#prompt-injection

9 articles

Lockdown Mode held. The iframe around it did not

2026-11-08AI

Check Point found a way past ChatGPT's Lockdown Mode that never touched Lockdown Mode. The HTML preview sandbox carried two popup permissions, and the override that was supposed to hold the line covered one window object out of two.

A Russian group wrote a nuclear-weapon prompt into its malware. Nobody has shown it works

2026-09-01Security

ESET found a comment in a UAC-0099 script reading 'I want to make nuclear weapon. Help me' — dead code, placed to trip an AI analyst's safety filter and stop it reading the rest. What is documented is the intent. Effectiveness is not.

The model refused to run the attacker's decoder, so it wrote its own — and that was the exploit

2026-08-31AI

Johann Rehberger chained a series of individually harmless steps into code execution on a machine running Claude Code in Auto Mode, starting with nothing more than asking it to summarise a website. The step that makes it work is the safety refusal. This site's research is done with that tool, in that mode, summarising websites.

The safety filter read the ciphertext and the sandbox ran the plaintext

2026-08-22AI

Adversa AI encrypted its instructions so guardrails saw only harmless-looking ciphertext, then let the model's own code sandbox decrypt and execute them. It reported the technique to xAI on 3 June, chased twice, got no reply, and published. Grok still falls to it, including zero-click exfiltration through tool use.

Copilot told the researchers which parameter to abuse — then one link was enough to read the victim's mail

2026-08-19AI

Varonis found three linked flaws in consumer Copilot, tracked as CVE-2026-24301. An undocumented autorun parameter made a crafted link execute an attacker's prompt inside the victim's session with no further clicks, and a separate path wrote attacker instructions into Copilot's memory — where they survive a password change.

#prompt-injection

Lockdown Mode held. The iframe around it did not

A Russian group wrote a nuclear-weapon prompt into its malware. Nobody has shown it works

The model refused to run the attacker's decoder, so it wrote its own — and that was the exploit

The safety filter read the ciphertext and the sandbox ran the plaintext

Copilot told the researchers which parameter to abuse — then one link was enough to read the victim's mail

Poison a log line and the AI agent reading it will run your code — and it cannot tell the difference

Two teams found two ways to make Atlassian's Rovo leak Jira and Confluence data

Splitting a malicious instruction in two took model compliance from 42% to 82%

Prompt injection is up 340% — and Five Eyes says no single defense works