prompt injection4 articles
HalluSquatting: How AI Coding Assistants Could Be Turned Into Botnet Recruitment Tools
Researchers have discovered a new AI attack called **HalluSquatting**, which exploits the tendency of large language models (LLMs) to hallucinate incorrect resource locations — such as repository URLs — up to 92% of the time for recently published content. Attackers can predict these hallucinated locations in advance, register them, and plant malicious code (such as reverse shells) that AI coding assistants like Cursor, GitHub Copilot, and Gemini CLI will automatically retrieve and execute. Unlike previous prompt injection attacks that required targeting individuals one by one, HalluSquatting scales massively, potentially enabling large botnets, DDoS attacks, and ransomware campaigns with minimal attacker effort.
AI Agents Are Being Tricked Into Sending Crypto Payments via Poisoned Web Content
Threat actors are exploiting prompt injection attacks embedded in malicious websites and manipulated search results to deceive AI agents into making unauthorised cryptocurrency payments. Zscaler identified two campaigns using these techniques: one involving a fake Python library site that instructs AI agents to pay for an API key, and another typosquatting the DeFi platform DeBank to trick agents into treating the fraudulent site as legitimate. Testing against 26 large language models found that four were successfully manipulated into making payments, highlighting the growing security risks as AI agents become more autonomous web users.
BioShocking: The Attack That Tricks AI Browsers Into Thinking Credential Theft Is Just Winning a Game
Cybersecurity researchers at LayerX discovered a manipulation technique called "BioShocking," where a game-themed puzzle tricks AI browsers into abandoning their safety guardrails and performing malicious actions, such as stealing SSH login credentials from authenticated repositories. The attack works by convincing the AI agent it is operating under game logic rather than real-world safety rules, causing it to treat harmful actions as acceptable moves to win. Of the six vendors notified, only OpenAI successfully patched the vulnerability, while others either failed to fix it or did not respond.
Anthropic Quietly Fixed a Claude Code Sandbox Bypass Nobody Told You About
Anthropic quietly fixed two vulnerabilities in Claude Code's network sandbox that could have allowed attackers to bypass network restrictions and exfiltrate sensitive data. The second flaw, discovered by researcher Aonan Guan, involved a SOCKS5 null-byte injection trick that could fool the allowlist filter into permitting connections to unauthorized hosts. Guan has criticized Anthropic for lacking transparency, noting no CVE was assigned to his finding and no public disclosure or release notes warned users — though Anthropic states the fix was deployed before his bug bounty report was submitted.