Prompt Injection

Atlassian Rovo Prompt Injection Leaks Jira Data to Attackers

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Aug 08, 2026

Two independent security firms discovered that Atlassian's Rovo AI assistant can be manipulated through indirect prompt injection to exfiltrate Jira and Confluence data to attacker-controlled servers. PromptArmor demonstrated a file-borne injection chain requiring no separate approval step, while Varonis uncovered a URL parameter flaw (RovoBlast) that preloads attacker instructions into Rovo Chat with a single authenticated click. The link-parameter vulnerability was patched server-side by Atlassian on July 8, 2026, but the content-borne injection path lacks a direct patch.

Claude and ChatGPT Hijacked via Zero-Click Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Aug 07, 2026

Zenity researchers disclosed a zero-click attack chain capable of hijacking Claude and ChatGPT's agentic browser capabilities through malicious content embedded in emails and X posts. The vulnerabilities, reported to Anthropic and OpenAI in late 2025 and early 2026, remain unpatched as of publication. This represents a significant escalation in prompt injection risk, as no user interaction is required to trigger malicious AI agent behaviour.

ChatGPT Sandbox C2 Attack Demonstrated at Black Hat 2026

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Aug 07, 2026

A researcher at Black Hat USA 2026 demonstrated a proof-of-concept attack chain enabling command-and-control-style influence over ChatGPT's isolated execution sandbox. The technique represents a significant escalation in LLM exploit sophistication, moving beyond prompt manipulation toward infrastructure-level session control. If reproducible at scale, this class of attack could undermine the isolation guarantees that underpin safe AI code execution environments.

Varonis Launches Agent IBAC to Constrain AI Agent Actions at Runtime

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 BleepingComputer Aug 05, 2026

Varonis has released Agent Intent-Based Access Control (IBAC) within its Atlas platform, a runtime enforcement layer that compares an AI agent's received instructions against its actual tool calls and data access to detect and block out-of-policy behaviour. While the capability is a defensive control, its deployment introduces new attack surface: adversaries who understand the intent-matching logic may craft prompt injections or instruction manipulation that causes the agent's declared intent to align with a malicious action, bypassing the guardrail. Security teams should treat Agent IBAC as a layer within a defence-in-depth strategy rather than a standalone control, and test it aggressively against adversarial prompt scenarios before trusting it in production.

Sprocket Launches AI Agent for Hardware and Software Dev

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Aug 03, 2026

Sprocket is an open-source AI agent that combines software code generation with hardware design synthesis, retrieving live web context to augment its outputs across both domains. This dual-domain agentic capability significantly expands the attack surface by introducing a single agent with write access to both software repositories and hardware description files, creating cross-domain compromise scenarios. Defenders must assess supply chain integrity across both EDA toolchains and software build pipelines, as a compromised or manipulated Sprocket instance could introduce vulnerabilities into hardware designs and software simultaneously.

Microsoft Copilot Super App Merges Chat, Code, and Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Verge AI Jul 30, 2026

Microsoft has confirmed a Copilot 'super app' launching in 2026 that consolidates chat, GitHub Copilot coding, Cowork collaboration, and agentic Autopilot capabilities into a single unified platform spanning consumer and commercial users. The convergence of these surfaces into one application dramatically expands the blast radius of any successful prompt injection or account compromise, as an attacker who subverts the LLM layer could pivot across coding pipelines, autonomous task execution, and business workflows simultaneously. Defenders should treat this consolidation as a significant privilege-escalation risk, where a single vulnerability in the AI layer now potentially unlocks lateral movement across the entire Microsoft productivity stack.

Meta Plans Billions of Personal AI Agents on WhatsApp

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 TechCrunch AI Jul 30, 2026

Meta CEO Mark Zuckerberg has publicly committed to deploying personal AI agents at billion-user scale within five years, with WhatsApp and Meta's messaging surfaces as the primary delivery channel for agents managing finances, health, relationships, and household tasks. This represents a massive expansion of agentic AI attack surface, as persistent, goal-directed agents operating 24/7 on behalf of individuals will hold unprecedented access to sensitive personal data and actionable context. Defenders must anticipate new classes of prompt injection, data exfiltration, and agent impersonation threats operating at a scale and intimacy that dwarfs current enterprise agentic deployments.

Perplexity Launches Personal Computer AI Agent for Windows PCs

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 The Verge AI Jul 29, 2026

Perplexity has expanded its Personal Computer agentic tool to Windows, enabling a locally-run AI agent that can access files, Office 365 apps, and the web on behalf of enterprise users. This significantly expands the attack surface for defenders: a compromised or manipulated agent running with local system access can exfiltrate files, execute unauthorised actions, and pivot across cloud-connected Microsoft 365 services. Security teams should treat this as a high-privilege process requiring the same scrutiny as endpoint detection tools, with particular attention to prompt injection via locally-processed documents.

Google Gemini API Adds Hooks, Budget Controls, and 3.6 Flash Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 Google DeepMind Blog Jul 29, 2026

Google has updated its Managed Agents in the Gemini API with Gemini 3.6 Flash as the new default model, environment hooks that allow interception of tool calls, budget controls, scheduled triggers, and free tier access. The introduction of environment hooks — which can block, lint, or audit tool calls inside the agent sandbox — creates a new interception layer that, if misconfigured or bypassed, could allow malicious tool calls to slip through undetected. Defenders deploying these agents must treat hooks as a critical trust boundary and scrutinise scheduled triggers and budget controls as potential abuse vectors for persistent, low-cost autonomous operations.

AWS AgentCore Gateway Adds Support for MCP 2026-07-28 Spec

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jul 29, 2026

AWS has released AgentCore Gateway with native support for the Model Context Protocol (MCP) 2026-07-28 specification, enabling standardised tool-use and context-sharing across agentic AI workloads on AWS infrastructure. For defenders, MCP-compliant gateways dramatically expand the inter-agent communication surface, introducing new vectors for prompt injection through tool responses, malicious server impersonation, and privilege escalation across agent boundaries. Security teams operating agentic pipelines on AWS must now treat MCP endpoints as high-value targets requiring the same scrutiny applied to API gateways and identity providers.

AWS Adds Bedrock Guardrails Best Practices for Code Generation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Jul 24, 2026

AWS has published guidance on applying Amazon Bedrock Guardrails to code generation workflows, detailing how to configure content filters, topic denials, and output controls for AI-assisted coding pipelines. For defenders, this surfaces the inverse risk: organisations that misconfigure or partially implement these guardrails expose code generation endpoints to prompt injection, malicious code output, and filter-evasion attacks. Security teams must treat guardrail configuration as a first-class security control, not a default-on safety net.

Anthropic Brings Voice Mode to Claude Opus and Sonnet Models

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Verge AI Jul 24, 2026

Anthropic has expanded Claude's voice mode to its more capable Opus and Sonnet models, with agentic integrations into productivity apps including Gmail, Slack, and Canva. This significantly widens the attack surface by combining a natural-language voice input channel with agentic action-taking capabilities across third-party platforms. Defenders must now account for voice-based prompt injection, cross-app lateral movement via conversational instruction, and the difficulty of auditing spoken-language interactions at scale.

AgentForger Flaw Lets Attackers Plant Invisible AI Agents in Orgs

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Jul 24, 2026

A newly patched vulnerability in OpenAI's ChatGPT agent infrastructure, dubbed AgentForger, allowed attackers to create, insert, and remotely control invisible autonomous AI agents inside victim organisations. The flaw represents a serious escalation in agentic AI risk, enabling adversaries to operate as a trusted AI insider without detection. OpenAI has issued a fix, but the technique highlights systemic risks in deploying autonomous AI agent frameworks within enterprise environments.

Azure DevOps MCP Prompt Injection Hijacks AI Review Agents

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 22, 2026

A prompt injection flaw in Microsoft's official Azure DevOps MCP server allows attackers to embed hidden instructions inside pull request descriptions using HTML comments, invisible to human reviewers but passed raw to AI agents. Because the affected tool lacks the spotlighting guardrail Microsoft already applied to other tools in the same server, a low-privileged contributor can hijack a senior reviewer's AI agent to exfiltrate secrets, trigger pipelines, and read confidential wikis across unrelated projects. The vulnerability represents a textbook confused-deputy escalation in an agentic AI workflow, confirmed unpatched as of July 21, 2026.

Tracebit Ships AWS Context Bombing Defence Against AI Hacking Agents

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.8 Ars Technica Security Jul 14, 2026

Tracebit has demonstrated a defensive technique called 'context bombing' that plants forbidden prompt injections alongside cloud secrets in AWS environments, exploiting AI hacking agents' own safety guardrails to force them into refusal loops and halt attacks. Tested across five leading models and 152 runs, the technique reduced successful admin privilege escalation from 57% to 5% and complete compromise from 36% to 1%. While highly effective as a canary and disruption mechanism, the technique also introduces a novel countermeasure-evasion arms race: adversaries now have strong incentive to build agents with hardened or guardrail-bypassed reasoning loops specifically to defeat context bombs.

Prompt Injection

Stay ahead of the threat.