Prompt injection and jailbreaks

PuzzleMask is a newly disclosed prompt injection technique that embeds a policy-violating payload inside fluent, properly punctuated prose. It gets that payload past an LLM-based gatekeeper without triggering heuristics that look for obfuscation in the input. The technique targets pipelines where a fast, low-cost model screens input before a more capable target model.

Microsoft researchers observed a high-volume phishing campaign that used invisible Unicode tag characters, a technique known from AI prompt injection research as ASCII smuggling. The attacker inserted these characters into financial lure words such as 'funding' to keep email filters from parsing them. Hits on a Microsoft Defender for Office 365 hunting signature for ASCII smuggling rose sharply from February 9, 2026, and stayed elevated on weekdays for about three months.

Mindguard disclosed a prompt injection flaw in Amazon Kiro IDE 0.7.45 on Windows, which has no CVE identifier. Attacker-controlled repository content can steer the Kiro agent into writing sensitive local data into IDE configuration, causing it to be sent to an external endpoint. Exploitation requires the user to open a malicious workspace file via File → Open Workspace From File and then send any message to the agent.

Varonis researchers demonstrated RovoBlast at DEF CON 34, an attack in which a single click on a crafted link uses Rovo's rovoChatPrompt parameter to inject attacker instructions into Rovo Chat. Because Rovo can search data across Jira, Confluence, Slack, Google Workspace, Microsoft 365 and more than 50 connected platforms, and its ResearchAgent can move information toward an external destination, the attack could expose enterprise data. The issue was reported to Atlassian through Bugcrowd and has since been fixed.

Zenity researchers disclosed two zero-click indirect prompt injection attacks against agentic browsers. Against ChatGPT Atlas, a single planted comment on an X thread hijacks benign user requests, enabling phishing messages sent to WhatsApp Web contacts and unauthorized Amazon orders that use Rufus to place the purchase. Against the Claude Chrome extension, a malicious email escalates into full account takeover, including Gmail exfiltration and Google Drive file sharing.

New research finds that AI browsers from top vendors remain vulnerable to prompt injection attacks, even with multiple security guardrails in place. The source text does not give further technical detail on the attacks or the vendors affected.

GitHub will begin rejecting command-line support bundle uploads from older GHES appliances starting August 18, 2026, unless they are patched. A separate npm package, @copilot-mcp/apex, acts as a postinstall dropper that installs a macOS infostealer, and a fake VS Code extension, "Markdown All Pro", impersonates Markdown All in One to beacon machine details and fetch remote payloads.

A Russian-speaking actor known as "Trim" dismantled publicly available frontier models and integrated them with offensive security tools. The source text gives no further details on the methods, scope, or impact.

Researchers from the University of Missouri-Kansas City's ASSET Research Group built 'Ghostcommit', a pull request attack that hides a prompt-injection instruction inside a PNG image that AI code reviewers do not examine. The merged AGENTS.md file points to the image, and a later coding agent session reads the .env file and writes its contents into source code as an integer constant that the attacker can decode from the public commit. The group says it has disclosed the findings to the affected vendors, and a survey found 73% of merged PRs had no substantive human or bot review.