacker, who controls data that Kiro processes, could hijack it to run arbitrary operating system commands or write and run custom code. In particular two
First reported Aug 26, 2025 14:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub Copilot and VS Code. It is achieved by placing Copilot into YOLO mode by modifying the project’s settings.json file. As described a few days ago with Amp, a vulnerability pattern in agents that might be overlooked is that if an agent can write to fil
First reported Aug 12, 2025 21:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Building reliable prompt injection payloads is challenging at times. It’s this new world with large language model (LLM) applications that can be instructed with natural language and they mostly follow instructions… but not always. Attackers have the same challenges around prompt engineering as normal users. Prompt Injection Exploit Development Attacks always get better over time. And as more feat
First reported Mar 03, 2024 06:25 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
In this post, we explore how ChatGPT generated an adversarial image that hijacked my Claude Opus 4.7 to invoke the memory tool and persist false memories for future chats. This matters because Opus 4.6+ is genuinely a lot harder to attack than previous models, but it still fell for a ChatGPT generated image. A trick that works well with reasoning models is to challenge them with puzzles. Indirect
First reported Apr 17, 2026 23:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
OpenAI recently introduced a memory feature in ChatGPT, enabling it to recall information across sessions, creating a more personalized user experience. However, with this new capability comes risks. Imagine if an attacker could manipulate your AI assistant (chatbot or agent) to remember false information, bias or even instructions, or delete all your memories! This is not a futuristic scenario, t
First reported May 22, 2024 19:24 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Earlier this month I had the opportunity to present at Ekoparty 2023 about Prompt Injections in the Wild, and the video of the talk was just posted to YouTube. Check it out. It starts with a basic overview of LLMs and then dives deep into exploits and mitigations across various LLM applications and chatbots, including (but not limited) to demos of exploits with Bing Chat, ChatGPT, Anthropic Claude
First reported Nov 29, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
The Amazon Q Developer VS Code Extension (Amazon Q) is a popular coding agent, with over 1 million downloads. The extension is vulnerable to indirect prompt injection, and in this post we discuss a vulnerability that allowed an adversary (or also the AI for that matter) to run arbitrary commands on the host without the developer’s consent. The resulting impact of the vulnerability is the same as C
First reported Aug 19, 2025 21:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post is about prompt-based command and control (C2), which is becoming more relevant. What is Promptware-Powered C2? Three years ago, when ChatGPT introduced the browsing tool, we already experimented with the idea of prompt-based command and control. And when ChatGPT got memories we showed that this can be combined and abused for a full command and control channel. Recent work uses the term
First reported Mar 17, 2026 03:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
What I like about the rapid advancements and excitement about AI over the last few years is that we see a resurgence of the testing discipline! Software testing is hard, and adding AI to the mix does not make it easier at all! Google AI Studio - Initially not vulnerable to data leakage via image rendering When Google released AI Studio last year I checked for the common image markdown data exfiltr
First reported Apr 07, 2024 23:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces. Naturally, I had to try it. Background AI labs like OpenAI and Anthropic send reasoning traces back and forth as part of their messaging protocols. However, the actual reasoning text is hidden inside an encrypted,
First reported Aug 17, 2026 03:06 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post describes vulnerability in Microsoft 365 Copilot that allowed the theft of a user’s emails and other personal information. This vulnerability warrants a deep dive, because it combines a variety of novel attack techniques that are not even two years old. I initially disclosed parts of this exploit to Microsoft in January, and then the full exploit chain in February 2024. A few days ago I
First reported Aug 27, 2024 00:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This post highlights how the GitHub Copilot Chat VS Code Extension was vulnerable to data exfiltration via prompt injection when analyzing untrusted source code. GitHub Copilot Chat GitHub Copilot Chat is a VS Code Extension that allows a user to chat with source code, refactor code, get info about terminal output, or general help about VS Code, and things along those lines. It does so by sending
First reported Jun 15, 2024 05:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Today we have another post about OpenHands from All Hands AI. It is a popular agent, initially named “OpenDevin”, and recently the company also provides a cloud-based service. Which is all pretty cool and exciting. Prompt Injection to Full System Compromise However, as you know, LLM powered apps and agents are vulnerable to prompt injection. That also applies to OpenHands and it can be hijacked by
First reported Aug 10, 2025 11:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Last week Leon Derczynski described how LLMs can output ANSI escape codes. These codes, also known as control characters, are interpreted by terminal emulators and modify behavior. This discovery resonates with areas I had been exploring, so I took some time to apply, and build upon, these newly uncovered insights. ANSI Terminal Emulator Escape Codes Here is a simple example that shows how to rend
First reported Dec 06, 2024 16:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
This week was HackSpaceCon 2024. It was the first time I attended and it was fantastic. The conference was at the Kennedy Space Center! Yes, right there and the swag and talks matched the world class location. The keynote “Buckle up! Let’s make the world a safer place” was by Dave Kennedy, who provided great insights on attacker strategies of the past and present, the importance of active threat h
First reported Apr 14, 2024 01:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
When the Model Context Protocol (MCP) came out it reminded me of the Common Object Model (COM) from Microsoft. COM has been around for decades and it’s used for programming, scripting, sharing of functionality at a binary/object level across languages and hosts. Via DCOM all of this can even be done remotely, and well, it’s also useful for red teaming. A lot of software on Windows was/is implement
First reported Jun 09, 2025 05:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
I added a couple of features and improvements to ASCII Smuggler, including: Optional rendering of the BEGIN and END Unicode Tags when crafting hidden text Added a feature to URL decode the input before checking for hidden text Output Modes for Decoding: Switch between highlighting the hidden text amongst the regular content, or only showing the hidden text in the output The selected options are re
First reported Mar 04, 2024 16:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Recently, Anthropic added the capability for Claude’s Code Interpreter to perform network requests. This is obviously very dangerous as we will see in this post. At a high level, this post is about a data exfiltration attack chain, where an adversary (either the model or third-party attacker via indirect prompt injection) can exfiltrate data the user has access to. The interesting part is that thi
First reported Oct 28, 2025 15:36 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Your Code Interpreter sandbox, also known as Advanced Data Analysis sessions, are shared between private and public GPTs. Yes, your actual compute container and its storage is shared. Each user gets their own isolated container, but if a user uses multiple GPTs and stores files in Code Interpreter all GPTs can access (and also overwrite) each others files. This is true also for files uploaded/crea
First reported Feb 14, 2024 11:30 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI. This is a vulnerability discovered in Windsurf Cascade, it follows invisible instructions. This means there can be instructions in a file or result of a tool call that the developer cannot see, but the LLM does. Some LLMs interpret invisible Unicode Tag characters as instructions, which can lead to hidden pr
First reported Aug 23, 2025 23:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
About a year ago we talked about how developers can’t intrinsically trust LLM responses and common threats that AI Chatbots face and how attackers can exploit them, including ways to exfiltrate data. One of the threats is unfurling of hyperlinks, which can lead to data exfiltration and is something often seen in Chatbots. So, let’s shine more light on it, including practical guidance on how to mit
First reported Apr 03, 2024 04:00 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
Last year, Jun Kokatsu disclosed an interesting vulnerability with ChatGPT Operator by exploiting a race condition. I was wondering if I could reproduce this attack chain, and this post describes the results of that research. I had this post drafted for months, and yesterday at the Real-world AI security conference I included a video demo of this attack in my talk and that reminded me that I shoul
First reported Jun 25, 2026 12:20 UTCCatalog metadata updated Oct 08, 2026 03:44 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.