This report discusses a novel approach to preventing prompt injection attacks in AI agent communication by enforcing containment as a structural property rather than relying on detection. The approach involves wrapping all incoming commands from peer agents as quoted data that cannot be interpreted as executable commands, effectively preventing unauthorized actions even if malicious input is accepted. The implementation is a 33 KB JavaScript module running entirely client-side without any language model or server interaction. It uses cryptographic signature verification and deterministic checks to block forged or replayed messages, unapproved agents, and unauthorized tokens. This containment layer ensures that even if an attack payload is delivered normally, it cannot be executed, eliminating the need for detection-based defenses. The solution is demonstrated interactively in a browser environment and is not a vulnerability or exploit but a security design concept.
Research by Peyton Kennedy reveals that several AI orchestration platforms, including NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow, ship with remote code execution (RCE) capabilities by design. These platforms assume that anyone who can modify a workflow is trusted to execute code on the host, an assumption that is unsafe for multi-tenant HTTP services exposed to unauthenticated webhooks. The research documents 14 findings showing that unauthenticated requests can lead to RCE through prompt injection and bypassing of regex-based filters. Some vendors consider this behavior intentional, reflecting a mismatch between developer tool threat models and production deployment risks. The full research was presented at DEFCON 34 and is publicly available.
An AI pentesting engine named Cascade successfully bypassed a production AI agent's prompt-injection guardrail by reframing its request, causing the agent to disclose its entire system prompt, including tool lists, calling rules, citation formats, and session IDs. The bypass did not rely on technical vulnerabilities but on social engineering-like prompt reframing that made the request appear reasonable to the agent. This finding highlights a novel attack vector against AI agents relying on prompt-based guardrails.
This research highlights a design compromise in the Windows kernel related to Supervisor Mode Access Prevention (SMAP). Specifically, it experimentally confirms that SMAP is effectively disabled during standard IOCTL dispatches, allowing a stack pivot into user-mode memory without triggering SMAP protections. This behavior stems from the Windows kernel not being originally built with SMAP in mind, and retrofitting it would require extensive changes. The finding is a confirmation of an architectural limitation rather than a newly discovered vulnerability with an active exploit.
This report discusses Google's upcoming Chrome protection against browser extensions that silently hijack users' default search engines and New Tab pages. The issue involves many extensions abusing this behavior without users' awareness. The protection aims to reduce this abuse by blocking such extensions by default. The information is sourced from a Reddit post linking to MalExt, a database tracking malicious browser extensions. No specific vulnerability or exploit details are provided, and no affected software versions are explicitly stated.
EvilFontTool is a font-based deception technique that uses specially crafted fonts to display different text to human readers than what is actually stored in the document's machine-readable text. This allows attackers to manipulate documents such as HTML, DOCX, and PDFs to bypass security tools, evade AI content filters, and perform social engineering or red team operations. The technique can be used to poison help desk documentation, bypass email filters, and create traps within corporate networks. Demonstrations show how commands that appear benign to a user can actually execute malicious actions when copied and pasted.
An exposed open directory at a staging server revealed an active intrusion by operators linked to The Gentlemen ransomware group. The operation involved establishing persistent access through privileged account creation, credential theft via LSASS dumping, and lateral movement across a Windows domain. Attackers deployed multiple implants including EtherRAT, which retrieves command-and-control domains from an Ethereum smart contract, alongside Sliver and custom Go reverse shells. Lateral movement was achieved through remote scheduled tasks distributing MSI payloads, while security products were disabled and reverse tunnels established for persistent access. The infrastructure and tactics align with previously documented The Gentlemen campaigns, including a ClickFix operation deploying EtherRAT.
Xpsd is an open-source tool designed to analyze whether reported CVEs or vulnerability scan findings are actually reachable in a given source code tree. It integrates with GitHub code scanning and uses an LLM-driven approach combined with structural code navigation and advisory lookups to provide verdicts on vulnerability reachability. The tool helps developers prioritize which vulnerabilities pose real risks in their codebase by providing evidence, call paths, and SARIF reports. It supports multiple vulnerability report formats and can be integrated into CI workflows. There is no indication that Xpsd itself is a vulnerability or threat.
The state of vibe-coded app security: my analysis of 549 self-described AI-generated repos (study + raw data)
Source: https://ogbuilds.ai/studies/vibe-coded-security
BrainDrain: A Chrome extension that collects your AI prompts without you ever opening it and has 100k users, 9 AI platforms
Source: https://chromewebstore.google.com/detail/prompt-optimizer-secondbr/aajjgdpofhhcjmjoombjdfepplndhgcp
The Chrome extension "Planet Search" with approximately 2 million installs is a search hijacker that routes all user queries through a chain of undisclosed redirects ending at nextgeeker.com, a domain flagged by multiple vendors as a browser hijacker. The extension declares itself as a default search provider but does not disclose the intermediate redirects or the affiliate monetization relationship. The extension's code is minimal and does not reveal this behavior, as the redirect logic is entirely server-side. Users receive standard Google Custom Search results, but their queries transit through third-party domains that may observe search data. The extension is published by FREE VPN PLANET SRL, which also offers other extensions under investigation. The threat was reported to the Chrome Web Store and Google Safe Browsing on 2026-07-25.
This report describes a paid bug-bounty-style game conducted against a multimodal prompt firewall designed to detect prompt injection and jailbreak attempts targeting large language models (LLMs). The project includes open-source code, a fine-tuned DeBERTa-v3-large binary classifier model, and a dataset of 13,230 real-world attack attempts collected over a year. The detector uses a two-stage approach combining regex pattern matching and machine learning inference to filter malicious inputs across multiple modalities including text, images, documents, and audio. The dataset and tooling are intended as a mitigation layer rather than a complete solution, and the author encourages further testing and improvement. No direct vulnerability or exploit is reported, and no patch or fix is applicable as this is a defensive research artifact.
A Broken Access Control vulnerability was discovered in Immich, a self-hosted media platform. The flaw allows any user to access photos stored in a locked folder without entering the required PIN. This occurs because one of the search endpoints (POST /search/random) does not enforce the PIN protection, exposing locked assets of the caller and their partners. Immich uses a PIN-elevated session to protect sensitive media, but this endpoint bypasses that control.
This report describes an AI-powered reconnaissance agent tool recently shared on a public forum. The tool is presented as a minimum viable product (MVP) for conducting reconnaissance on specified targets in a controlled lab environment. There is no indication of a vulnerability or exploit associated with the tool itself. No affected software versions or patch information are provided. The tool appears to be a new offering for security professionals to experiment with automated reconnaissance capabilities.
A family of 11 Chrome extensions named "AI Chat Exporter" falsely claim in their store listings that no chat data is uploaded to external servers and that all processing is local. However, during PDF export, these extensions send the full chat content to a developer-controlled cloud backend. Other export formats leak partial chat data via usage beacons. The extensions also track users across devices using a persistent client ID stored in Chrome sync storage. Approximately 5,500 users are affected on the main extension. This behavior contradicts the stated privacy claims and exposes sensitive chat content to unauthorized external servers.
This content discusses the concept of using timing and temporal observability as a defensive security metric, particularly in agentic AI systems. It highlights that while timing has traditionally been viewed as a health metric, it can also reveal security-relevant behavioral patterns. The referenced paper systematically surveys security threats and defenses in LLM-based AI agents, proposing a layered attack surface model that includes temporal dimensions of threats. The discussion notes that temporal anomaly detection and intra-execution timing analysis are under-explored areas in AI security research.
The Drift Corpus is a publicly available collection of binary diffs for over 240 Windows kernel patches released in 2026. It breaks down Microsoft's monthly kernel patches into detailed binary changes, including changed functions, bug classes, call chains, and root causes. This resource aids researchers in understanding the precise nature of kernel fixes, enabling improved detection and mitigation strategies. The corpus covers a wide range of vulnerabilities such as integer overflows, use-after-free, race conditions, and buffer overflows, all fixed in official Microsoft patches. No direct exploits are reported in the wild. The corpus itself is not a vulnerability but a research tool that exposes detailed patch information to facilitate security analysis and defensive improvements.
DuneSlide is a set of two critical remote code execution (RCE) vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor IDE. These vulnerabilities enable zero-click prompt injection, allowing an attacker to cause the IDE's AI agent to ingest attacker-controlled content from untrusted sources and perform actions such as sandbox escape, arbitrary file writes, and unsandboxed remote code execution without user interaction. The attack does not require opening malicious files or running attacker code directly. The research highlights the importance of sandboxing as well as controlling inputs, permissions, and execution boundaries.
A cluster of 50 Chrome extensions, all sharing the same codebase, backend infrastructure, Firebase project, and a hardcoded API key, has been identified. These extensions, collectively installed around 15,500 times, form a white-label WhatsApp CRM platform. The platform replaces WhatsApp Web's Content Security Policy (CSP), maintains persistent communication via Server-Sent Events (SSE) and Firebase Cloud Messaging, and includes voice transcription and backend backup APIs. Multiple privacy policies exist with inconsistent descriptions of the platform and omit several backend communication mechanisms. This raises privacy and security concerns due to centralized control and potential misuse of user data.