Prompt injection and jailbreaks

Threat actors are distributing malware through trojanized shared files on Hugging Face and ClawHub, according to Acronis. The attacks rely on social engineering to get users to download files that execute commands, fetch payloads and install hidden dependencies. Acronis identified close to 600 malicious skills across 13 ClawHub developer accounts, with the OpenClaw ecosystem's indirect prompt injection used to make agents download and run code.

AnythingLLM versions prior to 1.12.1 contain a stored DOM-level XSS flaw, tracked as CVE-2026-41318. The in-chat markdown renderer interpolates image `alt` text into an HTML attribute without encoding, and the `Chartable` component renders chart captions with no DOMPurify sanitization. An attacker who can influence LLM output, through indirect prompt injection in a shared workspace document or by creating a chart record in a multi-user workspace, can run script in other users' browsers when they open that conversation.

Google's Threat Intelligence teams swept Common Crawl, a public repository of mostly static English-language websites, to check whether real attackers are using indirect prompt injection (IPI) on the open web. The source describes a coarse-to-fine filtering approach, starting with pattern matching on phrases such as "ignore … instructions," because naive searches return mostly benign research and educational content. The article is cut off before reporting its findings.

Pillar Security researchers disclosed a prompt injection flaw in Google's Antigravity IDE that can turn the find_my_name file search tool into remote code execution. The Pattern parameter accepts strings beginning with "-", which the fd utility reads as flags, and Secure Mode never evaluates the call because it runs before the security boundary.

Cybersecurity researchers at Pillar Security found a flaw in Google's agentic IDE Antigravity that allows code execution. The find_by_name file-search tool passes its Pattern parameter directly to fd without strict validation, so injecting the -X (exec-batch) flag, such as the value -Xsh, makes fd run matched files as shell scripts, bypassing Strict Mode. An attacker can stage a malicious file and trigger it, or reach the same result through indirect prompt injection from an untrusted file.

Researchers reported that an indirect prompt injection could be chained with a sandbox bypass and Cursor's remote tunnel feature to gain shell access to developer machines.

A researcher has disclosed details of an AI attack method he calls 'Comment and Control'. The method reportedly enables prompt injection through comments in Claude Code, Gemini CLI and GitHub Copilot Agents.

Capsule Security researchers disclosed prompt-injection flaws in Microsoft Copilot Studio and Salesforce Agentforce that let crafted input override agent instructions and exfiltrate data. In the Microsoft case, a payload in a SharePoint form field leaks customer records from connected SharePoint Lists by email, and the flaw was assigned CVE-2026-21520 with a CVSS score of 7.5. In the Salesforce case, a malicious public lead form causes an agent to pull CRM records via the "GetLeadsInformation" function and email them externally, and Salesforce called the vector "configuration-specific" and pointed to optional human-in-the-loop controls.

Noma Security disclosed GrafanaGhost, a chained exploit in Grafana's AI components that can leak sensitive data such as financial metrics, infrastructure health data, customer data and operational logs without credentials or user interaction. The chain combines an indirect prompt injection with a URL validation flaw that lets protocol-relative URLs like //attacker.com bypass client-side image-loading protections, and it uses the keyword INTENT to evade AI guardrails. Grafana reportedly validated the flaw and rolled out a fix, though it did not immediately respond to CSO's request for comment.