Agent Goal Hijacking

This is an academic paper (not an active exploit) that defines a threat model called the 'hijacked authorized agent problem' for LLM agents operating in HPC environments. It argues that agents inheriting a user's credentials to manage Slurm jobs, logs, and files can be redirected by adversarial instructions embedded in logs, tool descriptions, or peer-agent messages, even though every resulting action remains fully authenticated and permitted. The paper proposes a research agenda and a benchmark (TaskBound) rather than demonstrating a working attack.

Updated Jul 22, 2026

This is a defensive research paper describing a pre-deployment pipeline that scans, hardens, and validates agentic applications against data leakage and prompt injection, rather than describing a new attack or active exploit. It proposes mitigations such as schema tightening, boundary sanitization, and allowlist-based tool gating, and reports strong empirical reductions in leakage on benchmark and real-world agents. Since this is a protective methodology rather than a vulnerability disclosure, severity is low from a threat perspective, though it is highly relevant to defenders.

Updated Jul 22, 2026

Researchers found that hidden text on an ordinary web page could hijack AWS Kiro, an agentic coding IDE, causing it to rewrite its own configuration file and execute attacker-controlled code without any human approval step. A simple task like asking Kiro to summarize a webpage was enough to trigger full remote code execution on the developer's machine. AWS has since patched the flaw, though no CVE has been assigned.

Updated Jul 22, 2026

This is an academic research paper (not an active exploit) demonstrating a novel attack against multi-hop RAG agents called 'Salience Induction,' which manipulates fact position, emphasis, and framing in retrieved documents to redirect an agent's reasoning without injecting false facts or instructions. The authors also propose a defense, Salience Normalization, that substantially reduces attack success. This is a legitimate, disclosed research contribution rather than an in-the-wild threat, but it identifies a real and previously underexplored weakness in agentic RAG reasoning pipelines.

Updated Jul 21, 2026

This is an academic research paper introducing a benchmark for testing how well LLM agent defenders resist adaptive, multi-round prompt injection attacks driven by other LLMs. It is not a report of an active exploit or vulnerability in a deployed system, but a methodology and dataset release showing that adaptive multi-turn attackers achieve modestly higher success rates than single-turn attacks against frontier models. Severity is low as a threat item since it describes research tooling and findings rather than a concrete exploitable weakness in a specific product.

Updated Jul 21, 2026

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

Updated Jul 21, 2026

This is an academic paper describing a defensive framework (Neural Cryptographic Services) that mitigates prompt-injection-driven tool hijacking in agentic workflows, not a new attack or active exploit. It highlights the well-known underlying threat—authenticated agents being manipulated via prompt injection to execute unintended but identity-valid tool calls—and proposes cryptographic gating as a countermeasure. Severity is low since no exploit, vulnerable product, or active threat is disclosed here.

Updated Jul 20, 2026

Hugging Face disclosed a security incident it attributes to an autonomous AI agent conducting an intrusion end-to-end, and a separate report describes 'JADEPUFFER,' an alleged agent-driven ransomware capable of real-time adaptation. Both reports indicate a shift toward AI systems autonomously executing attack chains, but the JADEPUFFER report lacks victim identification and methodology transparency, limiting verifiability. Severity is high due to the plausibility and real-world implications of autonomous offensive agents, but confidence is tempered by sparse technical detail in the secondary source.

Updated Jul 20, 2026

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability chain allowing any unauthenticated network attacker to obtain superuser credentials and execute arbitrary code on the server. This affects default deployments of a widely used AI agent-building platform, giving attackers full control of the host and any connected agent workflows, data, or credentials.

Updated Jul 18, 2026 · CVSS 9.8

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.

Updated Jul 17, 2026

This is a defensive research paper, not a disclosed vulnerability or active exploit. It proposes PVDetector, a training-free method to detect prompt injection attacks against purpose-specific LLM agents by analyzing hidden activation states for 'policy-violation' concepts rather than just input/output text. Since the raw data describes a detection technique intended to help defenders, it does not itself constitute a threat.

Updated Jul 15, 2026

Researchers demonstrate that malicious text placed in the physical environment (e.g., signs, labels) can be captured by camera-equipped smart glasses and hijack the behavior of Vision-Language Models, causing them to ignore true visual context and produce harmful, biased, or false outputs. This is a research paper describing a demonstrated but not actively exploited class of attack, with success rates up to 96% in simulation and 60% in real-world tests across 12 VLM models.

Updated Jul 14, 2026

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.

Updated Jul 13, 2026 · CVSS 9.8

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

Updated Jul 12, 2026

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

Updated Jul 11, 2026 · CVSS 7.5

PraisonAI's built-in prompt injection defense only blocks attacks rated CRITICAL, which requires three or more detector families to agree. This leaves a gap where cleverly crafted single- or double-vector injections score as HIGH and slip through untouched, reaching the underlying model. The flaw is a detection logic weakness rather than a full bypass of all protections, making it moderately severe.

Updated Jul 10, 2026 · CVSS 5.3

This is an academic defense paper (not an active exploit report) presenting 'Prismata', a system that mitigates cross-site prompt injection in web browsing agents by dynamically labeling page content trust levels and restricting agent capabilities accordingly. It describes a well-known class of attack (untrusted webpage content hijacking agent instructions) and proposes mitigations rather than disclosing a new vulnerability. Severity is rated low because this raw data itself is defensive research, not a new exploit or active threat.

Updated Jul 10, 2026

Researchers at the AI Now Institute demonstrated an attack called 'Friendly Fire' where malicious source code, submitted for automated security review, tricks AI coding agents like Claude Code and OpenAI Codex into executing the attacker's payload on the host machine. This occurs when the agents run in autonomous modes that self-approve actions, turning a defensive scanning tool into a code execution vector.

Updated Jul 9, 2026

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

Updated Jul 7, 2026

This is a defensive research paper, not a description of an active threat or exploit. It proposes a method (UCM) to protect web-browsing AI agents from prompt injection by redacting untrusted DOM regions before the agent sees them and routing interactions through a sandboxed, privilege-separated interface. Severity is low because no vulnerability is being disclosed here — the paper describes a mitigation, though it implicitly confirms that web agents remain broadly susceptible to prompt injection absent such defenses.

Updated Jul 7, 2026