ActiveSecHarness proposes capability tokens for coding agents
On 252 fixtures, the authors report Ring 0 blocked every attack fixture with zero false positives in 12.7 microseconds.
Stories per day · 30 days
27 RSS
Relatedllm-agents26ai-agents24agent-security22mcp14openai12codex10claude9claude-code8anthropic7coding-agents7jailbreak7gemini6benchmark5guardrails5least-privilege5microsoft5npm5agentdojo4
367 stories, newest first · one card per story
Stories tagged #prompt-injection
External monitors outperform prompt guardrails against agent injection
On two Qwen2.5 models, a task-bound monitor admitted 1.3% and 7.7% of attacks after models proposed the attacker's call in 64% and 84%.
Web-agent harnesses stay vulnerable across prompt and page attacks
WebTrap Farm separates defensive failures from task limits and finds harness design, not only the model, shapes outcomes.
Agent swarms still break prompt-injection defenses on frontier models
Authors report an agentic attacker can make models obey tool-output instructions despite strong public benchmark scores.
PlanTERS formalizes relative security of prompt injection in agents
Revoking injectable tools at the first untrusted read is proved relatively secure on finite runs.
ArmedAgent finds safety risks in coding agents that control robot arms
The benchmark covers 36 tasks in five scenarios, including indirect prompt injection that can move from digital resources into physical actions.
Intent-graph audit checks agent tool calls without a per-call model
A deterministic loop checks each call in a median 5.7 microseconds, and flagged calls go to a reasoning guardian.
ErosionBench scores alignment decay in enterprise multi-agent systems
The benchmark has 1,728 scenarios and 198 image attacks; a Meta-Auditor reached 98.5% recall at 2.9% false positives.
Benign-trained probes miss tool-action errors under adversarial conditions
Scalar uncertainty beat the probe on AUROC and average precision for Qwen2.5-14B-Instruct under system override.
MCP Explained walks through the 2025-11-25 protocol and attack cases
The guide covers JSON-RPC shapes, deprecated batching, and defenses for tool poisoning, shadowing, and injection.
1
Detecting prompt injections in PDFs for AI agents
Describes judges to catch hidden text and prompt injections in financial PDFs processed by Claude AI agents.
1
Review maps 284 attacks on agentic AI systems
Tool, MCP, and action-layer attacks dominate, while only 278 of 660 attack-safeguard links are directly assessed.
Claude Dispatch flaw lets malicious browser extensions run code
Browser extensions can force Claude agents to run commands on connected devices via prompt injection.
1
ChatGPT Lockdown Mode bypass enables silent chat exfiltration
Check Point says ChatGPT Classic needs no click: a conversation can leak full history and open phishing popups.
1
Thought injection attacks succeed on reasoning agents
Thought injection via chain-of-thought reasoning traces achieves up to 50% ASR on agent objectives like reverse-shell exfiltration in production models.
Governing Agentic Identities in the Enterprise
AI agents inherit human privileges and face prompt-injection risks as enterprise proxies, per GTIG agent-based intrusions.
Benchmarking indirect prompt injection with task-tampering attacks
New benchmark tests task-tampering in indirect prompt injection across 90 cases in three tool-use environments, showing higher success on decision rules and actions than objective attacks.
SPILLWAY defends tool-using agents from prompt injection
SPILLWAY separates target admission from sanitization using tool output fields and fixed rules, achieving zero successful injections across backbones and task suites.
Check Point Researchers Uncover Prompt Adware in OpenAI Codex Jailbreak
Haiou jailbreak modifies AI instructions to insert ads for zz.aiapi2025.top in responses, forked 77 times on GitHub.
1
Baya web agent prevents prompt injections using compile-then-execute
Baya achieves 0% attack success on WASP benchmark compared to 25.5% for browser-only ReAct.
Haiou jailbreak toolkit secretly injects ads into OpenAI Codex responses
Haiou modifies AI agent instructions to display ads for zz.aiapi2025.top on user greetings.
1
AuthorityFlow defends LLM agents from parameter poisoning
AuthorityFlow reduces parameter poisoning success rate from 93% to 9% by tracing information flows in tool arguments.
Taxonomy identifies nine dimensions of prompt injection attacks
The taxonomy covers six real-world vulnerabilities and reveals gaps in nine existing benchmarks.
ATrust adaptively expands trust boundary to secure LLM agents
ATrust reduces AgentDyn attack success rate from 37.80% to 4.37% while boosting utility by 10% with GPT-4o.