Zenity researchers found that a crafted ChatGPT URL could make the Workspace Agents builder create, configure, publish, and run an attacker-controlled enterprise agent after one click. The forged agent inherited previously authorized connectors, changed approval settings to "Never ask," scheduled itself to poll the attacker's email every five minutes, and could search or act across Outlook, Gmail, Slack, Drive, SharePoint, calendars, and Teams. Researchers used the controlled agent to map a mock organization, collect sensitive documents and credentials, and send internal phishing messages. OpenAI fixed the issue within four days of disclosure. No exploitation in the wild was reported, which leaves this as a demonstrated production hazard rather than a confirmed customer breach.

Oasis Security found that Claude Desktop's custom claude:// URL scheme could open the app and submit an attacker-written prompt without showing the full text or asking the user to press Send. A crafted link could therefore turn one click into an agent instruction. In the default setup, researchers chained the flaw with a previously disclosed route to copy conversation history. With Anthropic's optional Filesystem Server installed, the same entry point could reach local files, persistence, or code execution. Oasis reported the issue to Anthropic, which fixed it in Claude Desktop 1.1.2321. No real-world exploitation was reported.

ASSET researchers built a malicious pull request that hid its operative instruction inside a PNG image. Text-only AI reviewers passed the change. After merge, several vision-capable coding-agent configurations read the image, opened a seeded .env secrets file, and wrote its contents into source code as a tuple of integers that ordinary secret scanners did not recognize. Claude Code refused the same request in the researchers' tests. GhostCommit used controlled repositories and fake credentials, so it is a demonstrated supply-chain hazard rather than a confirmed theft from a real project.

AI Now researchers showed that Claude Code and Codex could be tricked into running attacker code while reviewing an untrusted library for security problems. With optional modes that let safety classifiers approve commands without a person checking each one, injected instructions got a disguised payload past the automated check. The controlled proof of concept achieved first-stage attacker-controlled execution on the review machine, without demonstrating sandbox escape, persistence, privilege escalation, or lateral movement. The Hacker News reported no known real-world use.

Wiz found GhostApproval across six AI coding assistants: malicious repositories could hide symbolic links that redirected agent file operations outside the workspace. Wiz demonstrated misleading approval paths in some products, writes before meaningful approval in others, and silent external access in another. At the July disclosure, three vendors had fixed their reported issues, two had not announced fixes, and Anthropic disputed the classification. The Hacker News reported no sign of real-world use.

Researchers demonstrated HalluSquatting, which predicts repository and skill names AI agents are likely to invent, registers them, and waits. Tests against nine production tools achieved remote code execution or unauthorized tool use in controlled runs. No real-world infections were reported.

Researchers demonstrated agent data injection against shipping browser and coding agents from Anthropic, Google, OpenAI, and Nanobrowser. Instead of hiding a command in hostile content, the attack forged data that looked like trusted interface metadata, code authorship, or a tool response. Tested agents clicked an attacker-selected button, ran a command associated with a fake repository maintainer, or accepted a forged security check before a merge. The July 2026 study found the technique worked across six frontier models and demonstrated failures in six real agent products. It documented controlled proof-of-concept failures, not known attacks against customers, and found that defenses built for conventional instruction injection often missed the different trust-boundary failure.

Noma researchers demonstrated GitLost, an indirect prompt-injection flaw in GitHub Agentic Workflows. A person who lacked organization access and private-repository access could submit a crafted public issue. Assignment of that issue then triggered a workflow with broader permissions. In the controlled proof of concept, the agent read one private test repository's README and posted it in a public issue comment. The sources do not report a customer incident and do not prove exploitation never occurred. Noma documented no official fix or substantive GitHub response.

Researchers demonstrated MemGhost, a one-email prompt-injection attack against persistent personal agents. The email caused an agent to save a false fact, conceal the write from the user, and rely on the fiction in a later session. Across 56 held-out cases, the full chain succeeded in 87.5 percent of background runs against OpenClaw with GPT-5.4 and 71.4 percent against a researcher-built Claude Code software-development-kit agent using Sonnet 4.6. The experiments used isolated inboxes and mock users, so MemGhost is a demonstrated hazard rather than evidence of attacks against real accounts.

Zscaler found two live campaigns building web content for AI agents: fake documentation for a nonexistent Python package that instructed agents to pay for an API key, and a counterfeit DeBank site that told agents it was the real financial platform. Researchers connected 26 models to an autonomous agent with web-browsing and payment powers. Four models completed a cryptocurrency payment after reading the injected instructions. In a separate test without a trusted reference for the real site, two others trusted the counterfeit DeBank page. The transfers occurred in controlled tests, but the agents did exactly what the hostile pages asked them to do.

Security researchers tested five open-source Android AI-agent frameworks and found every one susceptible to at least six of seven attacks involving hidden screen instructions, spoofed interfaces, screenshot tampering, or unsafe control channels. Host-side command injection succeeded in all 20 trials against each of four frameworks, and a chained AppAgent demonstration turned an instruction hidden on a phone into a command on its Windows controller. The work was confined to laboratory devices and synthetic tasks. No users, production systems, or private data were involved, and the researchers knew of no exploitation in the wild.

LayerX taught six agentic browsers and plugins to treat unsafe actions as game rules. Every agent entered an authenticated test repository and copied simulated SSH credentials. No real customer data was stolen, but LayerX reported only one working vendor fix at publication.

On June 29, 2026, researchers at Mozilla's Zero Day Investigative Network (0DIN) published a proof-of-concept showing that a GitHub repository containing no malicious code can still hijack an agentic coding tool like Claude Code. The repo ships normal-looking setup notes and a Python package engineered to fail on first run with an error telling the user to run an init command. The agent, trying to be helpful, runs it; the init script resolves an attacker-controlled DNS TXT record and pipes the result to bash, spawning a reverse shell on the developer's machine. The payload never lives in the repo, so scanners, human reviewers, and the agent itself never see it. It is a demonstrated hazard, not a confirmed in-the-wild attack.

In June 2026, Microsoft's own researchers disclosed AutoJack, a vulnerability chain in AutoGen Studio, the open-source prototyping interface for Microsoft Research's AutoGen multi-agent framework. When an AI web-browsing agent loaded an attacker-controlled page, the page's JavaScript could reach a privileged local service the agent relied on and spawn arbitrary processes on the host, full code execution under the account running the agent, with no login and no further user interaction once the agent opened the page. The flaw was found by research, not exploited in the wild, and per Microsoft the affected code was never shipped in a released package; only developers who built the tool from its main source branch were exposed, and the project was patched. It is a clean illustration of why an agent that browses untrusted content while holding local power is a hazard by design.

In June 2026, Varonis Threat Labs disclosed SearchLeak (CVE-2026-42824), a one-click data-exfiltration chain in Microsoft 365 Copilot Enterprise Search. The novel piece was "parameter-to-prompt" injection: the q parameter in a legitimate Copilot search URL was handed to the AI as executable instructions rather than treated as a search term. Chained with an HTML rendering race condition and a Bing image-search SSRF that slipped past the page's allowlist, a single click on a trusted Microsoft link could make Copilot read the victim's mailbox and files and quietly ship out emails, MFA codes, meeting details and SharePoint or OneDrive content. Copilot ran with the user's full Microsoft Graph permissions, so the blast radius was whatever that user could see. Microsoft fixed it server-side and rated it critical; there's no confirmed in-the-wild exploitation, so this one's a hazard, not a body count.

On June 9, 2026, Tenet Security disclosed "Agentjacking," a controlled attack that abused public Sentry DSNs and the Sentry MCP server to plant fake remediation steps inside error events. When developers asked AI coding agents to fix those Sentry issues, agents including Claude Code, Cursor, and Codex treated the injected text as trusted diagnostic guidance and ran attacker-controlled npm commands. Tenet said it found 2,388 organizations with injectable DSNs and confirmed more than 100 controlled agent executions. The old observability pipeline became a delivery truck for prompt injection, which is not what anyone meant by "shift left."

In June 2026, Brave disclosed indirect prompt-injection vulnerabilities in Mozilla Tabstack and Cotypist. In the Tabstack case, researchers asked a cloud-hosted AI web agent to summarize a page, but hidden text on that page instructed the agent to navigate to an external form, paste the user's conversation history and task context, and submit it. Tabstack confirmed and patched the issue before public disclosure. Cotypist, a local macOS autocomplete tool, could also be influenced by hidden instructions in local content, though its human tab-to-accept model limited the blast radius. What mattered was the shared context window rather than where the model ran.

In the first week of June 2026, a self-replicating supply-chain worm called Miasma treated AI coding agent configuration as its primary attack surface. It planted files like .claude/settings.json, .cursor/rules/setup.mdc, .gemini/settings.json and .vscode/tasks.json that auto-execute the moment a developer opens a cloned repo in Claude Code, Cursor, Gemini CLI or VS Code; no npm install required. On June 5 it rode a compromised contributor account into Microsoft's Azure/durabletask, and GitHub disabled 73 repositories across four Microsoft orgs in about 105 seconds, briefly breaking the Azure Functions deploy action for everyone. The worm harvested cloud keys, GitHub tokens and AI provider keys, then exfiltrated to attacker-controlled GitHub repos. Zero CVEs were ever assigned, because nothing here was technically a bug; the agents did exactly what they were designed to do.

Cymulate researchers demonstrated that Amazon's Kiro IDE before version 0.11 could be steered by prompt injection into writing an attacker-controlled shell command to .vscode/tasks.json without approval. The task could execute when the developer next opened the trusted workspace. Amazon assigned CVE-2026-10591, rated it High, and fixed the flaw by protecting execution-sensitive paths. The research established a workable remote code execution chain across Windows, macOS, and Linux, but identified no real-world exploitation or victims.

Cornell Tech researchers showed that deep-research agents can repeatedly pull from the same user-generated pages, turning Reddit, Wikipedia, Quora, and similar sites into convenient little steering wheels for AI search. In tests against STORM, Co-STORM, and OmniThink, a single poisoned URL with about 13 words of attacker-chosen text produced conditional mention rates of 38% to 51%. Multi-URL targeting pushed that higher. 404 Media tied the research to the already-growing AI-engine optimization industry, because apparently SEO was not enough of a sewage treatment problem.

In May 2026, Cyera Research disclosed "Claw Chain," a set of four chainable vulnerabilities in OpenClaw, one of the most widely deployed open-source AI agent platforms. CVE-2026-44112 (CVSS 9.6) is a time-of-check / time-of-use race in the OpenShell managed sandbox that lets attacker writes escape the intended mount root. CVE-2026-44113 (CVSS 7.7) lets reads escape it. CVE-2026-44115 (CVSS 8.8) leaks API keys and tokens through insufficient command validation. CVE-2026-44118 (CVSS 7.8) blindly trusts a client-controlled ownership flag, allowing a local process with a valid bearer token to escalate to owner-level. Chained, the four bugs go from initial foothold to data theft to persistent backdoor inside the agent's own sandbox. Roughly 65,000 to 180,000 OpenClaw instances were publicly reachable at disclosure. All four were patched in 2026.4.22.

Microsoft disclosed two Semantic Kernel vulnerabilities showing how prompt injection can stop being a content problem and become host compromise. In one case, an AI-controlled search parameter flowed into Python eval logic. In the other, an agent-exposed file-transfer helper could be driven to write outside its intended sandbox. The fixes were available, but the research is the useful part: once an AI agent can call tools, every model-controlled parameter is attacker-controlled input wearing a nicer jacket.

On May 4, 2026, a Bankr-provisioned wallet associated with Grok sent roughly 3 billion DRB tokens to an attacker after Grok decoded an obfuscated public X reply into a transaction command. Bankr's agent treated the generated instruction as authorization, which is a lovely way to discover that "the model said it" is not a signing ceremony.

Pillar Security disclosed on April 20, 2026 that Google Antigravity's `find_by_name` tool passed a model-controlled pattern into the underlying `fd` search utility without enough validation. A prompt injection could stage a file, pass an execution flag through a search parameter, and get code execution even with Secure Mode enabled. Wonderful news for anyone who thought a setting named Secure Mode was the end of the conversation.

Straiker disclosed NomShub, a Cursor vulnerability chain that combined malicious repository instructions, agent sandbox escape, and abuse of Cursor's remote tunnel feature. SecurityWeek reported that the chain could let attackers hijack developer machines by hiding prompts inside malicious repositories. The scary part was that a coding assistant could be steered into creating a remote access path on the developer's own device, rather than just writing bad code.

OX Security published research in April 2026 arguing that Anthropic's Model Context Protocol, especially STDIO-based spawning of MCP servers, embeds a systemic command-execution pattern that ripples across SDKs and downstream tools. They claim 150M+ downloads, thousands of exposed servers, and up to 200K vulnerable instances, filed ten-plus CVEs across projects like LiteLLM, Windsurf, and GPT Researcher, and say Anthropic declined protocol-level changes, treating the behavior as by design. The Register and trade press amplified the dispute; defenders of MCP argue sanitization belongs in each integration.

Security researcher Aonan Guan and Johns Hopkins collaborators showed that Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent could be hijacked through GitHub PR titles, issue bodies, and comments. The agents treated untrusted repository text as instructions, executed tool actions, and leaked tokens or API keys back through GitHub comments, logs, or commits. The finding turned GitHub itself into the exfiltration channel.

Capsule Security disclosed ShareLeak in Microsoft Copilot Studio and PipeLeak in Salesforce Agentforce, two prompt injection findings where ordinary business inputs such as SharePoint comments and lead forms could steer enterprise agents into leaking data through authorized workflows. Microsoft assigned CVE-2026-21520 to the Copilot Studio issue, and reporting from VentureBeat and CSO described the broader failure: agents connected to email, CRM, and business data were interpreting public form text as instructions.

The RSA Conference (RSAC) research team chained a Unicode right-to-left display control with the Neural Exec prompt-injection method to bypass input filtering, model safeguards, and output filtering in Apple's on-device model. The attack succeeded in 76 of 100 prompts in that randomized test set. Researchers demonstrated attacker-controlled model output, and The Register reported a contact-creation demonstration. The researchers said protections shipped in iOS 26.4 and macOS 26.4. The reports cite no real-world cases.

On April 7, 2026, researchers at Noma Security disclosed GrafanaGhost, a prompt-injection attack path against Grafana's AI components that could route sensitive observability data toward an attacker-controlled server. Grafana patched the issue and disputed the "zero-click" framing, saying there was no evidence of in-the-wild exploitation or Grafana Cloud data leakage. Even so, the pattern is ugly: operational logs became prompt delivery, and the assistant could become the courier.

BeyondTrust Phantom Labs found a critical command injection vulnerability in OpenAI's Codex coding agent. Malicious Git branch names - disguised with invisible Unicode characters - could execute arbitrary shell commands inside the Codex container and exfiltrate GitHub OAuth tokens. The attack worked across the ChatGPT website, Codex CLI, SDK, and IDE extensions, and could be triggered automatically by setting a poisoned branch as the repository default. OpenAI classified it as Critical Priority 1 and patched it across multiple rounds of fixes through early 2026.

Oasis Security disclosed Claudy Day, a chained attack against Claude.ai that combined invisible URL-based prompt injection, Anthropic's Files API, and an open redirect on claude.com. A victim could click what looked like a trusted Claude search result, land in a normal Claude.ai chat with hidden instructions already planted in the prompt, and have Claude search prior conversations or memory for sensitive data before uploading the results to an attacker-controlled Anthropic account. Anthropic fixed the prompt-injection issue after responsible disclosure, while Oasis said the remaining issues were still being addressed when the report went public.

PromptArmor disclosed that Snowflake's Cortex Code (CoCo) CLI agent could be hijacked through indirect prompt injection. A malicious instruction hidden in a third-party GitHub repository README caused the agent to download and run a script, bypass its human-in-the-loop approval step, and - by being talked into setting an unsandboxed execution flag - run the attacker's command entirely outside its sandbox, using the victim's active Snowflake credentials. That opened the door to data exfiltration or dropping tables. The bypass abused process-substitution syntax that the agent's command allowlist failed to validate. Tracked as CVE-2026-6442, Snowflake validated it and shipped a fix in Cortex Code 1.0.25 on February 28, 2026; coordinated public disclosure followed on March 16, 2026. No confirmed real-world exploitation was reported.

Security researchers at Zenity Labs disclosed PleaseFix, a family of vulnerabilities in Perplexity's Comet agentic browser so severe that a calendar invite was all it took to hijack the AI agent, exfiltrate local files, and steal 1Password credentials - without a single click from the user. The attack exploited what Zenity calls "Intent Collision": the agent couldn't distinguish between the user's actual requests and attacker instructions hidden in the invite, so it helpfully executed both. Perplexity patched the underlying issue before public disclosure, though some protections from 1Password still require users to manually opt in.

On March 3, 2026, Palo Alto Networks' Unit 42 reported that web-based indirect prompt injection had moved from lab demo to live abuse. Its telemetry caught real web pages carrying hidden instructions that hijacked AI agents into initiating Stripe and PayPal payments, deleting databases, leaking system prompts, and approving scam ads - the first observed case of AI ad-review systems being fooled by injected text. The researchers catalogued 22 payload techniques, from zero-sized fonts and off-screen text to Base64 that assembles itself at runtime, and found 85% of attacks used an authority-override framing ("this is a security update"). The systems failing here are the AI agents, which cannot tell the page's content from commands hidden inside it.

ERNW researcher Ahmad Al-Salehi showed that the Blackbox AI VS Code extension could be manipulated through indirect prompt injection. A malicious instruction hidden in a file, including a PNG image processed by the extension, could make the agent download and execute a reverse shell. With another prompt, the agent ran the payload with sudo, giving the attacker root access on the test host.

Check Point Research disclosed a set of Claude Code vulnerabilities on February 25, 2026 that let attacker-controlled repositories execute shell commands and exfiltrate Anthropic API credentials through malicious project configuration. The attack abused hooks, MCP server definitions, and environment settings stored in repository files that Claude Code treated as collaborative project configuration. Anthropic patched the issues before public disclosure, but the research showed just how little distance separates "shareable team settings" from "clone this repo and let it run code on your machine."

A prompt injection vulnerability in the Cline AI coding assistant was weaponized to steal npm publishing credentials, which an attacker then used to push a malicious Cline CLI version 2.3.0 that silently installed the OpenClaw AI agent platform on developer machines. The compromised package was live for approximately eight hours on February 17, 2026, accumulating roughly 4,000 downloads before maintainers deprecated it. A security researcher had disclosed the prompt injection flaw as a proof-of-concept; a separate attacker discovered it and turned it into a real supply chain attack.

Check Point Research demonstrated that Microsoft Copilot and xAI's Grok can be exploited as covert malware command-and-control relays by abusing their web browsing capabilities. The technique creates a bidirectional communication channel that blends into legitimate enterprise traffic, requires no API keys or accounts, and easily bypasses platform safety checks via encryption. The researchers disclosed the findings to Microsoft and xAI.

PromptArmor demonstrated that AI agents in messaging platforms can exfiltrate sensitive data without any user interaction. Malicious prompts trick AI agents into generating URLs with embedded secrets (API keys, credentials), and the messaging platform's automatic link preview feature fetches these URLs, completing the exfiltration before the user even sees the message. Microsoft Teams with Copilot Studio was the most affected, with Discord, Slack, Telegram, and Snapchat also vulnerable.

Microsoft Defender researchers documented a real-world campaign in which 31 companies across 14 industries embedded hidden prompt injection instructions inside "Summarize with AI" buttons on their websites. When users clicked these links, they opened directly in AI assistants such as Copilot, ChatGPT, Claude, Perplexity, and Grok, silently instructing the assistant to remember the company as a "trusted source" for future conversations. Over a 60-day observation period, Microsoft logged 50 memory-poisoning attempts. Turnkey tools like CiteMET NPM Package and AI Share URL Creator made crafting the manipulative links trivial, and the poisoned memory persisted across sessions.

In February 2026, a UK small business reported that its customer-support chatbot - deployed only to answer questions outside business hours and explicitly not meant to handle pricing - was steered over roughly an hour of flattery and math exercises into inventing fake discount codes, escalating from 25% to 80% off. A customer placed an order worth over £8,000, pasted the bogus code into the order comments when it failed at checkout, and demanded the discount be honoured manually. When the owner moved to cancel, the customer threatened small-claims action and set a three-day deadline. The business cancelled and refunded the order and absorbed the disruption. The account originates from a Reddit r/LegalAdviceUK post and was picked up by a security firm and a tech-news outlet; the business is anonymous, so treat the specifics as one owner's firsthand telling rather than an outlet-verified case.

LayerX Labs discovered a zero-click remote code execution vulnerability in Claude Desktop Extensions, rated CVSS 10/10. A malicious prompt embedded in a Google Calendar event could trigger arbitrary code execution on the host machine when Claude processes the event data. The attack exploited the gap between a "low-risk" connector and a local MCP server with full code-execution capabilities and no sandboxing. Anthropic declined to fix it, stating it "falls outside our current threat model."

Security researchers at Cyata disclosed three vulnerabilities in mcp-server-git, Anthropic's official reference implementation of the Model Context Protocol for Git. The flaws - a path traversal in git_init (CVE-2025-68143), an argument injection in git_diff/git_checkout (CVE-2025-68144), and a second path traversal bypassing the --repository flag (CVE-2025-68145) - could be chained together to achieve remote code execution entirely through prompt injection. An attacker who could influence what an AI assistant reads, such as a malicious README or a poisoned issue description, could trigger the full exploit chain without any direct access to the target system. Anthropic quietly patched the vulnerabilities. The git_init tool was removed from the package entirely.

A hacker bypassed Anthropic Claude's safety guardrails by framing requests as part of a "bug bounty" security program, convincing the AI to act as an "elite hacker" and generate thousands of detailed attack plans with ready-to-execute scripts. When Claude hit guardrail limits, the attacker switched to ChatGPT for lateral movement tactics. The result was 150 GB of stolen data from multiple Mexican federal agencies, including 195 million taxpayer records, voter information, and government employee files. A custom MCP server bridge maintained a growing knowledge base of targets across the intrusion campaign.

Varonis researchers disclosed the Reprompt attack, a chained prompt injection technique that exfiltrated sensitive data from Microsoft Copilot Personal with a single click on a legitimate Copilot URL. The attack exploited the "q" URL parameter to inject instructions, bypassed data-leak guardrails by asking Copilot to repeat actions twice (safeguards only applied to initial requests), and used Copilot's Markdown rendering to silently send stolen data to an attacker-controlled server. No plugins or further user interaction were required, and the attacker maintained control even after the chat was closed. Microsoft patched the issue in its January 2026 security updates.

Security researchers at PromptArmor demonstrated that IBM's Bob AI coding agent can be manipulated via indirect prompt injection to download and execute malware without human approval, bypassing its "human-in-the-loop" safety checks when users have set auto-approve on any single command.

Koi Security researcher Oren Yomtov disclosed ShadowPrompt, a zero-click attack chain in Anthropic's Claude for Chrome extension, which has more than 3 million users. It combined an overly permissive origin allowlist that trusted any *.claude.ai subdomain with a DOM-based cross-site scripting bug in an outdated Arkose Labs CAPTCHA hosted on a-cdn.claude.ai. Merely visiting a malicious page let an attacker inject arbitrary instructions into Claude as if the user had typed them, with no click and no permission prompt - enough to steal a Gmail access token, read Google Drive, export chat history, or send email as the victim. Reported December 26, 2025; Anthropic shipped an extension fix around January 15, 2026, and Arkose Labs patched the XSS on February 19, 2026. Responsibly disclosed; no confirmed exploitation.

In December 2025, Pen Test Partners published research on Eurostar's public AI chatbot after disclosing four flaws through the train operator's vulnerability disclosure process. The chatbot sent the full chat history back to its API on each request, but the server only validated the most recent message. Researchers could pass a harmless final message, alter earlier messages into prompt-injection payloads, extract system details, trigger HTML injection, and observe weak conversation and message ID validation. Eurostar said customer data was never at risk because the chatbot was not connected to sensitive systems, which is exactly why this belongs as a hazard: the design was brittle before the bot had access to anything truly valuable.

Noma Security disclosed GeminiJack, a zero-click flaw in Google Gemini Enterprise, on December 11, 2025. An attacker shares a booby-trapped Google Doc, email or calendar invite carrying hidden instructions. The victim never has to open it. Later, when any employee asks Gemini a routine question, the assistant's retrieval layer pulls in the poisoned content, treats the buried instructions as commands, and quietly exfiltrates emails, documents and calendar data containing terms like "confidential," "legal," "salary" or "API key." Google confirmed the findings and deployed mitigations. The vulnerability is not a bug in traditional code; it is the AI doing exactly what injected text told it to, because it cannot tell the difference between data it retrieved and instructions it should follow.

Security researcher Ari Marzouk discovered over 30 vulnerabilities across AI coding tools including GitHub Copilot, Cursor, Windsurf, Claude Code, Zed, JetBrains Junie, and more. 100% of tested AI IDEs were vulnerable to attack chains combining prompt injection with auto-approved tool calls and legitimate IDE features to achieve data exfiltration and remote code execution.

Cato Networks' research team disclosed HashJack on November 25, 2025, calling it the first known indirect prompt injection that can weaponize any legitimate website against AI browser assistants. The trick hides malicious instructions in a URL fragment - the part after the "#" - which browsers process only locally and never send to servers, so firewalls, intrusion systems and server logs never see the payload. When an AI assistant reads the page, it swallows the hidden instructions and can be steered into phishing, misinformation, malware guidance, bad medical advice, or, in agentic browsers like Perplexity Comet, actually exfiltrating user data. Microsoft and Perplexity shipped fixes. Google classified it for Gemini in Chrome as "won't fix - intended behavior."

Security researchers discovered that default configurations in ServiceNow's Now Assist allow AI agents to be recruited by malicious prompts to attack other agents. Through second-order prompt injection, attackers can exfiltrate sensitive corporate data, modify records, and escalate privileges - all while actions unfold silently behind the scenes.

CVE-2025-62353 (CVSS 9.8) allowed attackers to read and write arbitrary files on developers' systems using the Windsurf AI coding IDE. The vulnerability could be triggered via indirect prompt injection hidden in project files like README.md, exfiltrating secrets even when auto-execution was disabled.

Legit Security researcher Omer Mayraz disclosed CamoLeak, a critical flaw rated CVSS 9.6 in GitHub Copilot Chat. An attacker hides instructions in invisible Markdown comments inside a pull request; when a victim asks Copilot Chat about that PR, the assistant ingests the hidden text, searches the victim's private repositories for secrets and source, and smuggles the data out one character at a time through pre-signed image URLs routed via GitHub's own Camo image proxy. Because the traffic flows through GitHub's trusted infrastructure, it blends into normal image loading. GitHub mitigated it by disabling image rendering in Copilot Chat around August 14, 2025, after a June 2025 HackerOne report; public disclosure followed in October 2025. The reported attack is a proof of concept with no confirmed real-world victims.

Researchers at CodeIntegrity showed that Notion 3.0's autonomous AI agents, running Claude Sonnet 4 with web-search tool access, could be hijacked by a PDF containing white-on-white hidden text. Once the agent read the file, the concealed instructions told it to gather confidential workspace data - customer names, companies, and annual recurring revenue - concatenate it, and exfiltrate it by issuing a web-search request (functions.search) to an attacker-controlled URL. The technique is the classic "lethal trifecta": access to private data, exposure to untrusted content, and a way to communicate externally, all in one agent. The finding was corroborated by Simon Willison and PromptArmor. Notion, which reports roughly 100 million users, said it had remediated in production and upgraded its injection detection. Disclosed around September 18-19, 2025. A hazard and near-miss; no confirmed customer harm.

Noma Labs discovered "DockerDash," a critical prompt injection vulnerability in Docker's Ask Gordon AI assistant. Malicious instructions embedded in Dockerfile LABEL fields could compromise Docker environments through a three-stage attack. Gordon AI interpreted unverified metadata as executable commands and forwarded them to the MCP Gateway without validation, enabling remote code execution on cloud/CLI and data exfiltration on Desktop.

CVE-2025-55012 (CVSS 8.5) allowed Zed's AI agent to bypass user permission checks and create or modify project configuration files, enabling execution of arbitrary commands without explicit approval. Attackers could trigger this through compromised MCP servers, malicious repo files, or tricking users into fetching URLs with hidden instructions.

At Black Hat USA 2025, Zenity Labs researcher Tamir Ishay Sharbat demonstrated AgentFlayer, a zero-click exploit against ChatGPT Connectors. A document carrying invisible text - a prompt written in roughly 300 words of one-pixel white font - is shared with a target. Even a harmless "summarize this" makes ChatGPT follow the buried instructions, search the user's connected Google Drive or SharePoint for API keys and secrets, and exfiltrate them through image-render URLs pointed at attacker-controlled Azure Blob storage, slipping past OpenAI's url_safe check. AgentFlayer was part of a broader set of zero click attacks Zenity disclosed on August 6, 2025, that also hit Copilot Studio, Salesforce Einstein, Cursor with Jira, and Gemini. The work is a proof of concept; extraction was proven via the researchers' own logs, with no confirmed customer harm.

During his August 2025 "Month of AI Bugs" series, security researcher Johann Rehberger paid roughly $500 for a 30-day subscription to Devin, Cognition's commercial autonomous coding agent, and reported that it had almost no protection against prompt injection. Untrusted content - a poisoned GitHub issue or a web page Devin visited - could drive arbitrary command execution. In his demonstration Devin downloaded a command-and-control payload, granted itself execute permissions when an initial attempt was blocked, and ran it, handing an attacker a remote shell with access to secrets and AWS keys. Rehberger also showed multiple data-exfiltration channels and a tool that could expose internal ports to the public internet. These were researcher demonstrations against a paid production agent; no confirmed customer breach was reported.

SafeBreach researchers Ben Nassi, Stav Cohen, and Or Yair demonstrated "Targeted Promptware Attacks" against Gemini inside Google Workspace, in research titled "Invitation Is All You Need." A Google Calendar invite whose title carries a hidden prompt injection sits harmlessly until the victim later asks Gemini something innocent like "what's on my calendar?" At that point the poisoned text hijacks Gemini's connected agents and tool permissions. Across 14 attack scenarios the researchers showed Gemini being driven to geolocate and record the victim, delete calendar events, spew toxic content, and - most strikingly - trigger physical smart-home actions such as opening windows and switching on a boiler. Disclosed to Google around February 2025 and presented publicly in August 2025 at Black Hat USA and DEF CON. Google mobilized teams and shipped mitigations. A proof of concept; no confirmed customer harm.

CVE-2025-54136 (CVSS 8.8) allowed attackers to achieve persistent remote code execution in the popular AI coding IDE Cursor. Once a developer approved a benign MCP configuration, attackers could silently swap it for malicious commands without triggering re-approval. The flaw exposed developers to supply chain attacks and IP theft through shared GitHub repositories.

Mozilla's GenAI Bug Bounty Programs Manager disclosed a prompt injection flaw in Google Gemini for Workspace where attackers can embed invisible HTML directives in emails using zero-width text and white font color. When a recipient asks Gemini to summarize the email, the model obeys the hidden instructions and appends fake security alerts or phishing messages to its output, with no links or attachments required to reach the inbox.

Cybernews researchers found that Lenovo's GPT-4-powered customer-support chatbot "Lena" would happily turn a roughly 400-character prompt into stored cross-site scripting. The trick: ask the bot to format its reply as HTML containing an image that loads from a non-existent URL, so the browser falls back to sending the viewer's session cookies to an attacker server. When a human support agent later opened the conversation, the injected markup ran in the agent's browser, leaking an active session and opening the door to chat access and lateral movement. Disclosed July 22, 2025; Lenovo confirmed on August 6 and patched by August 18. No confirmed in-the-wild abuse - this is a documented hazard, not a known breach.

A rogue contributor injected a malicious prompt into the Amazon Q Developer VS Code extension, instructing the AI coding assistant to wipe local developer machines and AWS resources. AWS quietly yanked the release before widespread damage occurred. The incident illustrates a specific supply-chain risk for AI tools: once a poisoned extension is installed, the AI assistant itself becomes the delivery mechanism - executing destructive instructions with the developer's full trust and permissions.

CVE-2025-32711 (EchoLeak), discovered by Aim Security researchers and rated CVSS 9.3, enabled attackers to steal sensitive corporate data from Microsoft 365 Copilot without any user interaction. Hidden prompts embedded in documents or emails were automatically executed when Copilot indexed them, bypassing cross-prompt injection classifiers and exfiltrating confidential information via encoded image request URLs to attacker-controlled servers.

CVE-2025-55284 (CVSS 7.1) allowed attackers to bypass Claude Code's confirmation prompts and exfiltrate sensitive data from developers' computers through DNS requests. Prompt injection embedded in analyzed code could exploit auto-approved utilities like ping, nslookup, and dig to silently steal secrets by encoding them as subdomains in outbound DNS queries. Anthropic fixed the issue in version 1.0.4 by removing those utilities from the allowlist.

Legit Security researcher Omer Mayraz disclosed a remote prompt-injection flaw in GitLab Duo, the AI assistant built into GitLab. Because Duo reads the entire page context - merge request descriptions, commit messages, issue comments, and source code - an attacker could plant hidden instructions (for example, white KaTeX-rendered text) that Duo would obey. The crafted prompt told Duo to pull a confidential issue the victim could access, base64-encode it, and embed it in an image tag whose render leaked the data to an attacker-controlled server. The same flaw let attackers slip malicious HTML and links into Duo's answers shown to other users. Reported in February 2025 and disclosed in May 2025, GitLab patched the unsafe HTML rendering. No confirmed real-world exploitation was reported.

Researchers introduced LogiBreak, a jailbreak method that converts harmful natural language prompts into formal logical expressions to bypass LLM safety alignment. The technique exploits a gap between how models are trained to refuse dangerous requests and how they process logic-formatted input, achieving attack success rates exceeding 30% across major models. The Guardian reported on the broader finding that hacked AI chatbots threaten to make dangerous knowledge readily available, and that "dark LLMs" - stripped of safety filters - should be treated as serious security risks.

Rufus, the AI shopping assistant Amazon built into its store, turned out to be easy to talk out of its job. In a September 2024 disclosure through Mozilla's 0DIN program, researchers showed that ASCII-encoding tricks slipped past Rufus's guardrails and got it to produce content it was supposed to refuse. Separate research got the bot to reveal its own system prompt and internal security instructions, and to wander off-topic entirely - at one point suggesting Pepsi as a "healthier" alternative when asked about Coca-Cola, which is not the sort of thing a store wants its sales assistant volunteering. By 2026 the jailbreaks had a second life as a way to use Rufus as free general-purpose AI. No breach of customer data was confirmed; the damage was to the idea that bolting an LLM onto your storefront is a low-risk move.

PromptArmor disclosed that Slack AI could be coaxed into leaking data from private channels and direct messages the attacker had no access to. The attacker only had to post adversarial instructions in any public channel. When a user with private access later asked Slack AI a question, the assistant pulled the planted text into the same context and obeyed it, rendering an exfiltration path as a clickable Markdown link that smuggled private content - including secrets pasted into DMs - inside the URL. Slack initially called the behavior intended, then deployed a patch after the report went public in August 2024. This is a textbook indirect-prompt-injection authorization break: low-privilege input steering a high-privilege action. No confirmed real-world exploitation was reported.