Incidents tagged in

Researchers demonstrated that as few as 250 poisoned documents can create a backdoor vulnerability in large language models, irrespective of model size or training data volume. This data poisoning technique, which can induce denial-of-service or potentially facilitate data exfiltration, challenges prior assumptions about the required scale of malicious training data during pretraining.

Attackers can achieve remote code execution (RCE) on developer machines by leveraging indirect prompt injection against agentic AI developer tools. This is accomplished by introducing untrusted data, such as malicious commands in GitHub issues or hidden payloads in fake Python packages within pull requests, which the AI agent autonomously executes.

Threat actors are employing Large Language Models (LLMs) to create sophisticated phishing campaigns, leveraging LLM-generated code to obfuscate malicious payloads within Scalable Vector Graphics (SVG) files. These meticulously crafted SVG files bypass email security by disguising embedded JavaScript with business terminology, ultimately redirecting victims to fake login pages for credential harvesting.

A multi-stage supply chain attack, tracked as UNC6395, originated from the compromise of a Salesloft GitHub repository, leading to the theft of a sensitive OAuth token. This token enabled access to a high-privilege AI chatbot application (Drift) and subsequent exfiltration of customer conversation data and contact information from over 700 integrated Salesforce instances.

Threat actor UNC6395 exploited compromised OAuth and refresh tokens associated with the Drift AI chat agent, accessible via Salesloft, to gain unauthorized access to Salesforce customer instances. This systematic campaign led to the exfiltration of sensitive data, including AWS access keys, passwords, and Snowflake tokens, from over 700 organizations, indicating a potential supply chain attack.

Lenovo's GPT-4-powered chatbot "Lena" was vulnerable to cross-site scripting (XSS) attacks due to improper input and output sanitization, initiated by a malicious prompt. This allowed attackers to steal session cookies and potentially gain unauthorized access to customer support systems, facilitating further system command execution and lateral movement.

The article highlights novel prompt injection techniques, such as ASCII Smuggling and hidden instructions in public code repositories, designed to be imperceptible to human developers but interpretable by LLM-powered coding agents. These sophisticated methods exploit the agents' access to external data to achieve Remote Code Execution (RCE) on developer systems, especially concerning when agents operate in unconfirmed execution modes like 'Auto-Run.'

Enterprise AI assistants have been identified as vulnerable to abuse, potentially enabling unauthorized data theft. This exploitation pathway also allows for the manipulation of enterprise data or the behavior of these AI systems.

The Amazon Q Developer Extension for Visual Studio Code (version 1.84.0) was compromised via a software supply chain attack, embedding a prompt injection that bypassed security reviews. This malicious prompt, detailed in AWS Security Bulletin AWS-2025-015, instructed the AI assistant to systematically delete local file systems and AWS cloud resources, including S3 buckets, EC2 instances, and IAM users.

The McHire AI hiring bot, developed by Paradox.ai, suffered from basic security misconfigurations, specifically allowing unauthorized access via easily guessable weak passwords like '123456'. This critical flaw resulted in the data exposure of personal information, résumés, and contact details for tens of millions of McDonald's job applicants.

The article highlights critical security risks in AI and LLM deployments, specifically prompt injection and jailbreak attacks, which enable manipulation for unauthorized actions, sensitive data exposure, and compliance failures. These rapid exploits, alongside data leakage and model theft, pose significant financial and reputational impacts on enterprises leveraging AI technologies.

Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.

The article highlights critical security gaps in Large Language Model (LLM) applications, detailing common vulnerabilities such as prompt injection, sensitive information disclosure, and supply chain compromises. These flaws, categorized by the OWASP Top 10 for LLM Applications, can lead to unintended LLM behavior, data exposure, and other serious consequences.

A remotely exploitable zero-day vulnerability, CVE-2025-37899, has been discovered in the Linux kernel's Server Message Block (SMB) protocol using OpenAI's o3 model. This critical flaw is identified as a use-after-free bug in the SMB 'logoff' command handler, allowing an object to be freed while still accessible by another thread.

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.