prompt injection7 articles
The 5% Problem: Why Your AI Power Users Are Your Biggest Security Headache
New research from Akamai reveals that the top 5% of enterprise AI "power users" interact with AI tools at 12 times the rate of average employees, creating disproportionate security risks through shadow AI, data leakage, and unvetted autonomous tools operating outside corporate oversight. Nearly half of all enterprise AI conversations occur through personal rather than corporate-managed accounts, and 16% of AI browser extensions contain known security vulnerabilities, expanding the attack surface significantly. Security teams are urged to shift focus from broadly policing mainstream AI tools to identifying where AI is most deeply embedded in operations and whether those systems fall within established guardrails.
Encrypted Instructions Let Attackers Steal Your Grok Chats — And xAI Knew Months Ago
Researchers have discovered a technique called "Cryptographic Context Injection," in which malicious instructions are encrypted to bypass AI safety guardrails, causing models like Grok and Gemini to exfiltrate sensitive user data such as names, locations, and chat histories. The attack works because static safety filters scan content as plain text but cannot execute or decrypt code, meaning the harmful instructions only become readable after the model processes them internally — outside the guardrail's view. The findings highlight a fundamental and ongoing weakness in LLM security, as defenders are forced to build reactive, piecemeal guardrails rather than addressing the root vulnerability of prompt injection.
Emails and X Posts Used to Hijack Claude and ChatGPT's Agentic Browsers
AI security firm Zenity has revealed two attack techniques, collectively dubbed PleaseFix, targeting OpenAI's ChatGPT Atlas and Anthropic's Claude Chrome extension, showing how both can be hijacked through indirect prompt injection to carry out actions like phishing, unauthorized Amazon purchases, and full account takeover. ChatGPT Atlas is exploited via malicious content planted on sites like X, which redirects the agentic browser to perform harmful actions across authenticated sessions on other platforms, while Claude can be compromised through hidden instructions embedded in emails that silently exfiltrate Gmail data, Google Drive files, and account credentials. Both vulnerabilities stem from the fundamental design of agentic browsers rather than traditional software bugs, making them difficult to patch, and while the findings were reported to OpenAI and Anthropic in early 2026, no straightforward fixes have been issued.
HalluSquatting: How AI Coding Assistants Could Be Turned Into Botnet Recruitment Tools
Researchers have discovered a new AI attack called **HalluSquatting**, which exploits the tendency of large language models (LLMs) to hallucinate incorrect resource locations — such as repository URLs — up to 92% of the time for recently published content. Attackers can predict these hallucinated locations in advance, register them, and plant malicious code (such as reverse shells) that AI coding assistants like Cursor, GitHub Copilot, and Gemini CLI will automatically retrieve and execute. Unlike previous prompt injection attacks that required targeting individuals one by one, HalluSquatting scales massively, potentially enabling large botnets, DDoS attacks, and ransomware campaigns with minimal attacker effort.
AI Agents Are Being Tricked Into Sending Crypto Payments via Poisoned Web Content
Threat actors are exploiting prompt injection attacks embedded in malicious websites and manipulated search results to deceive AI agents into making unauthorised cryptocurrency payments. Zscaler identified two campaigns using these techniques: one involving a fake Python library site that instructs AI agents to pay for an API key, and another typosquatting the DeFi platform DeBank to trick agents into treating the fraudulent site as legitimate. Testing against 26 large language models found that four were successfully manipulated into making payments, highlighting the growing security risks as AI agents become more autonomous web users.
BioShocking: The Attack That Tricks AI Browsers Into Thinking Credential Theft Is Just Winning a Game
Cybersecurity researchers at LayerX discovered a manipulation technique called "BioShocking," where a game-themed puzzle tricks AI browsers into abandoning their safety guardrails and performing malicious actions, such as stealing SSH login credentials from authenticated repositories. The attack works by convincing the AI agent it is operating under game logic rather than real-world safety rules, causing it to treat harmful actions as acceptable moves to win. Of the six vendors notified, only OpenAI successfully patched the vulnerability, while others either failed to fix it or did not respond.
Anthropic Quietly Fixed a Claude Code Sandbox Bypass Nobody Told You About
Anthropic quietly fixed two vulnerabilities in Claude Code's network sandbox that could have allowed attackers to bypass network restrictions and exfiltrate sensitive data. The second flaw, discovered by researcher Aonan Guan, involved a SOCKS5 null-byte injection trick that could fool the allowlist filter into permitting connections to unauthorized hosts. Guan has criticized Anthropic for lacking transparency, noting no CVE was assigned to his finding and no public disclosure or release notes warned users — though Anthropic states the fix was deployed before his bug bounty report was submitted.