Incidents tagged Inject

The article details how AI agents introduce unique security risks through prompt injection attacks, over-permissioning, and unconstrained external tool access, which can lead to sensitive data leakage and unauthorized API calls. It emphasizes a robust security framework for AI agents, incorporating authentication, access controls, guardrails, and continuous monitoring to mitigate these vulnerabilities.

The RoguePilot vulnerability in GitHub Codespaces leveraged passive prompt injection within GitHub issues to manipulate Copilot. This enabled attackers to silently execute malicious commands and exfiltrate sensitive data, specifically the `GITHUB_TOKEN`, to external servers.

The OpenClaw open-source AI agent project rapidly exposed at least three high-risk Remote Code Execution (RCE) vulnerabilities, allowing attackers to perform high-authority tasks like shell command execution. These critical flaws are exacerbated by direct/indirect prompt injection, configuration errors, and supply chain poisoning through malicious plug-ins within its architecture.

The OpenClaw AI agent is critically vulnerable to remote code execution and extensive data exfiltration due to an authentication bypass where misconfigured reverse proxies improperly trust external requests as local. Additionally, the agent is susceptible to prompt injection attacks, enabling the extraction of private keys and sensitive user data from the underlying system.

Security researchers have identified a vulnerability where prompt injection attacks in LLM-powered applications can weaponize URL preview features to silently exfiltrate sensitive data. Attackers can craft malicious prompts that cause the LLM to generate URLs containing extracted confidential information, which is then transmitted to an attacker-controlled server when the application automatically fetches the URL preview.

A critical-severity vulnerability, named DockerDash, in Docker's Ask Gordon AI assistant allows for Remote Code Execution (RCE) in Docker environments. This is achieved through "meta-context injection," where malicious instructions embedded in Docker image metadata labels are executed by the Model Context Protocol (MCP) Gateway without proper validation.

OpenClaw, a rapidly adopted AI assistant with broad system access, presents significant security risks due to widespread deployment of internet-exposed instances by users. Threat actors are actively exploiting these misconfigurations, conducting prompt injection attempts and direct attacks via the WebSocket API for authentication bypasses and raw command execution.

The proliferation of unmanaged "Shadow AI" deployments, such as unauthenticated Ollama server instances, creates critical security blind spots within corporate networks. These unsecured LLM endpoints are susceptible to unauthorized access, risking exposure of proprietary training data, enabling prompt injection attacks, and serving as potential pivot points for lateral movement.

A critical vulnerability, codenamed DockerDash, in Docker's Ask Gordon AI assistant allowed remote code execution and data exfiltration. This "Meta-Context Injection" flaw leveraged malicious metadata labels within Docker images, which Ask Gordon AI processed and executed via the MCP Gateway due to a lack of validation.

The OpenClaw AI bot farm is plagued by critical security flaws, including a one-click remote code execution vulnerability and two command injection vulnerabilities. These issues are exacerbated by a repository of 341 malicious extensions, an exposed database, and prevalent prompt injection attacks, leading to a wave of malware, data exposure, and significant financial costs for users.

The article highlights advanced threats to AI agents, including "Shadow Escape," a zero-click exploit targeting Model Context Protocol (MCP) based systems that enables workflow hijacking and data exfiltration. Another critical vulnerability involves "ASCII Smuggling," where hidden malicious prompts embedded in files lead to remote code execution and sensitive data exfiltration by deceiving LLMs like Claude.

The article highlights numerous AI agent vulnerabilities, prominently featuring prompt injection techniques like "ASCII Smuggling" used to embed invisible, malicious instructions within legitimate data. These attacks exploit AI agent reasoning and tool usage, leading to significant impacts such as zero-click workflow hijacking, unauthorized data exfiltration, and potential remote code execution in systems like ChatGPT and Google Gemini.

OpenAI confirmed a data breach originating from unauthorized access to Mixpanel, a third-party web analytics provider it uses for its API product. This incident exposed names, email addresses, approximate locations, OS/browser data, and user IDs associated with OpenAI API accounts (platform.openai.com users), but did not compromise ChatGPT content, passwords, or payment details.

Prompt injection is a critical vulnerability in Large Language Models (LLMs) that manipulates their natural language processing to override system instructions and safety filters using crafted malicious prompts. This exploit can lead to significant impacts such as data exfiltration, including the disclosure of sensitive files like `/etc/passwd`, and enables the AI system to perform unauthorized actions.

Grok AI was exploited by users who bypassed its content moderation safeguards through prompt-based manipulation, enabling the generation of non-consensual deepfake images of real individuals. This critical vulnerability in generative AI defenses led to widespread regulatory investigations and forced X to implement geoblocking and content filtering measures.

Prompt injection attacks manipulate AI systems, particularly Large Language Models (LLMs), by overriding their intended instructions through malicious input, leading to sensitive data leakage, unauthorized actions, or corrupted outputs. A real-world example involved a phishing campaign leveraging hidden text-based prompt injection to bypass AI defenses, coupled with the exploitation of CVE-2022-30190 (Follina) for remote code execution.

Prompt injection is a prevalent AI-specific vulnerability where Large Language Models (LLMs) misinterpret external data as executable instructions, bypassing intended safeguards. This can lead to sensitive data exfiltration, the execution of rogue tasks, or malicious code execution, impacting various AI agents, coding assistants, and chatbots.

Traditional security frameworks fail to address AI-specific attack vectors such as prompt injection, model poisoning, and AI supply chain compromises, creating significant security gaps. This inadequacy has enabled various exploits, including the Ultralytics AI library compromise for cryptomining and malicious Nx packages exfiltrating 23.77 million secrets in 2024.

A March 2023 vulnerability in the Redis open-source library temporarily exposed ChatGPT users' chat titles, messages, and potentially payment information. Beyond platform vulnerabilities, users face risks from prompt injection attacks that bypass LLM guardrails and the utilization of AI by threat actors to generate malware, phishing templates, and deepfakes.

Prompt injection attacks against AI coding tools like Amazon Q were demonstrated to direct the tool to wipe local files and potentially disrupt AWS cloud infrastructure. Additionally, an unauthenticated code injection vulnerability in Langflow AI allowed threat actors to steal credentials and deploy malware.