Promptective journal / Topic index

AI security

16 journal entries tagged AI security.

An incoming form card enters a metal sorter connected to separate record and correspondence trays

Article25 September 20265 min read

SalesBleed prompt injection: a public CRM lead reaches account data and Slack

Zenity Labs shows how an indirect prompt injection in a public Web-to-Lead form reached Salesforce Agentforce account data and Slack. The reported chains are patched.

Read article

An aluminium selector holds removable cartridges beside a separate slot returning a strip of paper

Article24 September 20265 min read

Prompt injection in MCP: first win the tool call, then redirect the agent

A benchmark study separates two trust boundaries: the metadata that wins a tool call and the return content that redirects the agent after it runs.

A two-stage MCP prompt injection study wins tool calls with optimised metadata, then redirects agents through malicious tool returns. Both boundaries need policy.

Read article

A cream envelope and amber maintenance card rest against a dark metal server panel

Article23 September 20265 min read

Prompt injection in email agents: a fake mailbox fault becomes permission

A revised study shows how a forged mailbox fault can make an unauthorised mailbox operation look like routine maintenance, and why verified state and authorised action are separate controls.

A revised study shows how forged mailbox faults can steer email agents into unauthorised actions, and why verified state and action authorisation are separate checks.

Read article

Four separately tagged paper spools feed distinct strips into an aluminium reader

Article22 September 20265 min read

Prompt injection and source authority: can a model tell who supplied the text?

A preprint labels every input token with its origin and adds a learned attention bias, so suppression follows where text came from.

A new preprint labels each input token with its origin and adds a learned attention bias, reporting near-zero prompt-injection attack success.

Read article

A strip-chart monitoring record reaches an open server drawer on a terracotta work surface

Article20 September 20265 min read

Prompt injection in telemetry: how an SRE agent deployed the wrong fix

A controlled Kubernetes demonstration shows how attacker-controlled monitoring data became an apparent instruction to repair infrastructure.

Straiker’s lab shows how indirect prompt injection in telemetry led an SRE agent to deploy a privileged Kubernetes workload, enabling ransomware effects.

Read article

A support-ticket card beside a computing module with an exposed service-connection cable

Article19 September 20265 min read

Prompt injection in AWS AgentCore: when a vaulted credential becomes readable

Unit 42’s controlled support-agent demonstration traces a poisoned ticket through shell access to a replayable downstream credential.

Unit 42’s AWS AgentCore prompt injection research shows how shell access exposed an in-use credential, with lessons for tool scope and runtime isolation.

Read article

An open phone chassis with exposed circuitry lies beside a closed laptop and precision tool on a pale workbench

Article16 September 20265 min read

DeepSeek V4.1 Flash reportedly finds a Samsung GPU driver vulnerability

A researcher says the model produced a race-condition use-after-free in the sgpu driver. The claim now needs independent confirmation and a vendor response.

Exocija says DeepSeek V4.1 Flash found a race use-after-free in Samsung’s sgpu GPU driver. Here is what the claim shows about AI vulnerability discovery, and what remains unverified.

Read article

An aluminium relay with its lid slid aside exposes copper circuitry between two dark blue cables

Article11 September 20266 min read

Your API router can hijack your AI agent

A study of 428 commodity routers finds tool-call tampering and credential abuse. The findings put intermediary trust on the AI security checklist.

Research finds malicious LLM API routers rewriting agent tool calls and abusing credentials. Learn the findings, defence limits and checks for security teams.

Read article

A dark instruction sheet lies among pale project documents and extends beneath a laptop showing a code editor

Article10 September 20265 min read

Prompt injection in the wild: DUSTMAKER targets coding assistants

Google reports malicious workspace instructions and loader comments aimed at AI tools. The two techniques cross different trust boundaries.

Google reports a DUSTMAKER prompt injection attack targeting coding assistants. Learn how workspace instructions cross trust boundaries and what teams can check.

Read article

An image display and voice recorder sit beside a mechanical fingertip hovering above an unpressed blue switch

Article10 September 20267 min read

Multimodal prompt injection: why attempted actions matter

A study of image and audio inputs shows why agent evaluations need to record what was attempted, what reached a tool and what completed.

Explore multimodal prompt injection examples from a new preprint, and learn why attempted actions, tool calls and completed attacks need separate measures.

Read article

A mechanical agent arm crosses a cobalt workspace boundary towards a sensitive local-file card

Article1 September 20265 min read

SiYuan fixes prompt-injection path to SSH keys and cloud credentials

CVE-2026-82233 shows how an AI agent’s ordinary upload tool can turn hidden instructions and an approved tool call into sensitive local-file exposure.

CVE-2026-82233 let SiYuan’s AI agent copy sensitive local files through MCP, showing why tool approvals need action-level policy.

Read article

A malicious repository directs an AI agent to read a sensitive file and make an outbound request

Article29 August 20265 min read

A malicious repository could turn Amazon Kiro into a data-exfiltration path

A Kiro prompt-injection flaw shows how repository content can steer an AI coding agent towards sensitive files, configuration changes and data exfiltration.

Read article