prompt injection

Bilingual

Copirate 365: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)
3 days ago
- The talk covers multiple vulnerabilities in M365 and Consumer Copilot, including data exfiltration via HTML preview using CSS background images and font-faces, bypassing CSP restrictions.
- Delayed Tool Invocation (DTI) allows attackers to plant instructions for later execution, enabling persistent compromises.
- M365 Copilot's long-term memory feature, enabled by default without audit logs, can be manipulated via prompt injection to add or delete memories, compromising future conversations.
- The SpAIware attack combines memory persistence with data exfiltration, using prompt injection to create malicious memories that automatically exfiltrate user secrets like passwords via HTML preview.
more...
Document-borne AI worms can self-propagate through Copilot for Word
3 days ago
- Attackers can embed hidden instructions in Word documents that cause Microsoft Copilot to alter content and propagate the attack to new documents, creating a self-replicating AI worm.
- The attack exploits the trust boundary between attached documents and the current drafting document, as Copilot treats all text in its context as potentially authoritative.
- No robust mitigation exists for the broader vulnerability class; Microsoft's fixes closed specific payloads but not the underlying architectural weakness.
- Once propagated, the attack becomes difficult to trace because affected documents are created by legitimate users and may spread across organizations via shared SharePoint or Teams.
more...
A quote from Boris Cherny
5 days ago
- Opus 5 is highlighted as having the lowest susceptibility to prompt injection among evaluations.
- The claim is supported by both prompt injection evaluations and red teaming efforts.
- The significance of this reduction in prompt injection vulnerability is emphasized over other evaluation scores.
People are deceiving the justice system with AI
7 days ago
- Lawyers in Brazil attempted to deceive the justice system by hiding instructions in white text within petitions, targeting the AI system Galileu used by the court. The AI detected the attempt, leading to sanctions.
- This 'prompt injection' technique is not science fiction but an expected development, with legal frameworks like Spain's already considering AI use in courts.
- Prompt injection involves inserting hidden prompts to manipulate AI systems, and similar tactics have been used in education and hiring to detect or influence AI behavior.
- The legal world is particularly vulnerable due to the high volume of documents and the state's authority, with prior cases of lawyers using AI to fabricate case law.
more...
Prismata: Confining cross-site prompt injection in web agents
22 days ago
- Prismata is a defense mechanism for web agents to prevent cross-site prompt injection attacks.
- It enforces contextual least privilege by deriving dynamic trust labels for page content and restricting agent capabilities.
- The system provides structural confinement guarantees to bound labeling errors, ensuring labels can only decrease in privilege.
- Prismata requires no developer annotations, making it applicable to a wide range of websites.
more...
Hackers can use 9 of the most popular AI tools to assemble botnets
24 days ago
- Prompt injection is the top AI security threat because LLMs cannot distinguish between legitimate and malicious instructions.
- Current guardrails only mitigate damage without solving the root cause of separating trusted from untrusted sources.
- Push-based attacks target individuals (e.g., via email) and are limited in scale, while pull-based attacks (e.g., from websites) have also been limited in scale.
- HalluSquatting is a new pull-based attack that exploits LLM hallucinations to target AI coding assistants and agents, enabling large-scale exploits like botnet assembly and DDoS attacks.
more...
GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos
25 days ago
- Noma Labs discovered GitLost, a critical prompt injection vulnerability in GitHub's new Agentic Workflows.
- Exploit allows an unauthenticated attacker to exfiltrate data from private repositories by posting a crafted issue in a public repository of the same organization.
- The GitHub AI agent, triggered by workflow events, treats malicious instructions hidden in issue content as trusted commands.
- Attackers can leverage keywords like 'Additionally' to bypass GitHub's guardrails and leak private data.
more...
Possible evidence of literal prompt injection by Anthropic
a month ago
- The post suggests possible evidence of literal prompt injection related to Anthropic
- It was submitted by a user named johnnyApplePRNG
- The discussion appears to be from old.reddit.com
- There are currently 15 comments on this post

prompt injection

Copirate 365: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299)

Document-borne AI worms can self-propagate through Copilot for Word

A quote from Boris Cherny

People are deceiving the justice system with AI

Prismata: Confining cross-site prompt injection in web agents

Hackers can use 9 of the most popular AI tools to assemble botnets

GitLost: We Tricked GitHub's AI Agent into Leaking Private Repos

Possible evidence of literal prompt injection by Anthropic