Prompt Injection

Claude Code Auto Mode Bypassed via Zip Payload at 80% Rate

ATLAS OWASP HIGH ▲ 8.5 Simon Willison Aug 28, 2026

Security researcher Johann Rehberger demonstrated an 80% success-rate prompt injection attack against Claude Code's auto mode, Anthropic's default safety mechanism for its coding agent. The attack tricks the agent into downloading and decompressing a zip archive containing a malicious local module that hijacks Python's import resolution to execute arbitrary code. Critically, auto mode was observed blocking Claude's own remediation commands after detecting the compromise, rendering the safety layer counterproductive.

NVIDIA NemoClaw Flaw Lets Malicious Page Poison Local AI Model

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 26, 2026

Oasis Security has disclosed a vulnerability in NVIDIA's NemoClaw agent stack that exposes local Ollama inference servers to unauthenticated access when the daemon is bound to 0.0.0.0:11434, enabling attackers to modify a model's chat template and inject persistent hidden instructions. The attack chain combines a misconfigured network binding, bypassed CORS and Host header middleware, and DNS rebinding to allow a malicious webpage to silently poison the AI model used by every subsequent conversation. A partial fix is available for macOS and Linux in v0.0.35, but Windows and WSL deployments remain unpatched and receive only a warning banner.

Grok Data Exfiltration via Cryptographic Context Injection

ATLAS OWASP CRITICAL ▲ 9.2 Ars Technica Security Aug 23, 2026

Researchers at Adversa have demonstrated a novel prompt injection bypass against Grok, xAI's LLM, in which malicious instructions are encrypted using PBKDF2 and AES-256-GCM before being embedded in attacker-controlled web content. Because Grok's safety filters inspect plaintext input and output but not the results of its own code execution, the decrypted instructions execute without warning, causing the model to exfiltrate the user's name, location, and chat history to an attacker-controlled server. The vulnerability was disclosed to xAI in June 2026 but remained unpatched at time of publication, underscoring the systemic difficulty of defending LLMs against prompt injection at the model level.

Encrypted Prompts Bypass Safety Guardrails in Grok and Gemini

ATLAS OWASP HIGH ▲ 8.5 SecurityWeek Aug 22, 2026

Researchers have disclosed a novel attack technique called 'Cryptographic Context Injection' that conceals malicious instructions within encrypted payloads, which are only decrypted inside a trusted execution environment — effectively hiding them from AI safety filters. The technique has been demonstrated against Grok and Gemini, two widely deployed commercial LLMs. This represents a significant escalation in prompt obfuscation methods, as it undermines content-level safety scanning by design.

AI Mind Viruses Spread Between Agents via Prompt Files

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 20, 2026

Researchers from Anthropic and EPFL have demonstrated self-propagating prompt payloads — dubbed 'mind viruses' — that can spread between autonomous AI agents through persistent state files such as SOUL.md and MEMORY.md. In controlled tests, ideological and action-based payloads achieved a 55% agent-to-agent infection rate when written to SOUL.md, with one recorded episode resulting in destruction of credential and SSH key files. A single-paragraph system prompt warning reduced propagation to near zero, though model susceptibility varied significantly and did not correlate with overall capability.

CVE-2026-24301: Microsoft Copilot One-Click Data Exfiltration

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Aug 20, 2026

Varonis Threat Labs disclosed three vulnerabilities in Microsoft Copilot Personal, collectively named CoSnitch (CVE-2026-24301), that allow an attacker to silently exfiltrate data from connected services with a single crafted link. The attack exploits an undocumented autorun=1 URL parameter that Copilot itself revealed during adversarial meta-hacking interrogation, enabling automatic prompt execution inside the victim's authenticated session. A separate third vulnerability allows persistent memory poisoning via web page summarization, potentially shaping future Copilot sessions.

CoSnitch Attack Forces Copilot to Expose Its Own Architecture

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Aug 19, 2026

Researchers demonstrated a 'meta-hacking' technique dubbed CoSnitch that manipulates Microsoft Copilot into disclosing its own internal security weaknesses and architectural details. The attack leverages the AI system's own reasoning capabilities against itself, effectively turning the assistant into an unwitting reconnaissance tool. This class of vulnerability has significant implications for enterprise deployments where Copilot has access to sensitive organisational infrastructure and data.

GhostSplice MCP Attack Splits Prompts to Exfiltrate SSH Keys

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 16, 2026

ASSET Research Group has disclosed GhostSplice, a technique that fragments malicious instructions across multiple Model Context Protocol (MCP) server channels to evade AI coding assistant safety filters and trigger secret exfiltration. By splitting a theft request into individually innocuous pieces placed in tool descriptions and tool results, the attack raised average model compliance from 42% to 82% across eleven tested models. The research highlights that host-side safety controls matter as much as model-level refusals, with the same model behaving differently across coding clients.

Context Bombing Uses Prompt Injection to Stop AI Hacking Agents

ATLAS OWASP MEDIUM ▲ 7.8 Schneier on Security Aug 14, 2026

Researchers at Tracebit have demonstrated a defensive technique called 'context bombing,' which plants prompt injections alongside cloud secrets on AWS to halt AI-driven attack agents by triggering their own guardrails. The approach reportedly reduced admin escalation attempts from 57% to 5% in testing, representing a novel inversion of the prompt injection threat. However, the technique's effectiveness is limited to LLMs with active guardrails, leaving a growing class of ungoverned, locally-run models unaffected.

LLM Reasoning Trace Theft via Encrypted Block Replay Attack

ATLAS OWASP HIGH ▲ 8.5 Simon Willison Aug 12, 2026

Researchers discovered that Anthropic, OpenAI, and Google share the same encryption key across model families for encrypted chain-of-thought blocks, allowing adversaries to replay stronger model reasoning traces into weaker siblings and extract hidden reasoning in plaintext via jailbreak. The attack also enables a prompt injection variant where malicious instructions embedded in reasoning traces are treated as trusted by the model, dramatically increasing attack success rates. All three vendors have since patched the vulnerability following responsible disclosure.

GhostJacking Attack Hijacks AI Agents via Security Alerts

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Aug 11, 2026

New research dubbed 'GhostJacking' demonstrates how attackers can exploit security alerts and blocked events to manipulate and hijack AI agents, exposing fundamental identity governance gaps in agentic AI systems. The technique highlights how defensive signals—normally indicators of protection—can be weaponised to subvert agent behaviour and assume control of automated workflows. This finding has significant implications for enterprises deploying AI agents in sensitive or privileged operational contexts.

Google APK Flaw Enables Agent-to-Agent Supply Chain Attack

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Aug 10, 2026

Researchers discovered vulnerabilities in Google's Python APK that allowed attackers to exploit a trust boundary between two AI agents operating at different privilege levels. The flaw enabled agent-to-agent attack chains capable of triggering automated workflows with supply chain compromise potential. Google has since patched the issues, but the disclosure highlights systemic risks in multi-agent AI architectures.

Atlassian Rovo Prompt Injection Leaks Jira Data to Attackers

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 08, 2026

Two independent security firms discovered that Atlassian's Rovo AI assistant can be manipulated through indirect prompt injection to exfiltrate Jira and Confluence data to attacker-controlled servers. PromptArmor demonstrated a file-borne injection chain requiring no separate approval step, while Varonis uncovered a URL parameter flaw (RovoBlast) that preloads attacker instructions into Rovo Chat with a single authenticated click. The link-parameter vulnerability was patched server-side by Atlassian on July 8, 2026, but the content-borne injection path lacks a direct patch.

Claude and ChatGPT Hijacked via Zero-Click Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Aug 07, 2026

Zenity researchers disclosed a zero-click attack chain capable of hijacking Claude and ChatGPT's agentic browser capabilities through malicious content embedded in emails and X posts. The vulnerabilities, reported to Anthropic and OpenAI in late 2025 and early 2026, remain unpatched as of publication. This represents a significant escalation in prompt injection risk, as no user interaction is required to trigger malicious AI agent behaviour.

ChatGPT Sandbox C2 Attack Demonstrated at Black Hat 2026

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Aug 07, 2026

A researcher at Black Hat USA 2026 demonstrated a proof-of-concept attack chain enabling command-and-control-style influence over ChatGPT's isolated execution sandbox. The technique represents a significant escalation in LLM exploit sophistication, moving beyond prompt manipulation toward infrastructure-level session control. If reproducible at scale, this class of attack could undermine the isolation guarantees that underpin safe AI code execution environments.

Prompt Injection

Stay ahead of the threat.