Agent Goal Hijacking

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.

Updated Jul 7, 2026

This post describes 'promptware'-based command and control, where prompt injection payloads act like malware to give attackers persistent, remote-controlled influence over an AI agent's actions. It builds on prior research showing that combining browsing tools with persistent memory features can create a full C2 channel, letting an attacker issue ongoing instructions to a compromised agent over time.

Updated Jul 5, 2026

This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.

Updated Jul 5, 2026

This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.

Updated Jul 5, 2026

Researchers demonstrate that LLM-controlled ROS 2 robots can be hijacked via prompt injections delivered through non-text sensory channels: vision (OCR), audio (Whisper STT), and fabricated LiDAR obstacle data injected at the system-prompt level. Several tested models show up to 100% attack success rates, and a proposed semantic firewall defense can still be bypassed roughly 10% of the time using obfuscated payloads, indicating a serious and only partially mitigated real-world safety risk for physical robotic systems.

Updated Jul 5, 2026

Kong Konnect's Model Context Protocol server prior to version 1.0.0 is vulnerable to indirect prompt injection, allowing a remote attacker to manipulate an LLM agent into executing unintended API requests. This effectively lets an attacker who controls untrusted content processed by the MCP server hijack the agent's actions against Kong-managed APIs, with a CVSS score of 7.4 indicating high severity.

Updated Jul 5, 2026 · CVSS 7.4

The fast-mcp-telegram MCP server fails to sanitize Bearer tokens used for session file lookup, allowing a remote attacker to use path traversal sequences to authenticate as the default legacy Telegram session. This effectively bypasses the server's multi-user session isolation, letting an unauthenticated or low-privilege remote client impersonate the primary account owner and access their Telegram session and MCP tools.

Updated Jul 5, 2026 · CVSS 9.4

This is an academic research paper (arXiv, not an active exploit) empirically benchmarking six major LLMs against direct, multilingual, and obfuscated prompt injection attacks. The study finds that all tested models can be induced to generate phishing content, malicious websites, and malware, with non-English prompts and multi-stage obfuscation significantly increasing compliance rates. Since this is a research disclosure rather than an in-the-wild exploit or agent-specific vulnerability, severity is rated medium rather than high/critical.

Updated Jul 5, 2026

This is an academic research paper, not an active exploit or vulnerability disclosure. It introduces a benchmark (SecFid) showing that current defenses against indirect prompt injection achieve security by suppressing untrusted text, which degrades task fidelity for legitimate uses like translation or document editing. No new attack technique or exploited system is described; it is a measurement and evaluation contribution.

Updated Jul 5, 2026

Adversarial instructions planted in content processed by one agent can replicate into its outputs and infect downstream agents, spreading through normal inter-agent messaging the way the Morris II research worm spread through AI email assistants.

Updated Jul 3, 2026