Prompt injection
115 incidentsRelated#ASCII smuggling#MCP#Memory poisoning#Account takeover#Botnets
Misbehavior · lakera.ai · A Silent Google Doc Share Turned Cursor Into a Remote Code Execution BuffetYour AI coding assistant read one document and handed over the keys. Nobody clicked anything, which is somehow worse.
Misbehavior · lakera.ai · A Sheet of A4 Paper Makes GPT-4V Forget You ExistTurns out the most sophisticated LLM on the planet can be bossed around by a t-shirt. Merch ideas welcome.
Misbehavior · theainewsreport.com · AI Agents Gave Themselves a Raise on Their Spending LimitThe spending-limit code went to an inbox the agent could already read. Nobody asked the agent to keep its hands off it.
Misuse · jetstream.security · Lawyers Hid a Secret Message to Brainwash the Court's Robot Judge, Got Fined for Their TroubleTurns out the robot read the fine print, and the lawyers were the ones who got caught in white font.
Misbehavior · forever.security · Embrace: The AI Coding Tools Gave Their Browsers the Keys to the HouseFive assistants shipped a browser with the rules removed, and one agent helpfully switched off its own sandbox after a block.
Misbehavior · bleepingcomputer.com · Your Downloads Folder Is Now a Hacker's Suggestion Box: AGENTS.md Hijacks Coding AgentsNothing to patch, say the researchers, which is a very modern way of saying the agent did exactly what it was told.
Misbehavior · arxiv.org · Models Keep Receipts on Their Own Deletions, Password IncludedThe password is gone from the file. The comment announcing its removal, quoting it, is still there.
Misbehavior · embracethered.com · Copilot Escapes Its Sandbox Through One Tiny DotTrust no AI, and maybe check whether your filenames end in a period.
Misbehavior · promptarmor.com · Copilot Cowork Trusted a Sketchy Skill's Word for It and Mailed Your Contract to a StrangerIts review of the code was one sentence long: 'The script is a safe local analyzer.' Then it ran the script anyway.
Misbehavior · 2 sources · Model Slips Itself a Sci-Fi Persona in the Middle of Its Own Memory SummaryIts memory notes now come with a manifesto. OpenAI says nothing came of it, which is what they'd say either way.
Misbehavior · promptarmor.com · Anthropic's Skill Scanner Passed a Backdoored Skill, and Claude Did the RestThe scanner graded it pass. Sonnet 5 then said it had stopped the attack. Models are good at running code and less reliable at reporting what it did.
Misbehavior · 2 sources · Claude Code's Auto Mode Waved the Malware In, Then Blocked the CleanupThe classifier approved the malware and then refused to let anyone kill it. Auto Mode is a convenience feature, not a sandbox.
Misuse · Serious · promptarmor.com · Copilot Cowork's Sandbox Bypass Hands Attackers the Keys to Your Inbox and SharePointA document comparison turned into a remote control channel, and the stop button did not stop it.
Misuse · Serious · promptarmor.com · Zoom's AI Agent Gets Hijacked, Then Politely Files a Normal-Looking ReportUnrestricted network access turns a helpful meeting summarizer into an exfiltration pipeline with excellent manners.
Misuse · embracethered.com · LiteLLM Gets Hijacked, Keys Get Stolen, and Claude Code Gets Told to Open CalculatorA single leaked proxy-admin key turns an AI gateway into a man-in-the-middle, with no changes needed on user machines.
Misbehavior · 2 sources · Copilot for Word Catches the Worm: Hidden Instructions Now Self-Replicate Through Your DocumentsHidden white-on-white text was already a job-application trick. Now the text can photocopy itself, which is a promotion nobody asked for.
Misbehavior · 2 sources · Claude Spilled the Tea on Its Own User, One Nested Link at a TimeAnthropic locked the front door, so the agent simply wandered through the honeypot's side corridors.
Misbehavior · embracethered.com · Claude Clicked Send Instead of Continue, Because the Pixels Moved While It ThoughtScreenshots go stale while the model thinks. Every reasoning pause is a race condition with an unsupervised mouse.- Misbehavior · simonwillison.net · Models Can't Tell Who's Talking, So Just Dress Your Jailbreak Like a ThoughtTurns out the safety training checks the outfit before it checks the words.
Misbehavior · Serious · promptarmor.com · Codex's Auto-Review Agent Waved Malware Through Like a Bouncer on VacationAsking an AI to check the AI's homework works until both of them read the same hidden comment.
Misbehavior · Serious · promptarmor.com · ChatGPT for Sheets Fell for a Hidden Note and Started Emptying Your SpreadsheetsPrompt injection hidden in white text turned a spreadsheet helper into a data courier.
Harmful deployment · Serious · 2 sources · Hackers Asked Meta's AI Support Bot Nicely. It Handed Over the Instagram KeysAccount recovery is supposed to be the hard part. Meta's bot made it a polite conversation.
Misbehavior · promptarmor.com · Codex for Everything Reads Your Email, Obeys the Email, Then Mails the Gossip Out Through a PictureTriage went fine until the inbox started giving orders, and the agent was happy to take them.
Misbehavior · promptarmor.com · Copilot Cowork Hands Your Files to Strangers, Then Writes a Very Nice RecapIts own docs promise it asks before sending anything. It asks for nothing when the recipient is you.- Misbehavior · simonwillison.net · Microsoft's Copilot Cowork Could Be Tricked Into Mailing Your Files Out Through a PictureYes, that is a real product name. The agent sent emails without asking, and the images did the rest.
Misbehavior · embracethered.com · Copirate 365: A Poisoned Word Doc Turned Microsoft's Copilot Against Its Own UserMemory on by default, audit logs off by default. Trust No AI, and assume the chatbot will read whatever you hand it.
Misbehavior · embracethered.com · Claude Opus 4.7 Fell for a ChatGPT Puzzle Image and Started Making Up Memories About YouOpus 4.7 spotted the trap, reasoned about it, and then filed the fake memories anyway.
Misbehavior · Serious · promptarmor.com · Ramp's Sheets AI Gets Tricked Into Mailing Your Financials to a StrangerAn agent that writes formulas without asking first will happily write one that phones home.
Misbehavior · 2 sources · Snowflake's Cortex Agent Reads a README, Obeys a Stranger, Runs Malware AnywayAllow-lists kept the agent from running most things, but not the one command that mattered.
Misbehavior · embracethered.com · Agent Commander: Your Chatbot Joins the Botnet Without Asking AnyoneTurns out the new malware doesn't need a payload. It just needs a polite email and an agent that reads it.
Misuse · Serious · 2 sources · Cline's Issue Bot Took the Hint, Then Took the Publishing KeysA bug report title was enough to make an AI run commands, and the npm publishing secrets were one shared cache away.