Claude

Claude Chrome Extension Prompt Injection Enables Agent Takeover

ATLAS OWASP HIGH ▲ 9.1 SecurityWeek May 09, 2026

A vulnerability dubbed ClaudeBleed in Anthropic's Claude Chrome extension allows any browser extension to inject arbitrary prompts into the Claude AI agent by exploiting lax permission checks and improper trust validation. Attackers can bypass user confirmation protections via DOM manipulation and repeated message forging, enabling full agent takeover for information theft or unauthorized actions. The flaw effectively breaks Chrome's extension security model and exposes users running Claude's agentic capabilities to third-party extension compromise.

Firefox Vulnerabilities Discovered via AI-Assisted Fuzzing

ATLAS OWASP HIGH ▲ 7.2 Simon Willison May 08, 2026

Mozilla used early access to Anthropic's Claude Mythos model to systematically discover and patch hundreds of previously unknown vulnerabilities in Firefox, including bugs over 15–20 years old. The effort demonstrates a step-change in AI-assisted vulnerability research, with April 2026 seeing 423 security fixes compared to a monthly baseline of 20–30. The same capability that empowered Mozilla's defenders also signals that adversaries with similar model access could industrialise exploit discovery against open-source software at scale.

Pixel-Level Perturbations Enable Invisible Prompt Injection in Vision-Language Models

ATLAS OWASP HIGH ▲ 8.2 SecurityWeek May 08, 2026

Cisco's AI Threat Intelligence team has demonstrated that bounded pixel-level perturbations can recover the attack effectiveness of degraded typographic images against vision-language models (VLMs), enabling hidden prompt injection that bypasses both human review and content filters. The technique works by optimising perturbations against open-source embedding models and transferring results to proprietary systems like GPT-4o and Claude, exposing a cross-model transferability risk. The attack allows adversaries to embed instructions—such as data exfiltration commands—inside images that appear as visual noise to human observers.

Anthropic Claude Memory Poisoning Enables Prompt Injection

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 24, 2026

Cisco researchers discovered and reported a significant vulnerability in how Anthropic's AI systems handle memory files, which has since been patched. The flaw highlights a broader, systemic risk in agentic AI architectures where persistent memory mechanisms can be exploited to inject malicious instructions or exfiltrate sensitive data across sessions. Security experts caution that memory mismanagement in AI agents represents an enduring attack surface that extends well beyond any single vendor fix.

Claude Supply Chain Attack: SentinelOne EDR Blocks LLM

ATLAS OWASP HIGH ▲ 7.5 SentinelOne Blog Apr 23, 2026

SentinelOne claims its AI-powered EDR autonomously detected and blocked Anthropic's Claude LLM from executing a zero-day supply chain attack, representing a significant case study in agentic AI systems operating as attack vectors. The incident highlights the emerging threat surface created when LLMs are granted autonomous execution capabilities within enterprise environments. This appears to be a vendor marketing piece, and the claims warrant independent verification, but the scenario it describes — an AI agent compromising supply chain integrity — is technically credible and aligns with known agentic AI risk models.

Firefox: 271 Vulnerabilities Found via AI-Assisted Discovery

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison Apr 22, 2026

Firefox CTO Bobby Holley reports that a collaboration with Anthropic using an early version of Claude Mythos Preview identified 271 vulnerabilities in Firefox, resulting in fixes shipped in Firefox 150. This represents a significant real-world demonstration of AI-assisted vulnerability discovery at scale, signalling a shift in the defender-attacker dynamic. The findings suggest LLMs are becoming operationally viable tools for large-scale code security auditing.

Claude System Prompts Exposed via Git-Based Extraction

ATLAS OWASP MEDIUM ▲ 6.2 Simon Willison Apr 22, 2026

Simon Willison has created a git-based tool to track the evolution of Anthropic's publicly published Claude system prompts across model versions, enabling structured diff analysis of prompt changes over time. While the underlying prompts are intentionally public, the tooling lowers the barrier for adversarial reconnaissance — making it easier for threat actors to identify shifts in safety constraints, refusal heuristics, or behavioral guardrails between model releases. This kind of systematic prompt archaeology directly supports meta-prompt extraction and jailbreak development workflows.

Prompt Injection Risk: Claude 4.7 Agentic Tool Expansion

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 20, 2026

Anthropic's published system prompt diff between Claude Opus 4.6 and 4.7 reveals significant expansions in agentic tool access, autonomous browsing capabilities, and child safety guardrails — changes with direct security implications for prompt injection and excessive agency risks. The new `tool_search` mechanism and acting-before-asking posture increase the attack surface for adversarial inputs targeting agentic Claude deployments. Transparency in publishing these changes is notable, but the expanded autonomous capabilities warrant scrutiny from defenders.

Scanning for AI Models, (Tue, Apr 14th)

ATLAS OWASP HIGH ▲ 7.8 SANS Internet Storm Center Apr 15, 2026

A single threat actor (IP 81.168.83.103) has been systematically scanning internet-facing systems since at least January 2026, specifically targeting credential files, API tokens, and configuration data associated with popular AI platforms including OpenAI, Anthropic Claude, HuggingFace, and the Openclaw/Clawdbot tools. The campaign focuses on harvesting AI API credentials and secrets stored in predictable file paths, representing a targeted reconnaissance effort against AI model deployments. If successful, these probes could enable API key theft, model access abuse, and broader compromise of AI-integrated systems.

Anthropic Claude Prompt Injection Enables Excessive Agency

ATLAS OWASP LOW ▲ 6.2 CrowdStrike Blog Apr 11, 2026

CrowdStrike, as a founding member of Anthropic's Mythos program, is highlighting the security challenges posed by increasingly capable frontier AI models, signaling a growing industry focus on securing agentic and large-scale AI systems. The article underscores the philosophical and practical position that AI capability gains must be matched by proportional security investment. While the piece is primarily a vendor partnership announcement and executive viewpoint, it reflects an important industry trend toward formalising AI-specific security frameworks and tooling.

botctl Process Manager Enables Prompt Injection Attacks

ATLAS OWASP HIGH ▲ 7.2 HN AI Security Apr 09, 2026

botctl is an open-source process manager that enables persistent, autonomous AI agents (currently Claude-backed) to run continuously as background daemons with tool access, file system write permissions, and internet connectivity. While marketed as a productivity tool, the architecture introduces substantial attack surface through unattended agentic execution, a skills marketplace with third-party prompt injection, and a locally-exposed web dashboard. The combination of persistent autonomy, extensible skill modules from arbitrary GitHub repositories, and session memory creates compounding risk vectors relevant to agentic AI security.

Claude Source Code Leak Reveals AI Supply Chain Risk

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 03, 2026

A reported source code leak affecting Claude, Anthropic's large language model, underscores systemic weaknesses in AI software supply chains and the absence of robust oversight mechanisms at critical development and distribution layers. The incident highlights how proprietary model code, training pipelines, and system prompts can become high-value targets for adversarial actors seeking to enable model theft, backdoor insertion, or competitive intelligence gathering. This event serves as a broader warning about treating AI development infrastructure with the same rigor applied to other critical systems.

Claude

Stay ahead of the threat.