Threat Library

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

A coordinated campaign involving 737 free VPN and proxy Chrome extensions, published across at least 40 developer accounts, has been found intercepting browser traffic and routing it through attacker-controlled proxy infrastructure. The campaign primarily targets Russian-speaking users attempting to bypass service blocks, with 274 extensions identified as impersonating 66 legitimate brands, and has amassed over 75,000 installs.

Security researchers at Tracebit demonstrated a defensive technique called 'context bombing,' which plants prompt injections next to decoy secrets (passwords, API keys) in cloud environments. When an autonomous AI hacking agent discovers and reads these decoys, the embedded injection triggers the attacker LLM's own safety guardrails, causing it to refuse and halt the intrusion. This is a legitimate, low-risk defensive use of prompt injection rather than a novel attack, though it highlights the broader unreliability of LLM instruction boundaries.

Kimwolf v7, an evolution of the AISURU Android/IoT botnet, was discovered by Palo Alto Networks Unit 42 in February 2026 with enhanced HTTP/2-based DDoS capabilities designed to blend malicious traffic with legitimate browsing patterns. The improvements increase operational resilience and evasion, making detection and mitigation more difficult for defenders relying on traditional traffic-signature analysis.

This is a research paper (not an active exploit) that benchmarks static analysis techniques against malicious 'Agent Skills' — installable instruction/script packages for LLM agents. The authors show static analysis catches data exfiltration and steganographic payloads well but completely misses host-destruction attacks using common shell commands and largely misses natural-language prompt injection, highlighting a real supply-chain detection gap for agent skill marketplaces.

ToolJet, a platform used to build internal tools and AI agents, fails to verify that the organizationId in the URL path matches the authenticated user's actual organization membership when calling its ToolJet Database API. Any authenticated user can manipulate the tj-workspace-id header and the target organizationId to read or modify database tables belonging to other tenants, including table schemas, rows, and data used by that tenant's workflows or agents. This is a broken object-level authorization (IDOR) vulnerability rather than a novel AI-specific attack, but it directly threatens the confidentiality and integrity of data feeding AI agents built on the platform.

This is an academic research paper introducing StepJack, a benchmark that demonstrates how indirect prompt injection attacks against computer-use agents (CUAs) become significantly more effective when the adversarial goal is split across multiple innocuous-looking sub-steps distributed across a chain of web pages. It is not an active exploit, but the findings show meaningfully higher attack success rates against several state-of-the-art CUAs compared to single-step injection, indicating a real and underexplored gap in current agent safety defenses. Severity is rated medium because this is disclosed research with a public benchmark rather than an in-the-wild attack, but the technique is practically reproducible.

An MCP server tool (read_webpage) fails to validate the 'url' argument, allowing server-side request forgery when a malicious or manipulated URL is passed to it. Exploitation requires local access, which limits severity but still poses risk in multi-tenant or agent-orchestrated environments where untrusted input reaches this tool. A patch is available and should be applied.

Gen's H1 2026 Threat Report details two distinct financially-motivated attack chains: one leveraging compromised legitimate business email accounts combined with browser manipulation to deliver banking malware, and another using clipboard hijacking malware to silently redirect cryptocurrency payments to attacker-controlled wallets. Both campaigns rely on abusing trust in legitimate channels (real inboxes, clipboard contents) rather than novel exploits, making detection via traditional signature-based tools more difficult.

This is an editorial/news item about Anthropic making 'auto mode' the default in Claude Code, reducing human permission prompts in favor of automated risk judgments. Anthropic cites a third-party eval claiming zero successful indirect prompt injections out of 720 attempts, but the author (a respected security researcher) is skeptical that the lethal trifecta problem is truly solved, noting the eval's narrow scope (72 held-out scenarios) and that 11% of dangerous-action tests still slipped past auto mode. This is not a disclosed exploit but a discussion of risk trade-offs in agent autonomy design.

Levi Strauss & Co. disclosed that attackers used social engineering tactics against three employees to gain unauthorized access to corporate data stored on their machines. The incident resulted in the theft of corporate information, though full scope of the compromised data has not been publicly detailed. This represents a targeted human-layer attack rather than a technical exploit of infrastructure.

Johnson Controls TL280 camera devices running firmware versions below 5.63 contain a vulnerability involving use of a broken or risky cryptographic algorithm, tracked as CVE-2026-27871, which stems from hardcoded credentials embedded in the firmware. Successful exploitation could allow an attacker to access sensitive information on the device, though the attack requires high complexity and privileges. Johnson Controls has released firmware 5.63 to remediate the issue and recommends network segmentation and credential rotation as mitigations.

A heap out-of-bounds write vulnerability (CVE-2026-17264) affects Medixant RadiAnt DICOM Viewer versions 2025.2 and earlier, triggered by opening a maliciously crafted DICOM file with malformed JPEG-compressed pixel data. Successful exploitation could crash the application or potentially allow remote code execution, though built-in exploit mitigations (CFG, DEP, ASLR) reduce practical exploitability. No known public exploitation has been reported to date.

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api versions up to 1.11.9, specifically in the dynamic client registration handling code. A remote attacker can exploit this flaw to make the MCP server issue unauthorized requests to internal or arbitrary network destinations. The issue is fixed in version 1.11.10.

This is a research paper (not an active exploit) demonstrating that proprietary 'skills' offered by AI agent platforms can have their hidden functionality functionally cloned purely through legitimate use, without ever disclosing the underlying files. The method, SkillClone, builds an interface hypothesis from public documentation, probes the skill with structured benign queries, and iteratively synthesizes and repairs a replica using differential validation against real outputs. This shows that file-disclosure defenses are insufficient to protect proprietary agent logic, since functional secrecy can be broken through cumulative, non-malicious-looking interactions.

This is a research paper describing PIMiner, an academic agentic red-teaming system that automatically discovers and transfers prompt injection strategies against LLM agents like Gemini, GPT-5.1, and Claude. It is a defensive/evaluative research tool rather than an active in-the-wild exploit, but it demonstrates high attack success rates (up to 86.7%) with very few queries, meaning its techniques could be repurposed by attackers to efficiently craft prompt injections against production agents. Severity is moderate because it is disclosed research intended to improve defenses, not an observed live attack campaign.

OpenAI disrupted a Cambodia-based scam network operating out of Poipet that used coordinated ChatGPT accounts to generate content for investment fraud, romance scams, illegal gambling promotion, and law enforcement impersonation schemes. The operation leveraged generative AI to scale social engineering content creation and craft convincing fraudulent communications targeting victims across multiple scam categories. OpenAI banned the associated accounts as part of its abuse enforcement efforts.

Langflow OSS, a framework used to build AI agent and LLM workflows, contains a server-side request forgery vulnerability caused by incomplete SSRF protections. An attacker able to supply URLs or trigger outbound requests through Langflow components could force the server to reach internal or restricted network resources.