AI agents

Researchers named the attack stealth memory injection and built MemGhost, a tool that writes emails which trick personal AI agents into saving false memories and hiding the change. In 56 benchmark test cases against OpenClaw on GPT-5.4, the full attack succeeded in 87.5% of background-mode runs, and against a Claude Code SDK agent on Sonnet 4.6 in 71.4%. The findings are described in the arXiv paper "When Claws Remember but Do Not Tell," posted 6 July 2026.

Researchers from the University of Missouri-Kansas City's ASSET Research Group built 'Ghostcommit', a pull request attack that hides a prompt-injection instruction inside a PNG image that AI code reviewers do not examine. The merged AGENTS.md file points to the image, and a later coding agent session reads the .env file and writes its contents into source code as an integer constant that the attacker can decode from the public commit. The group says it has disclosed the findings to the affected vendors, and a survey found 73% of merged PRs had no substantive human or bot review.

AI Now Institute researchers Boyan Milanov and Heidy Khlaaf published "Friendly Fire," a proof-of-concept showing that Anthropic's Claude Code and OpenAI's Codex, when run in autonomous auto-approve modes, can be tricked into executing an attacker's binary during a security scan of untrusted code. The attack hides a malicious instruction in a README.md file of an open-source library (demonstrated with geopy), which tells the agent to run a security.sh script that launches a disguised hidden binary. The researchers say the same payload worked unchanged across Claude Sonnet 4.6, Sonnet 5, Opus 4.8 and GPT-5.5.

Wiz researchers found that six AI coding assistants (Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf) can be tricked by a malicious repository containing a symlink into writing to sensitive files such as ~/.ssh/authorized_keys or ~/.zshrc, which can lead to control of the developer's machine. Wiz named the pattern GhostApproval and published it on July 8, noting that the approval prompt names the harmless file rather than the real write target. Three vendors have fixed the issue, two have not, and Anthropic disputes that it is a bug.

Noma Security researchers detailed GitLost, a prompt injection attack in which hidden instructions inside a public GitHub issue cause GitHub's preview Agentic Workflows to read a private repository's README and publish its contents in a public comment. The attack requires no stolen credentials, malware, or software vulnerability, and the agent needs read access to private repositories within the same organization. Noma frames the root cause as an architectural trust boundary problem affecting AI agents generally rather than a GitHub-specific flaw.

Noma Labs disclosed GitLost, a critical prompt injection flaw in GitHub Agentic Workflows that could let unauthenticated attackers leak private repository data. An attacker only needs to open a crafted issue in a public repository of an organization using the setup, and the agent, which has read access to public and private repositories, follows the hidden instructions and posts the contents of private Readme.md files as a public comment. GitHub's guardrails failed after the researchers varied their techniques and triggered the behavior with the keyword "additionally".

A flaw dubbed 'GitLost' lets an unauthenticated attacker craft a GitHub Issue in an organization's public repository. Through it, the attacker can silently pull data from that organization's private repositories.

Noma Security researchers showed that a malicious instruction hidden in a normal-looking public GitHub issue can steer a GitHub Agentic Workflows agent into copying a private repository's README into a public comment, when the organization has granted the agent read access across its repositories. The technique, named GitLost, needs no stolen credentials and no organization access, and Noma reported that adding the word "Additionally" let the malicious instruction bypass GitHub's threat-detection guardrail.

Zscaler tested LLMs against indirect prompt injection (IPI) traps and found that some autonomous agents fell victim to payment and fraud schemes. Four of 26 models failed to take appropriate actions, with results varying by model and by the context supplied alongside the prompt. Analysts quoted in the article questioned how generalizable a single point-in-time binary safe/vulnerable test is.