Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system. Along similar lines, Sysdig recently …

This talk demonstrates end-to-end prompt injection exploits that compromise agentic systems. Specifically, we will discuss exploits that ...

Claude's Code Interpreter recently got network access, and the default allow-list enables an interesting novel exploit chain that allows an adversary to exfiltrate large amounts of data by uploading f...

AgentHopper: A proof-of-concept AI Virus

Agents That Can Overwrite Their Own Configuration and Security Settings

This post shows how an indirect prompt injection can trick Manus to expose the VS code server and at the same time leak its connection password, allowing an adversary to connect over the internet and ...

When enabling Deep Research an agent might go off for a long period of time and invoke many tools and leak information from one tool to another.

A vulnerability in Windsurf Cascade allows malicious instructions to be hidden from developers but followed by the AI, leading to potential data exfiltration. Learn how this 'invisible' attack works.

Windsurf is vulnerable to Prompt Injection and also long-term memory persistence, which allows an adversary to persist malicious instructions for a long period of time, aka. SpAIware attack

Windsurf is vulnerable to indirect prompt injection and can be exploited to leak sensitive source code, environment variables and other information on the host

Amazon Q Developer Compromising Developer Machines

Amazon Q Developer Leaking Sensitive Data To External Systems Via DNS Requests (no human in the loop)

AmpCode is vulnerable to Prompt Injection and it was possible to leak sensitive source code, environment variables and other information on the host

Sourcegraph recently fixed a vulnerability that allowed invisible instructions to perform prompt injection and hijack the agent.

Jules is vulnerable to Prompt Injection from invisible instructions in untrusted data, which can end up running arbitrary operating system commands via the run_in_bash_session tool

Jules is vulnerable to Prompt Injection and can be exploited to leak sensitive source code, environment variables and achieve remote command & control by joining a botnet.

Jules is vulnerable to Prompt Injection and can be exploited to leak sensitive source code, environment variables and other information on the host

Independent AI researcher Johann Rehberger (previously) has had an absurdly busy August. Under the heading The Month of AI Bugs he has been publishing one report per day across an …

An attacker can put GitHub Copilot into YOLO mode by modifying the project's settings.json file on the fly, and then executing commands, all without user approval

Claude Code Can Leak Sensitive Data To External Systems with DNS requests

When processing untrusted data OpenHands can be hijacked to run remote code (RCE) and connect to an attacker's command and control system

OpenHands Coding Agent Data Exfiltration Threats

AI Kill Chain in Action: Devin AI Exposes Ports to the Internet with Prompt Injection

Data gone, oops.

I Paid $500 to test Devin AI for security vulnerabilities in April 2025. When processing untrusted data Devin can be hijacked to run remote code (RCE) and connect to an attacker's command and control ...

By automatically allowlisting bash commands or adding a fake MCP server, it was possible for prompt injection to achieve code execution on the developer's machine!

Cursor Data Exfiltration via Mermaid Image Rendering

Improper Path Prefix Validation Allows Access to Alternate Directories

Common Dependencies Allowlist includes domain that allows full remote control of ChatGPT Codex (ZombAI)

August 2025 will be the month of Agentic ProbLLMs and AI Bugs. Fresh posts nearly every day.

An MCP Server that can host COM servers for advanced Windows Automation

AI Clickfix

Custom Rule Files in Code Editors Can Be Abused By Adversaries

Gemini allows persistent storage of memories. However, a bypass technique using delayed tool invocation can force Gemini to store false information into a user’s long-term memory. This post explores h...