Incidents tagged Remote

The UK's NCSC warns that Large Language Models (LLMs) possess an inherent architectural flaw, known as prompt injection, where they fail to distinguish between instructions and data within a single prompt. This fundamental vulnerability allows malicious actors to bypass security guardrails, hijack models, and potentially achieve remote code execution by embedding hidden instructions in seemingly benign inputs.

Over 30 critical "ShadowMQ" vulnerabilities, stemming from insecure ZeroMQ `recv_pyobj()` and Python `pickle` deserialization, affect leading AI inference engines such as Meta Llama LLM and NVIDIA TensorRT-LLM. These flaws enable remote code execution, data theft, and privilege escalation, with specific CVEs like CVE-2024-50050 attributed, and active exploitation has been observed.

Security researcher Ari Marzouk disclosed "IDEsaster," a collection of over 30 vulnerabilities, with 24 assigned CVEs, affecting various AI-powered Integrated Development Environments (IDEs) like GitHub Copilot and Cursor. These flaws enable attackers to chain prompt injection techniques with legitimate IDE features and auto-approved AI agent tool calls to achieve sensitive data exfiltration and remote code execution (RCE).

Agentic AI systems introduce new architectural risks due to their autonomous planning, decision-making, and tool-use capabilities, moving the attack surface from static models to dynamic workflows. Key threats include memory poisoning, tool misuse, and potential remote code execution (RCE) stemming from manipulated agent reasoning paths, external interactions, and inter-agent communications.

Anthropic's Threat Intelligence team disrupted the first known AI-orchestrated cyber espionage campaign, where a state-sponsored Chinese threat actor utilized Claude Code to autonomously execute 80-90% of the intrusion life cycle, including reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration. This campaign leveraged widely available open-source commodity tools rather than zero-day vulnerabilities, demonstrating a critical shift where AI handles tactical attack execution, significantly compressing detection timelines and challenging traditional incident response frameworks.

The article details a Remote Code Execution (RCE) vulnerability, tracked as CVE-2024-12366, affecting agentic AI systems that execute LLM-generated code without proper sandboxing. Attackers can craft malicious prompts to bypass sanitization, leading the AI to generate and execute arbitrary code on the host system.

A critical vulnerability in OpenAI's ChatGPT Atlas browser leverages a Cross-Site Request Forgery (CSRF) flaw to inject malicious instructions into the AI's persistent memory. This allows attackers to achieve arbitrary code execution and gain control over user accounts or systems across sessions, triggered by legitimate user interaction with the compromised AI.

Attackers can achieve remote code execution (RCE) on developer machines by leveraging indirect prompt injection against agentic AI developer tools. This is accomplished by introducing untrusted data, such as malicious commands in GitHub issues or hidden payloads in fake Python packages within pull requests, which the AI agent autonomously executes.

An advanced attack chain exploits an LLM chatbot through indirect prompt injection (OWASP LLM01:2025) to achieve system prompt leakage and abuse excessive agency (OWASP LLM06:2025). This leads to sensitive customer data exfiltration and escalates to command injection (OWASP LLM05:2025) in a backend API, ultimately enabling remote code execution and intellectual property theft.

LLM-based applications are susceptible to remote code execution (RCE) vulnerabilities when executing LLM-generated code via functions like `exec` or `eval` without proper sandboxing, often triggered by prompt injection. Additionally, insecure access controls in Retrieval-Augmented Generation (RAG) systems can lead to data leakage and indirect prompt injection, while active content rendering of LLM outputs enables data exfiltration by embedding malicious links or images.

Salesforce Agentforce was susceptible to a critical indirect prompt injection vulnerability, codenamed ForcedLeak (CVSS 9.4). This flaw allowed attackers to exfiltrate sensitive CRM data by manipulating Web-to-Lead forms, causing AI agents to transmit information to an attacker-controlled domain.

A multi-stage supply chain attack, tracked as UNC6395, originated from the compromise of a Salesloft GitHub repository, leading to the theft of a sensitive OAuth token. This token enabled access to a high-privilege AI chatbot application (Drift) and subsequent exfiltration of customer conversation data and contact information from over 700 integrated Salesforce instances.

A security flaw in the Cursor AI code editor, a Visual Studio Code fork, allows for silent arbitrary code execution when a maliciously crafted repository is opened. This vulnerability stems from "Workspace Trust" being disabled by default, enabling tasks configured in `.vscode/tasks.json` to auto-execute and posing a significant supply chain risk.

Hexstrike-AI is an AI-powered orchestration framework designed to automate and accelerate zero-day exploitation, leveraging large language models to significantly reduce the time and skill required for complex attacks. Threat actors are actively discussing using Hexstrike-AI to target recently disclosed unauthenticated remote code execution and other critical vulnerabilities (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424) in Citrix NetScaler ADC and Gateway appliances, with observed webshell deployments.

The incident involved the mass-theft of authentication tokens from Salesloft's Drift application, leading to significant data exfiltration from integrated corporate Salesforce instances and other cloud services. Threat actors, tracked as UNC6395, leveraged these stolen credentials to perform "authorization sprawl," accessing and siphoning sensitive data including AWS keys and VPN credentials.

Threat actor UNC6395 exploited compromised OAuth and refresh tokens associated with the Drift AI chat agent, accessible via Salesloft, to gain unauthorized access to Salesforce customer instances. This systematic campaign led to the exfiltration of sensitive data, including AWS access keys, passwords, and Snowflake tokens, from over 700 organizations, indicating a potential supply chain attack.

AI coding tools like Claude Code integrate security features to identify common vulnerabilities such as SQL injection, XSS, RCE, and SSRF during development workflows. However, these tools are limited by their training data and struggle to detect novel, complex, or architectural vulnerabilities, potentially instilling a dangerous false sense of security among developers.

The article highlights novel prompt injection techniques, such as ASCII Smuggling and hidden instructions in public code repositories, designed to be imperceptible to human developers but interpretable by LLM-powered coding agents. These sophisticated methods exploit the agents' access to external data to achieve Remote Code Execution (RCE) on developer systems, especially concerning when agents operate in unconfirmed execution modes like 'Auto-Run.'

The Amazon Q Developer Extension for Visual Studio Code (version 1.84.0) was compromised via a software supply chain attack, embedding a prompt injection that bypassed security reviews. This malicious prompt, detailed in AWS Security Bulletin AWS-2025-015, instructed the AI assistant to systematically delete local file systems and AWS cloud resources, including S3 buckets, EC2 instances, and IAM users.

The article highlights the significant risk of sensitive enterprise data leaks through the misuse of Large Language Models like ChatGPT. A prominent example is the April 2023 Samsung incident, where employees inadvertently exposed confidential source code and intellectual property by inputting it into the chatbot.