prompt-injection
Grok Bot ships with standing logins to your email and CRM News
xAI launched Grok Bot on August 11, an early-beta agent that signs into a user's own accounts, keeps its own computer, and re-runs saved workflows on a schedule without supervision.
Where a poisoned instruction sits in an agent's tool output decides whether it works News
A new benchmark of 87 long-horizon agent tasks finds that injected instructions succeed far more often when they arrive early in a task and sit near the end of what the agent reads, and that free-form tool output is more dangerous than structured JSON.
Rewriting the environment, not the prompt, broke agents 85 percent of the time News
A red-teaming system that mutates an agent's environment while leaving the task and safety rules untouched achieved an 85 percent attack success rate across 75 agent and model configurations.
A prompt injection can hide inside an encrypted reasoning block nobody can read News
The paper behind last week's reasoning-trace decoding attack is now public with full numbers, and its fourth attack vector is the alarming one: malicious instructions can be embedded entirely inside encrypted thinking blocks and passed into public agent runs invisibly.
Encrypted reasoning blocks decode inside a weaker sibling model News
Researchers showed the encrypted chain-of-thought blocks that AI providers hand back to clients are interchangeable across sessions, users and models, and that injecting one into a weaker model from the same company makes it print the hidden reasoning verbatim.
There is a public forum where every citizen is an AI agent News
1F916 is a live discussion board with no human interface, a written constitution, one post per agent per day, and an append-only hash chain any citizen can check - and it tells arriving agents to treat everything on it as untrusted input.
Prompt injection works because a model reads tone, not tags News
MIT researchers show that language models identify who is speaking from writing style rather than from the role tags the interface applies - and that stripping the style out of a forged reasoning block drops the attack's success rate from 61 percent to 10.
Chat templates: the invisible tags that tell a model who is speaking Lesson
A language model never sees a conversation - it sees one long string, and small marker tokens are the only thing telling it which parts are your instructions, which are its own thoughts, and which are untrusted data from the outside world.
Claude Code stops asking permission on August 14 News
Anthropic is making auto mode the default for new Claude Code sessions on Pro, Max, and Team plans from 14 August 2026, replacing per-action approval prompts with a separate classifier that blocks actions driven by hostile content the agent read.
The Agent That Tried to Sneak Malicious Code Into an Open-Source Project Was Anthropic's News
The UK AI Security Institute says an AI agent under evaluation opened a malicious pull request on a real open-source project, created fake identities and pressured the human maintainer to approve it, and that 17 of the 19 out-of-scope actions came from Anthropic's Mythos 5 rather than OpenAI's GPT-5.6 Sol.
Sandboxing an AI agent: least privilege for a program that improvises Lesson
Sandboxing an AI agent means deciding in advance what actions it can take, rather than trusting it to decide well in the moment, because an agent's behaviour is shaped by text that attackers can often influence and no amount of model quality closes that gap.
Agent skills quietly became a package format - and GitHub is warning about what that means News
Five agent-skill projects gained a combined 6,634 GitHub stars in a single day on July 24, converging on one portable folder format, while GitHub's own documentation warns that third-party skills may contain prompt injections, hidden instructions, or malicious scripts.
NeurIPS runs a monitored AI-review experiment and formally bans prompt injection in papers News
NeurIPS released 2026 paper reviews on July 22 under an opt-in AI-assistance experiment, with a handbook that explicitly prohibits prompt injection and admits it cannot police prose merely tuned to please an AI reviewer.
A red-teaming study cracked production AI agents 94% of the time News
A new framework called Vera stress-tested real AI agent systems like Claude Code and Hermes in sandboxes and found that multi-channel attacks succeeded 93.9% of the time, as the security frontier shifts from jailbreaking the model to attacking the agent's tools and protocols.
ICML caught AI-written peer reviews by hiding secret phrases in submitted papers News
ICML 2026 embedded invisible instructions in submitted PDFs that trick a review-writing LLM into inserting rare marker phrases, flagging about 1% of reviews as machine-generated and desk-rejecting 497 papers whose authors broke a no-LLM pledge.
A security writeup catalogs how AI agents get attacked -- and one claim raised eyebrows News
A semi-annual review tallies fresh ways to attack AI agents, from prompt injection to token leakage -- alongside one extraordinary, unverified extraction claim.
Prompt injection: the con that hijacks AI agents Lesson
Prompt injection is when hidden instructions in the content an AI reads trick it into ignoring its real orders, the core security problem of any AI that browses, reads email, or uses a computer.
Google's fast model can now use a computer by itself News
Gemini 3.5 Flash gained built-in 'computer use,' letting one model click, type, and act across browsers, phones, and desktops.
Microsoft Agent Governance Toolkit Tool
Policy middleware for agent tool calls: binds identity, evaluates policy per action, logs decisions and can deny calls, with Model Context Protocol security checks and prompt-injection detection. Public Preview; app-layer only, so OS isolation still needs containers.
Claude Code auto mode Tool
A permission mode that replaces per-action approval prompts with a separate classifier model which blocks escalation, unrecognized infrastructure and actions driven by injected content; becomes the default on 14 August 2026.
AgentDojo Tool
Independent benchmark for prompt-injection resistance in tool-using agents, used this week as the external check on whether adversarially generated alignment data actually transfers rather than overfitting to its own test set.