AI agents

A flaw dubbed 'GitLost' lets an unauthenticated attacker craft a GitHub Issue in an organization's public repository. Through it, the attacker can silently pull data from that organization's private repositories.

Noma Security researchers showed that a malicious instruction hidden in a normal-looking public GitHub issue can steer a GitHub Agentic Workflows agent into copying a private repository's README into a public comment, when the organization has granted the agent read access across its repositories. The technique, named GitLost, needs no stolen credentials and no organization access, and Noma reported that adding the word "Additionally" let the malicious instruction bypass GitHub's threat-detection guardrail.

Zscaler tested LLMs against indirect prompt injection (IPI) traps and found that some autonomous agents fell victim to payment and fraud schemes. Four of 26 models failed to take appropriate actions, with results varying by model and by the context supplied alongside the prompt. Analysts quoted in the article questioned how generalizable a single point-in-time binary safe/vulnerable test is.

Sysdig researchers documented JadePuffer, an extortion operation that Sysdig calls the first known case of agentic ransomware, in which an AI agent handled the technical execution. The agent exploited a known Langflow bug to get in, moved to a production MySQL server, exploited another known flaw for admin access, and encrypted over 1,300 configuration records. A human still chose the victim, provisioned the command-and-control and staging infrastructure, and supplied the database credentials obtained from a prior compromise.

Sysdig Threat Research Team reports an AI agent, dubbed JadePuffer, ran an end-to-end extortion campaign after exploiting CVE-2025-3248, an RCE flaw in an internet-facing Langflow instance. The agent pivoted to a production server running MySQL and Alibaba's Nacos, encrypted 1,342 Nacos configuration records, deleted the original tables and left a Bitcoin ransom demand. Sysdig attributes the operation's adaptive decisions, including self-narrating payloads sent to the Langflow remote-code-execution endpoint, to an LLM.

Threat actors are using indirect prompt injections hidden in malicious websites and SEO-poisoned search results to steer AI agents into making cryptocurrency payments or trusting fraudulent platforms, according to Zscaler. One campaign targets agents searching for the Python library requests-secure-v2, hiding payment instructions in schema markup and a hidden div, while a second typosquats the DeBank portfolio tracker. In Zscaler's test of 26 LLMs, four were manipulated into making a payment, and only two misclassified the fraudulent DeBank site as legitimate.

Researchers at the Hong Kong University of Science and Technology built SKILLCLOAK, a tool that rewrites malicious AI agent skills so they evade static scanners while behaving the same. Its self-extracting packing technique moves the payload into a directory scanners skip and got past all eight scanners tested more than 90% of the time, across 1,613 real malicious skills from ClawHub. The team also proposes SKILLDETONATE, a runtime checker that caught 97% of attacks in a controlled test and 87% of real-world malicious skills.

Sysdig reports JadePuffer, which it describes as the first documented ransomware operation conducted entirely by an LLM agent. The agent exploited CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow, for initial access, then stole credentials, moved laterally, established persistence, and encrypted 1,342 Alibaba Nacos configuration items before deleting the originals and leaving a ransom note.

A threat actor tracked as JadePuffer used an LLM agent to attack an organization's internet-exposed Langflow instance by exploiting CVE-2025-3248 (CVSS 9.8), a missing authentication flaw that permits arbitrary Python code execution on the host. The agent harvested secrets, pivoted to a production server with a MySQL database and a Nacos configuration service, and encrypted 1,342 Nacos configuration items before dropping an extortion table with a ransom demand.