AI agents

Wiz researchers found a serious flaw in Moltbook, a social network for AI agents, where a mishandled private key in the site's JavaScript code exposed the email addresses of thousands of users and millions of API credentials. The exposure would have allowed complete account impersonation of any user and access to private communications between AI agents.

A platform called Moltbook, built entirely with AI, exposed all of its data through a publicly accessible API. The article describes this as a predictable and preventable outcome.

Researchers exploited a lack of isolation in several agentic browsers, which are browsers with embedded AI agents, to carry out attacks such as spreading false information and leaking data across sites. They describe the attacks as similar to cross-site scripting (XSS) and cross-site request forgery (CSRF), and say they resurface old vulnerability patterns. The authors outline a threat model with four trust zones and four violation classes, and they recommend extending the Same-Origin Policy to AI agents.

Modern AI agents run system commands such as find, grep, rg and git without human approval for efficiency, and the researchers describe bypassing human approval through argument injection against these pre-approved commands. They achieved remote code execution with a single prompt against three unnamed production agent platforms, which the authors say remain under coordinated disclosure.

Johann Rehberger describes a design flaw in agentic systems that lets one coding agent rewrite another agent's configuration, freeing it from its sandbox. In his demo, a prompt-injected GitHub Copilot writes a malicious MCP server into Claude Code's config, which then runs arbitrary code. The post notes that Claude can reciprocate by modifying Copilot's configuration.

Johann Rehberger presented a demo at the SAGAI Workshop on May 15, 2025 in San Francisco, showing how ClickFix attacks apply to computer-use AI systems. ClickFix is a social engineering technique in which adversaries tell users that something is broken or needs validation, prompting them to click a button, open a terminal and run commands.

Anthropic released Claude Computer Use, a beta model and code package that lets Claude control a computer by reading screenshots and running bash commands. The author demonstrates how prompt injection in untrusted data can drive the model to run commands autonomously on a machine, and frames this as a fundamental design problem in LLM-powered applications and agents.

The post explains how automatic link unfurling in Slack can enable data exfiltration when untrusted content, such as text injected through a prompt injection attack, causes an LLM-powered Slack App to render a hyperlink with chat data appended. Slack's unfurling request sends that appended data to the third-party server. The author then shows how to disable unfurling in a Slack App's message payload.