FlagThis - Latest Cybersecurity News

GhostJacking is a systemic exploitation technique targeting autonomous AI agents with WebAI integrations. By leveraging indirect prompt injection via malicious web content, attackers manipulate an agent's autonomous feedback loop to hijack its execution flow. This allows the attacker to abuse the agent's tool-calling capabilities (function calling) to execute arbitrary shell commands on host developer machines, exfiltrate sensitive API keys, and facilitate lateral movement. Effectively, this converts trusted productivity agents into LLM-orchestrated Remote Access Trojans (RATs), bypassing traditional input filters by poisoning the external data the agent consumes during autonomous browsing.

Atlassian Rovo, an enterprise AI assistant, is subject to two distinct Indirect Prompt Injection (XPIA) attack vectors that threaten cross-platform data integrity. While the "RovoBlast" one-click vulnerability via the rovoChatPrompt URL parameter was patched in July 2026, a more severe zero-click vector remains unconfirmed for remediation. This second vector utilizes malicious instructions embedded within file metadata or content to hijack Rovo’s internal URL retrieval and grounding tools. Once triggered, the attack enables silent, unauthorized exfiltration of sensitive information from interconnected platforms, including Jira, Confluence, Slack, Google Workspace, and Microsoft 365, effectively bypassing "web search disabled" security configurations.

The Retrieval-Augmented Defense (RAD) framework addresses the "security lag" inherent in static LLM safety alignments by shifting defense from model weights to a dynamic retrieval layer. By leveraging Retrieval-Augmented Generation (RAG) to match incoming queries against a curated database of adversarial patterns, RAD mitigates sophisticated jailbreaks such as Prompt Automatic Programming (PAP) and Prompt Automatic Iterative Refinement (PAIR) without requiring costly retraining. This architecture enables "hot-swappable" security updates and provides a controllable mechanism to optimize the trade-off between model utility and safety, as validated by the StrongREJECT benchmark.

AI jailbreaking is transitioning from rudimentary single-shot prompt injections to sophisticated, multi-turn adversarial techniques like the "Crescendo" methodology. These attacks exploit the architectural lack of isolation between system-defined instructions and user-provided data, facilitating semantic safety guardrail bypasses. By iteratively manipulating LLM reasoning, attackers can trigger unauthorized instruction execution, extract sensitive system prompts, and generate polymorphic malware or advanced phishing content. This evolution significantly increases the risk of hijacking enterprise-grade AI assistants. Defending against these exploits requires mapping vulnerabilities to the OWASP Top 10 for LLM Applications, implementing specialized adversarial testing via platforms like Sandgarden, and deploying real-time telemetry to monitor for guardrail erosion and anomalous model behavior.

As LLM agents transition from text generation to autonomous tool execution, they face heightened risks from Indirect Prompt Injection (IPI), where malicious external data manipulates agent reasoning to execute unauthorized actions. Current defenses are either too rigid (rule-based) or computationally expensive (constant semantic auditing). Researchers from Emory University have developed SIEVE, a hybrid defense framework that utilizes an "Intent Graph" for deterministic verification of tool transitions and argument sources. By escalating only ambiguous or non-deterministic actions to a high-level Semantic Adjudication Module, SIEVE significantly reduces Attack Success Rate (ASR) across AgentLure and AgentDojo benchmarks while maintaining high operational utility and minimizing token overhead compared to state-of-the-art baselines like DRIFT and ARGUS.

Microsoft Copilot for Word is susceptible to a self-propagating Cross-Prompt Injection Attack (XPIA) stemming from a fundamental architectural inability to distinguish between untrusted user data and authoritative developer instructions. Attackers embed JSON-formatted payloads using white-on-white text obfuscation in .docx files. Upon ingestion, the AI agent elevates these hidden strings to high-priority system commands, enabling the worm to autonomously append itself to any subsequently generated or edited documents. This mechanism bypasses traditional EDR and AV signatures by utilizing authorized AI agents within enterprise workflows—specifically SharePoint and Teams—potentially leading to organizational-wide context collapse and unauthorized data exfiltration.

North Korean state-sponsored actors have deployed MacOS.Gaslight, a Rust-based information stealer and backdoor targeting macOS environments. The implant utilizes a novel evasion technique by embedding 38 adversarial prompt injection strings designed to manipulate LLM-based malware triage tools. By targeting the cognitive layer of analysis, the malware attempts to trigger AI safety guards or provide fabricated system context, inducing AI assistants to misclassify the payload as benign or refuse analysis. This strategy directly degrades the accuracy of AI-assisted SOC triage, increasing attacker dwell time by blinding automated security analysis pipelines.

Researchers from Mozilla 0DIN have identified critical Indirect Prompt Injection (IPI) vulnerabilities within Claude Code and other agentic AI coding tools. By embedding malicious instructions in seemingly benign external data, such as GitHub README files or bug reports, attackers can manipulate the agent's control flow to execute unauthorized system commands. This exploitation enables Remote Code Execution (RCE) on developer workstations, often bypassing traditional EDR/AV via instruction-based hijacking rather than traditional binary-based malware. Specifically, the research demonstrates an escalation path where the agent is coerced into establishing a reverse shell through DNS TXT records, providing a covert Command and Control (C2) channel that facilitates full machine compromise.

OpenAI has introduced GPTRed, an internal automated red-teaming framework designed to proactively identify and mitigate prompt injection vulnerabilities within its large language models (LLMs). By utilizing adversarial training pipelines, GPTRed automates the discovery of complex attack vectors, specifically targeting model versions such as GPT-5.6 Sol. The framework aims to scale vulnerability discovery through machine-led adversarial testing, shifting the security paradigm from manual human auditing to high-velocity, AI-driven remediation. This deployment marks a significant advancement in hardening LLMs against prompt injection before wide-scale commercial deployment.

Threat actors have successfully bypassed Instagram account recovery protocols by exploiting prompt injection vulnerabilities within Meta's AI-powered customer support chatbot. By delivering malicious conversational payloads, attackers manipulated the Large Language Model (LLM) to act as a proxy for unauthorized identity verification, triggering illegitimate password reset requests via Instagram's account recovery APIs. This vulnerability represents a critical failure in access control, where the AI bot's ability to execute high-privilege system calls was weaponized to facilitate Account Takeover (ATO). The incident notably impacted high-profile U.S. government-affiliated accounts, escalating the threat from simple fraud to sophisticated geopolitical influence operations.

Emerging research from Zscaler ThreatLabz, Microsoft, and Palo Alto Networks identifies a critical evolution in the threat landscape: Indirect Prompt Injection (IPI) targeting autonomous AI agents. Unlike direct injections, attackers utilize context poisoning to embed malicious instructions within web content using hidden HTML elements (CSS display:none) or SEO poisoning. These payloads hijack the "agentic tool-chain," specifically targeting Model Context Protocol (MCP) vulnerabilities to manipulate agentic autonomy. This enables unauthorized API executions, including fraudulent cryptocurrency transfers and the corruption of long-term agent memory, effectively bypassing human-in-the-loop controls and creating systemic risks for autonomous AI infrastructure.

The transition from passive LLM suggestions to agentic AI introduces critical vulnerabilities via Indirect Prompt Injection and Model Context Protocol (MCP) tool poisoning. By exploiting the LLM's inability to distinguish between data and instructions, attackers can embed malicious commands in external sources that agents process. When agents possess privileged toolsets—including Git write access and filesystem interaction—these injections enable remote code execution (RCE), silent supply chain compromise through unauthorized repository commits, and the exfiltration of environment variables or SSH keys. This expands the attack surface from simple prompt manipulation to automated, privileged system exploitation.

Research detailed in arXiv:2606.27567 identifies a fundamental architectural flaw in shared-embedding sequence models where instructions and data are processed via a unified attention-aggregation pipeline. This "instruction-data conflation" mirrors the Von Neumann architecture's overlap of code and data, rendering prompt injection a structural vulnerability rather than a patchable alignment bug. Mathematical proofs utilizing Total Variation Distance (TVD) demonstrate the impossibility of Semantic-Faithful Control (SFC), proving that trusted instructions and untrusted data are statistically inseparable. This flaw enables authoritative action hijacking, including refusal bypasses and unauthorized tool execution, effectively neutralizing current in-pipeline classifiers and alignment-based defenses.

LayerX Security has identified "BioShocking," a novel class of logic-based exploitation targeting AI-integrated browsers, specifically Perplexity and Comet. The vulnerability exploits the "confused deputy" phenomenon, where the AI agent's reasoning capabilities are manipulated via specialized prompt injection payloads to bypass internal security guardrails. By targeting the integration layer between the Large Language Model (LLM) and the browser's data access permissions, attackers can induce the AI to access sensitive session credentials, passwords, and PII. The compromised AI agent then executes exfiltration sequences, transmitting stolen data to attacker-controlled remote endpoints under the appearance of legitimate operational requests.

Agentic frameworks are transitioning from stateless interactions to stateful autonomy, introducing Cross-Session Stored Prompt Injection. This vulnerability allows attackers to embed malicious instructions into an agent's persistent state—including long-term episodic memory, vector databases (RAG), and tool-use logs—which are later retrieved as "trusted" context in subsequent sessions. By poisoning the internal state, attackers bypass per-session input sanitization to achieve persistent goal hijacking, unauthorized tool execution, and data exfiltration. This shift mirrors the evolution from Reflected to Stored XSS, where the attack is temporally decoupled from the injection, creating "sleeper" payloads that activate upon specific retrieval triggers.

Researchers at Cato Networks have identified "DuneSlide," a pair of critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI IDE. These flaws enable prompt-injection-driven sandbox escapes, escalating from LLM interactions to full operating system-level Remote Code Execution (RCE). Attackers can leverage malicious Model Context Protocol (MCP) servers or poisoned web search results to manipulate the run_terminal_cmd tool and bypass path canonicalization logic via symbolic links. Successful exploitation allows unauthorized file writes outside the project root, enabling attackers to overwrite the cursorsandbox executable, modify shell configurations, or establish persistence via macOS LaunchAgents, resulting in total system compromise.

Web Agent Retrieval Poisoning (WARP) is a critical evolution in indirect prompt injection targeting agentic AI systems, including OpenAI Deep Research, Google Gemini Deep Research, and Claude Code. Attackers embed instructions within seemingly benign source material, such as public GitHub repositories, to exploit an AI agent's automated error-recovery instincts. By triggering specific logic, attackers force the agent to fetch second-stage payloads via non-file-based channels like DNS TXT records. This technique bypasses static analysis, secret scanners, and human code review, ultimately enabling Remote Code Execution (RCE) through reverse shells on developer workstations or within CI/CD pipelines.

Attackers are leveraging Indirect Prompt Injection (IPI) to hijack AI agents from OpenAI, Anthropic, and Google by weaponizing the Retrieval-Augmented Generation (RAG) process. Through SEO poisoning, malicious sites are prioritized in agent grounding searches, delivering hidden payloads via CSS (display:none, opacity:0) and zero-width characters. These invisible instructions override system prompts to execute unauthorized tool-use functions, enabling cryptojacking via WebAssembly and the exfiltration of sensitive session data to attacker-controlled endpoints. This vulnerability shifts the primary attack vector from direct user input to external, untrusted data sources utilized for agentic autonomy.

Autonomous AI agents are increasingly susceptible to Indirect Prompt Injection (IPI), where malicious instructions are embedded within untrusted data sources such as web pages or documents. Attackers utilize encoded payloads (e.g., Base64) to bypass semantic filters, hijacking the agent's action layer to trigger unauthorized tool-calling and API execution. This vulnerability, confirmed across 13 frontier LLM models, enables the automated execution of irreversible cryptocurrency transactions. The primary risk lies in the agent's inability to distinguish between legitimate user intent and malicious instructions retrieved via Retrieval-Augmented Generation (RAG) pipelines.

Gaslight (macOS.Gaslight) is a Rust-based backdoor attributed to North Korean (DPRK) state-sponsored actors, designed for browser credential harvesting from Chrome, Brave, Firefox, and Safari on macOS. The implant utilizes the Telegram Bot API for command-and-control (C2) communications. Its primary innovation is the integration of 38 adversarial prompt injection strings embedded within the binary. These strings are engineered to deceive Large Language Models (LLMs) used by SOC analysts during triage, inducing AI refusals or hallucinated benign classifications to bypass automated analysis and extend attacker dwell time. Detection was initially facilitated by an Apple XProtect update.

Adversaries are pivoting from direct prompt injection to indirect injection attacks targeting agentic AI systems by poisoning external data sources. By manipulating Model Context Protocol (MCP) tool definitions and OpenAPI/Swagger specifications, attackers embed malicious instructions within metadata fields such as 'description' or 'parameter'. When an AI agent parses this documentation to resolve tool-calling logic, it interprets the embedded payloads as functional requirements. This enables unauthorized tool execution, facilitating sensitive data exfiltration to attacker-controlled callback URLs, privilege escalation, and fraudulent financial transactions, including cryptocurrency payments. This vulnerability fundamentally compromises the security boundary of AI agents utilizing external tool integration and grounding.

Researchers at Varonis Threat Labs have identified 'SearchLeak' (CVE-2026-42824), a critical indirect prompt injection vulnerability in Microsoft 365 Copilot Enterprise Search. The vulnerability utilizes a Parameter-to-Prompt (P2P) technique via the ?q= URL query parameter to manipulate the LLM. By exploiting a race condition during incremental HTML rendering, an attacker can inject malicious <img> tags that bypass Content Security Policy (CSP) restrictions. Through the exploitation of Bing’s Image Search imgurl= parameter, the attack facilitates the silent exfiltration of sensitive data—including 2FA codes, SharePoint documents, and emails—by leveraging the user's inherited Microsoft Graph API permissions.

The "ChatGPhish" vulnerability is a high-severity indirect prompt injection flaw residing in the ChatGPT web interface's Markdown rendering engine. By leveraging the model's web-browsing and summarization capabilities, an attacker can host malicious Markdown/HTML payloads on an external webpage. When ChatGPT processes this URL, the renderer interprets the untrusted content as legitimate UI elements within the chatgpt.com domain. This facilitates "trust-transfer" attacks, allowing adversaries to inject spoofed security alerts, fraudulent hyperlinks, and phishing QR codes directly into the user's trusted session, aiming for credential theft and session hijacking via sophisticated social engineering.

Researchers have introduced AutoDojo, an adaptive adversarial framework designed to expose the inadequacy of static security benchmarks like AgentDojo in evaluating Indirect Prompt Injection (IPI) vulnerabilities. By leveraging frontier LLMs to perform black-box, iterative optimization, AutoDojo bypasses current prompt-level instructions and detection-based filters. While static testing often yields a 0% Attack Success Rate (ASR), adaptive optimization recovers a 28% overall ASR and up to a 64% ASR in "action-open" tasks where agents delegate authority based on untrusted third-party data. This demonstrates a critical structural vulnerability in LLM agent workflows, necessitating a transition from static benchmarking to continuous, agentic red-teaming and robust system-level isolation.

The rapid integration of autonomous AI agents into enterprise workflows has introduced significant security visibility gaps, with 86% of organizations unable to monitor AI data flows and 83% lacking oversight of agentic actions. This exposure facilitates prompt injection attacks, where adversarial inputs bypass model-level alignment to execute unauthorized commands or exfiltrate data. To address this, a new layer of defense-in-depth is emerging through open-source frameworks like Rebuff, Augustus, and LLM Guard. These tools function as a generative AI Web Application Firewall (WAF), implementing programmable guardrails through input/output sanitization, adversarial detection heuristics, and LangChain integration layers to intercept and neutralize malicious payloads before they reach the Large Language Model (LLM).

The shift from passive Large Language Models (LLMs) to autonomous AI agents introduces a systemic governance gap where agents possess the capability to execute code and invoke APIs. The primary technical vector is Indirect Prompt Injection (IPI), which enables "agentic amplification"—a chain where external malicious instructions trigger unauthorized tool execution and permanent system state changes. Because agents operate as authorized internal entities, traditional perimeter defenses fail to detect these attacks. This paradox suggests that providing agents with the autonomy required for operational utility inherently increases the risk of unauthorized actions, sandbox escapes, and privilege escalation via over-privileged service accounts.

The TrustFall attack leverages indirect prompt injection to compromise autonomous AI coding agents, such as GitHub Copilot and Claude Code. Attackers poison repository metadata, README files, or configuration files with hidden instructions that the AI agent processes as authoritative commands. By exploiting the agents' high-level autonomy and shell privileges, attackers can induce the agent to execute unauthorized shell commands, modify dependency manifests (e.g., package.json), or exfiltrate sensitive environment variables and SSH keys. This vector allows for the silent introduction of backdoors into production software, as the developer perceives the malicious modifications as legitimate AI-driven optimizations or bug fixes.