Prompt injection and jailbreaks

A security researcher found that Anthropic's Claude Code GitHub Action let anyone running a GitHub App bypass the write-access check, so a single opened issue could trigger the action on public repositories. Through indirect prompt injection, the attacker could make Claude write /proc/self/environ values, including the GitHub Actions OIDC credentials, back into the issue, enabling write access to the target's code, issues and workflows. Anthropic fixed the core bypass within four days of a January report and rated the issues 7.8 under CVSS v4.0.

Microsoft's Semantic Kernel, an open-source framework for building AI agents, contained two vulnerabilities, CVE-2026-25592 and CVE-2026-26030, which the source says have since been fixed. The flaws let an attacker use prompt injection to reach unauthorized code execution on the host running an agent, and the source demonstrates this by launching calc.exe with a single prompt. Exploitation of CVE-2026-26030 requires a prompt injection vector and an agent with the Search Plugin backed by the In-Memory Vector Store.

Threat actors are distributing malware through trojanized shared files on Hugging Face and ClawHub, according to Acronis. The attacks rely on social engineering to get users to download files that execute commands, fetch payloads and install hidden dependencies. Acronis identified close to 600 malicious skills across 13 ClawHub developer accounts, with the OpenClaw ecosystem's indirect prompt injection used to make agents download and run code.

Google's Threat Intelligence teams swept Common Crawl, a public repository of mostly static English-language websites, to check whether real attackers are using indirect prompt injection (IPI) on the open web. The source describes a coarse-to-fine filtering approach, starting with pattern matching on phrases such as "ignore … instructions," because naive searches return mostly benign research and educational content. The article is cut off before reporting its findings.

Pillar Security researchers disclosed a prompt injection flaw in Google's Antigravity IDE that can turn the find_my_name file search tool into remote code execution. The Pattern parameter accepts strings beginning with "-", which the fd utility reads as flags, and Secure Mode never evaluates the call because it runs before the security boundary.

Cybersecurity researchers at Pillar Security found a flaw in Google's agentic IDE Antigravity that allows code execution. The find_by_name file-search tool passes its Pattern parameter directly to fd without strict validation, so injecting the -X (exec-batch) flag, such as the value -Xsh, makes fd run matched files as shell scripts, bypassing Strict Mode. An attacker can stage a malicious file and trigger it, or reach the same result through indirect prompt injection from an untrusted file.

Researchers reported that an indirect prompt injection could be chained with a sandbox bypass and Cursor's remote tunnel feature to gain shell access to developer machines.

A researcher has disclosed details of an AI attack method he calls 'Comment and Control'. The method reportedly enables prompt injection through comments in Claude Code, Gemini CLI and GitHub Copilot Agents.

Capsule Security researchers disclosed prompt-injection flaws in Microsoft Copilot Studio and Salesforce Agentforce that let crafted input override agent instructions and exfiltrate data. In the Microsoft case, a payload in a SharePoint form field leaks customer records from connected SharePoint Lists by email, and the flaw was assigned CVE-2026-21520 with a CVSS score of 7.5. In the Salesforce case, a malicious public lead form causes an agent to pull CRM records via the "GetLeadsInformation" function and email them externally, and Salesforce called the vector "configuration-specific" and pointed to optional human-in-the-loop controls.

Noma Security disclosed GrafanaGhost, a chained exploit in Grafana's AI components that can leak sensitive data such as financial metrics, infrastructure health data, customer data and operational logs without credentials or user interaction. The chain combines an indirect prompt injection with a URL validation flaw that lets protocol-relative URLs like //attacker.com bypass client-side image-loading protections, and it uses the keyword INTENT to evade AI guardrails. Grafana reportedly validated the flaw and rolled out a fix, though it did not immediately respond to CSO's request for comment.

Koi Security researcher Oren Yomtov disclosed ShadowPrompt, a flaw in Anthropic's Claude Google Chrome Extension that lets any website silently inject prompts into the assistant. The issue chains an overly permissive origin allowlist matching *.claude.ai with a DOM-based XSS flaw in an Arkose Labs CAPTCHA component hosted on a-cdn.claude[.]ai. A successful attack could steal access tokens, expose conversation history, and perform actions as the victim, with no clicks or permission prompts required.

China's CNCERT warned that OpenClaw, an open-source self-hosted autonomous AI agent, has weak default security configurations and privileged system access that attackers could exploit to take control of endpoints. Indirect prompt injection can trick the agent into leaking data, and PromptArmor showed that link previews in messaging apps like Telegram or Discord can carry data to an attacker's domain without a click.