Prompt injection and jailbreaks

Researchers from the University of Missouri-Kansas City's ASSET Research Group built 'Ghostcommit', a pull request attack that hides a prompt-injection instruction inside a PNG image that AI code reviewers do not examine. The merged AGENTS.md file points to the image, and a later coding agent session reads the .env file and writes its contents into source code as an integer constant that the attacker can decode from the public commit. The group says it has disclosed the findings to the affected vendors, and a survey found 73% of merged PRs had no substantive human or bot review.

CVE-2026-60086 affects PraisonAI before 4.6.78. Its prompt injection defense only blocks threats classified as CRITICAL, which requires three or more detector families to match at once. Single or double-vector prompt injections rated HIGH pass through unblocked and reach the model.

Noma Security researchers detailed GitLost, a prompt injection attack in which hidden instructions inside a public GitHub issue cause GitHub's preview Agentic Workflows to read a private repository's README and publish its contents in a public comment. The attack requires no stolen credentials, malware, or software vulnerability, and the agent needs read access to private repositories within the same organization. Noma frames the root cause as an architectural trust boundary problem affecting AI agents generally rather than a GitHub-specific flaw.

Noma Labs disclosed GitLost, a critical prompt injection flaw in GitHub Agentic Workflows that could let unauthenticated attackers leak private repository data. An attacker only needs to open a crafted issue in a public repository of an organization using the setup, and the agent, which has read access to public and private repositories, follows the hidden instructions and posts the contents of private Readme.md files as a public comment. GitHub's guardrails failed after the researchers varied their techniques and triggered the behavior with the keyword "additionally".

Zscaler tested LLMs against indirect prompt injection (IPI) traps and found that some autonomous agents fell victim to payment and fraud schemes. Four of 26 models failed to take appropriate actions, with results varying by model and by the context supplied alongside the prompt. Analysts quoted in the article questioned how generalizable a single point-in-time binary safe/vulnerable test is.

Threat actors are using indirect prompt injections hidden in malicious websites and SEO-poisoned search results to steer AI agents into making cryptocurrency payments or trusting fraudulent platforms, according to Zscaler. One campaign targets agents searching for the Python library requests-secure-v2, hiding payment instructions in schema markup and a hidden div, while a second typosquats the DeBank portfolio tracker. In Zscaler's test of 26 LLMs, four were manipulated into making a payment, and only two misclassified the fraudulent DeBank site as legitimate.

Cato Networks researchers found two flaws, CVE-2026-50548 and CVE-2026-50549, in the Cursor AI IDE that let prompt injection break out of its command execution sandbox and reach remote code execution. The exploit needs no prior user privileges or specific user interaction. It is triggered when a victim's innocuous prompt ingests an attacker-controlled payload from an untrusted source, such as an MCP server or a web search result.

Cato AI Labs disclosed two Cursor flaws, DuneSlide, tracked as CVE-2026-50548 and CVE-2026-50549, that let a prompt-injected instruction write a file outside the editor's sandbox and disable it, so later commands run unsandboxed as the developer. The first abuses the working_directory parameter of run_terminal_cmd, and the second abuses a symlink-check fallback. Every version before Cursor 3.0 is affected, and no real-world exploitation is reported.