Proof-of-Concept

5 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Model Theft Data Poisoning AI Security Tools Security Operations

Ghostcommit PoC Embeds Prompt Injection in PNG to Steal Repo Secrets

FIRST LOOK ATLAS OWASP CRITICAL ▲ 9.2 BleepingComputer Jul 11, 2026

Researchers from UMKC's ASSET Research Group have published a proof-of-concept attack called Ghostcommit that hides malicious prompt injection instructions inside PNG image files referenced by AGENTS.md convention files, causing AI coding agents to silently exfiltrate repository secrets. The technique exploits a blind spot shared by multiple AI code review tools — including CodeRabbit and Bugbot — which exclude or ignore binary image files from analysis, allowing the payload to survive review undetected. Defenders operating AI-assisted development pipelines must treat image files in agentic context paths as a new, uncontrolled input surface and reassess trust boundaries around automatically-ingested project convention files.

Browser Ransomware via File System Access API: DeepSeek

ATLAS OWASP HIGH ▲ 8.5 Check Point Research Jul 03, 2026

Check Point Research demonstrates how DeepSeek's lower refusal rates allowed researchers to transform an LLM-hallucinated malware concept into a practical browser-native ransomware technique targeting Android photo directories via the File System Access API. The attack requires no native payload, APK installation, or root access — only social engineering to obtain a legitimate browser permission prompt. This research highlights how frontier AI models with weaker safety controls can independently design novel attack paths not yet seen in real-world campaigns.

Claude Code Prompt Injection via GitHub Supply Chain

ATLAS OWASP HIGH ▲ 9.1 BleepingComputer Jun 29, 2026

Mozilla 0DIN researchers demonstrated a novel attack chain in which a seemingly clean GitHub repository tricks AI coding agents like Claude Code into executing a reverse shell payload — with no malicious code ever present in the repo itself. The attack leverages three innocuous components: a Python package that deliberately errors on first run, an error message that instructs the agent to run an init command, and a shell script that fetches and executes a payload stored in an attacker-controlled DNS TXT record. The technique exploits the autonomous error-recovery behaviour of agentic AI tools, effectively turning a safety feature into an attack vector.

Claude Mythos Generates Working Exploits for Firefox, Windows

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jun 10, 2026

Anthropic's Claude Mythos Preview model demonstrated the ability to generate functional proof-of-concept exploits targeting known Firefox and Windows vulnerabilities within minutes to hours, compressing the traditional patch gap window dramatically. Testing also revealed that public Anthropic models with safety guardrails disabled could produce working exploits, though at a lower success rate than Mythos. The findings underscore how frontier LLMs are shifting the threat landscape for unpatched N-day vulnerabilities by automating and accelerating exploit development previously bottlenecked by scarce reverse engineering expertise.

AI Worm Autonomously Generates Exploits at Runtime

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jun 10, 2026

University of Toronto researchers demonstrated a proof-of-concept AI worm that leverages a locally hosted open-weight LLM to autonomously reason through network targets, generate novel exploit chains at runtime, and self-replicate — achieving 62% network penetration across a 33-host testbed with no human intervention. Unlike traditional worms with fixed payloads, this system bypasses conventional patch-based defences by dynamically adapting attack logic to whatever vulnerabilities it discovers. The use of offline open-weight models eliminates dependency on commercial AI APIs, making it resilient to rate-limiting or platform-level safety controls.