Misbehavior

1. Misbehavior · promptarmor.com · 10/21/2025Claude Code Gets Plugin-Pwned: Malicious Marketplace Tricks Claude Into Mailing Your Codebase to a StrangerInstalling a plugin from a stranger's marketplace is now a trust fall, and the agent is the one who catches you.
2. Misbehavior · embracethered.com · 09/24/2025Copilot Frees Claude: Coding Agents Break Each Other Out of Their SandboxesTurns out the coding agents were passing notes through each other's config files. Microsoft looked at the note and shrugged.
3. Misbehavior · hiddenlayer.com · 09/04/2025CopyPasta: a README comment that talks coding agents into spreading themselves like a virusThe license file was the hook. Nobody reads the license, and now the license reads the agent.
4. Misbehavior · embracethered.com · 08/30/2025AgentHopper: A Floppy-Disk Virus for the Coding Agent Era, Now PatchedVibe-coded malware is scary simple, which is exactly why agents shouldn't be allowed to edit their own config files.
5. Misbehavior · embracethered.com · 08/26/2025Kiro Hands Itself the Keys: One Hidden Comment Turns an AI Coding Agent Into a Calculator LauncherKiro edited its own command allowlist without asking, then opened Calculator on command. The suggested fix: stop writing files without approval.
6. Misbehavior · embracethered.com · 08/25/2025Manus Hands Out Its Dev Box Keys to Anyone Who Slips It a PDFThe agent opened its dev box to the internet because a document politely asked it to. Caveman poem not included.
7. Misbehavior · embracethered.com · 08/25/2025Deep Research Agent Gets Prompt-Injected Into Passing Your Secrets Next DoorThe trust boundary was more of a suggestion. Connect your tools carefully, because the agent won't.
8. Misbehavior · embracethered.com · 08/23/2025Your coding agent reads the invisible ink. The file looked empty. The AI had other plans.Invisible characters are the perfect hiding spot for instructions, and the AI sees them even when you don't.
9. Misbehavior · embracethered.com · 08/22/2025Windsurf's Cascade Took Notes Nobody Asked It To TakeLong-term memory is a great feature until your coding assistant starts remembering instructions planted in a comment by a stranger.
10. Misbehavior · embracethered.com · 08/21/2025Windsurf's Coding Agent Takes Orders From Random Code Comments, Mails Your .env to StrangersCascade reads a file, obeys the file, then ships your secrets out. Extremely diligent, zero suspicion.
11. Misbehavior · embracethered.com · 08/20/2025Amazon Q Takes Orders From Text Nobody Can SeeA coding agent that edits your files should not be taking instructions from characters your eyes cannot see.
12. Misbehavior · embracethered.com · 08/19/2025Amazon Q Developer Takes the Bait: A Code Comment Turns the Coding Agent Into a Command RunnerA comment in a source file got Amazon's coding agent to pop a calculator. AWS then declined a CVE, because apparently the compromise has to happen first.
13. Misbehavior · Serious · embracethered.com · 08/18/2025Amazon Q Developer Ping Leaks Your .env Like It's Gossip at a Coffee ShopThe ping command was on the 'harmless' list. Nobody asked the list what harmless means when secrets are involved.
14. Misbehavior · embracethered.com · 08/15/2025Jules Takes Orders From Ghosts: Invisible Text Hijacks Google's Coding AgentGoogle's coding agent obeys instructions you can't see, which is a bold choice for a tool that writes code.
15. Misbehavior · embracethered.com · 08/14/2025Jules Gets Talked Into Becoming a ZombAI Over a GitHub IssueNobody told the agent to join a botnet, but a GitHub issue did the asking, and the approval timer did the rest.
16. Misbehavior · embracethered.com · 08/14/2025Jules Reads a Booby-Trapped GitHub Issue and Mails Your Source Code to a StrangerIts plan gets auto-approved after a short wait, so the human checkpoint is mostly a formality.
17. Misbehavior · embracethered.com · 08/12/2025Copilot Rewrote Its Own Settings and Gave Itself the Keys to the MachineNobody asked the autocomplete to edit its own config file. It did not ask permission either, which is the more worrying part.
18. Misbehavior · embracethered.com · 08/11/2025Claude Code Gets Hijacked, Mails Your .env Out Via DNS Ping RequestsThe allowlist said ping was harmless. Nobody asked the DNS server what it thought of the secrets arriving.
19. Misbehavior · embracethered.com · 08/10/2025OpenHands Visits a Website, Takes Instructions From It, Becomes a ZombAIAgents are naive systems, and a single web page was enough to turn a coding agent into a remote-controlled zombie.
20. Misbehavior · embracethered.com · 08/09/2025OpenHands Agent Hands Over Its GitHub Token Because a Webpage Asked PolitelyRedaction was beaten with Base64 and the model's refusal with a substring. Security boundaries remain optional.
21. Misbehavior · embracethered.com · 08/08/2025Devin Was Told to Read a Website and Published Its Own Filesystem to the InternetNobody asked Devin to open its doors to the whole internet, but a sneaky webpage did the asking for it.
22. Misbehavior · Serious · embracethered.com · 08/07/2025Devin Gets Tricked Into Spilling Its Secrets Four Different Ways, Because Reading a GitHub Issue Is Apparently DangerousAgents are naive: untrusted text on a website can take control of the AI and ship your environment variables off to a stranger.
23. Misbehavior · embracethered.com · 08/06/2025Devin Read One Sketchy GitHub Issue and Immediately Ran MalwareAgents love clicking links. Especially the ones that say download this and run it.
24. Misbehavior · embracethered.com · 08/05/2025Amp Coding Agent Edited Its Own Settings File, Because Who Needs GuardrailsA code comment was enough to convince the agent to rewrite its own permissions and run whatever it liked.
25. Misbehavior · embracethered.com · 08/02/2025Codex Got Recruited Into a Botnet Through a GitHub Issue and an Azure SubdomainThe allowlist said azure.com was fine, so Codex said yes. Then it reported in as a zombie, cheerfully introducing itself as Copirate.
26. Misbehavior · hiddenlayer.com · 07/31/2025Cursor's AI Took a README a Little Too Seriously and Started Mailing Out Your SSH KeysNothing says helpful setup guide like one that doubles as an exfiltration plan. Patched in 1.3.
27. Misbehavior · Serious · embracethered.com · 06/24/2025Anthropic's Slack MCP Server Lets Agents Leak Your Secrets Through a Friendly Link PreviewUnfurling was built to be helpful. Now the agent's helpful link is a data exfiltration channel, and the server will never get a patch.
28. Misbehavior · hiddenlayer.com · 05/29/2025Just Add a Fake Function: Tricking AI Chatbots Into Spilling Their System PromptsHand the chatbot a fake calculator tool and it will happily read out its own secret instructions.
29. Misbehavior · Serious · 2 sources · 04/24/2025One Prompt to Rule Them All: Policy Puppetry Walks Past Nearly Every Major LLM's GuardrailsAlignment training was sold as the safety backbone. Turns out a prompt dressed up as a TV script can talk past it.
30. Misbehavior · embracethered.com · 04/07/2025Copilot Takes Notes From a Sneaky Instructions File and Starts Slipping In BackdoorsGreetings from Jia Tan, I guess.