Prompt Injection

A vulnerability in the Ansible Lightspeed MCP server allows an attacker to use indirect prompt injection to manipulate the AI agent into writing files outside of intended directories. This path traversal flaw can expose sensitive host data and enable execution of malicious commands, potentially leading to full system compromise. The CVSS score of 6.6 reflects meaningful but not maximal severity, likely due to required conditions like agent exposure to untrusted content.

Updated Jul 22, 2026 · CVSS 6.6

Researchers found that hidden text on an ordinary web page could hijack AWS Kiro, an agentic coding IDE, causing it to rewrite its own configuration file and execute attacker-controlled code without any human approval step. A simple task like asking Kiro to summarize a webpage was enough to trigger full remote code execution on the developer's machine. AWS has since patched the flaw, though no CVE has been assigned.

Updated Jul 22, 2026

This is an academic research paper introducing a benchmark for testing how well LLM agent defenders resist adaptive, multi-round prompt injection attacks driven by other LLMs. It is not a report of an active exploit or vulnerability in a deployed system, but a methodology and dataset release showing that adaptive multi-turn attackers achieve modestly higher success rates than single-turn attacks against frontier models. Severity is low as a threat item since it describes research tooling and findings rather than a concrete exploitable weakness in a specific product.

Updated Jul 21, 2026

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

Updated Jul 21, 2026

This is an academic paper describing a defensive framework (Neural Cryptographic Services) that mitigates prompt-injection-driven tool hijacking in agentic workflows, not a new attack or active exploit. It highlights the well-known underlying threat—authenticated agents being manipulated via prompt injection to execute unintended but identity-valid tool calls—and proposes cryptographic gating as a countermeasure. Severity is low since no exploit, vulnerable product, or active threat is disclosed here.

Updated Jul 20, 2026

This is academic research (not an active exploit) demonstrating that using humor as an indirect refusal mechanism in LLMs can itself introduce hidden safety risks. The authors show that a crafted attack, HumorPIA, can covertly embed harmful or toxic content inside seemingly safe humorous outputs, significantly increasing toxicity while evading existing safety detectors.

Updated Jul 20, 2026

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.

Updated Jul 17, 2026

The BetterDocs WordPress plugin before version 4.5.5 lets unauthenticated users trigger an AI documentation-summary feature whose output is stored and rendered without sanitization. An attacker can craft input that causes the AI to emit malicious HTML/JavaScript, which then executes as stored XSS in the browser of anyone viewing the page, including site administrators.

Updated Jul 16, 2026

This is a defensive research paper, not a disclosed vulnerability or active exploit. It proposes PVDetector, a training-free method to detect prompt injection attacks against purpose-specific LLM agents by analyzing hidden activation states for 'policy-violation' concepts rather than just input/output text. Since the raw data describes a detection technique intended to help defenders, it does not itself constitute a threat.

Updated Jul 15, 2026

Researchers demonstrate that malicious text placed in the physical environment (e.g., signs, labels) can be captured by camera-equipped smart glasses and hijack the behavior of Vision-Language Models, causing them to ignore true visual context and produce harmful, biased, or false outputs. This is a research paper describing a demonstrated but not actively exploited class of attack, with success rates up to 96% in simulation and 60% in real-world tests across 12 VLM models.

Updated Jul 14, 2026

This is an academic benchmark paper (NetInjectBench), not an active exploit, demonstrating that LLM agents used for network operations can be manipulated via indirect prompt injection embedded in tickets, alerts, logs, and ChatOps messages to trigger unsafe tool actions. The researchers show naive agents execute unsafe actions 82.5% of the time under attack, but a metadata-aware execution-time policy gate can reduce this to near-zero while preserving usefulness. The severity is rated medium because this is defensive research quantifying and mitigating a known risk class rather than a disclosed vulnerability in a specific deployed product.

Updated Jul 14, 2026

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

Updated Jul 12, 2026

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

Updated Jul 11, 2026 · CVSS 7.5

PraisonAI's built-in prompt injection defense only blocks attacks rated CRITICAL, which requires three or more detector families to agree. This leaves a gap where cleverly crafted single- or double-vector injections score as HIGH and slip through untouched, reaching the underlying model. The flaw is a detection logic weakness rather than a full bypass of all protections, making it moderately severe.

Updated Jul 10, 2026 · CVSS 5.3

This is an academic defense paper (not an active exploit report) presenting 'Prismata', a system that mitigates cross-site prompt injection in web browsing agents by dynamically labeling page content trust levels and restricting agent capabilities accordingly. It describes a well-known class of attack (untrusted webpage content hijacking agent instructions) and proposes mitigations rather than disclosing a new vulnerability. Severity is rated low because this raw data itself is defensive research, not a new exploit or active threat.

Updated Jul 10, 2026

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.

Updated Jul 10, 2026

Researchers at the AI Now Institute demonstrated an attack called 'Friendly Fire' where malicious source code, submitted for automated security review, tricks AI coding agents like Claude Code and OpenAI Codex into executing the attacker's payload on the host machine. This occurs when the agents run in autonomous modes that self-approve actions, turning a defensive scanning tool into a code execution vector.

Updated Jul 9, 2026

This is an academic defense paper, not an active exploit report. It describes and mitigates 'stored IPI', a known weakness in Dual-LLM prompt injection defenses where untrusted data written to disk/environment and later reread loses its 'untrusted symbol' tagging and becomes trusted again. The paper's proposed solution, DualView, is presented as fully blocking this class of attack in benchmarks, so the actual residual risk described here is low and mainly relevant to agents using prior, incomplete Dual-LLM protections.

Updated Jul 7, 2026

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

Updated Jul 7, 2026

This is a defensive research paper, not a description of an active threat or exploit. It proposes a method (UCM) to protect web-browsing AI agents from prompt injection by redacting untrusted DOM regions before the agent sees them and routing interactions through a sandboxed, privilege-separated interface. Severity is low because no vulnerability is being disclosed here — the paper describes a mitigation, though it implicitly confirms that web agents remain broadly susceptible to prompt injection absent such defenses.

Updated Jul 7, 2026