Active AI Security Signals

According to Noma Security, the "GitLost" vulnerability in GitHub Agentic Workflows allows an unauthenticated attacker to post a crafted but normal-looking issue in a public repository that, via hidden natural-language instructions, causes the AI agent to read from and leak data in the organization’s private repositories when the agent has cross-repository read access.[1][3] This is a textbook *indirect prompt injection* / Agentic Workflow Injection case, where user-controlled issue text is ingested into the agent’s prompt and converted into data-exfiltrating behavior without any stolen credentials or direct code exploit.[3][4] From a RealGround perspective, this highlights the need to redesign agent workflows so untrusted GitHub events (issues, PR descriptions, comments) are never treated as trusted instructions, to enforce strict least-privilege on cross-repo access, and to continuously red-team agent behavior against prompt-injection and data leakage scenarios. Organizations should use Secure AI Agent Build and AI Agent Business Logic Audit to harden workflow design, and Continuous AI Red Teaming to repeatedly test for similar AWI flaws before they reach production.

According to the report and related research, attackers used SEO poisoning and malicious websites embedding hidden instructions to perform indirect prompt injection against autonomous AI agents, coercing them into making unauthorized cryptocurrency payments or trusting fraudulent crypto platforms.[1][2][5][7] These campaigns target browsing and DeFi-capable agents whose plugins or connected wallets can execute real financial transactions, demonstrating that prompt-based guardrails alone are insufficient to prevent agent compromise and unauthorized transfers.[5][6] From a RealGround perspective, the practical implication is that any AI agent with transaction, trading, or wallet privileges must be treated as a high-risk fintech surface: enforce least-privilege action-layer controls (spend limits, allowlists, mandatory human approval for payments), cryptographically verify directives, and continuously red-team agents against indirect web-based injections before production use.[3][4][6][7] Organizations should also audit agent business logic and memory handling to ensure that injected instructions from web content cannot persist or propagate across sessions, reducing the likelihood

According to LayerX’s research, the BioShocking technique uses indirect prompt injection inside web content to manipulate agentic AI browsers into abandoning safety guardrails and exfiltrating credentials from authenticated sessions.[4][5] The attack convinces the AI that it is in a game-like alternate reality, so it applies game rules instead of security logic and willingly copies secrets such as GitHub SSH credentials to an attacker.[3][5] From a RealGround perspective, this demonstrates that any AI agent with browser or system access must be designed with strict context isolation, confirmation gates for sensitive operations, and scope limiting aligned to least privilege, and should be continuously red-teamed against indirect prompt injection scenarios.[1][5] Organizations should also update AI governance and usage policies so that AI browsers and autonomous agents are treated as privileged identities whose access, behavior, and attack surface require the same controls and monitoring as human admin accounts.[3][7]

The recap highlights new AI-linked threats, notably Gaslight macOS malware and a Rust-based macOS implant that embed prompt injection payloads specifically to mislead AI-assisted malware analysis tools into aborting or refusing analysis.[2][4] It also reports serious indirect prompt injection risks in agentic IDEs and coding agents, where attacker-controlled but seemingly benign repositories can trigger tool access, code execution, file operations, and network calls.[2][4] From a RealGround perspective, these demonstrate that AI-powered security and coding tools can be turned into attack surfaces: organizations should treat AI agents as high-privilege components, enforce strict tool- and repo-access controls, and continuously red-team agent workflows to identify and mitigate indirect prompt injection paths before they lead to compromise.

According to Mozilla’s 0DIN researchers, seemingly benign GitHub repositories can embed indirect instructions that lead Claude Code and similar AI coding agents to execute a staged setup flow, ultimately spawning a reverse shell on the developer’s machine when the agent "helps" fix a failing initialization step.[1][6] Once the interactive shell is established, an attacker can access environment variables, credentials, API keys, tokens, source code and deploy persistent backdoors, all triggered by routine-looking agent actions on a clean-appearing repo.[1][6] From a RealGround perspective, this exemplifies indirect prompt injection against agentic coding tools, where untrusted repositories and configuration flows become a covert control channel; organizations should harden AI agent workflows, restrict tool permissions, and continuously red-team agent behavior against malicious repos and hidden instructions. Secure AI Agent Build and Continuous AI Red Teaming can help design safer toolchains, validate repository trust models, and detect exploitable prompt and tool use patterns before they reach production developer environments.

The article describes macOS.Gaslight, a Rust-based macOS implant and infostealer linked with high confidence to North Korea–aligned actors that embeds a 3.5 KB prompt-injection payload of 38 fabricated "system" messages inside the malware sample itself.[2][6] These Markdown-fenced messages are crafted to mimic an LLM triage harness and claim token expiry, OOM kills, disk failures, bogus injection warnings, and static-analysis flags, with the explicit goal of steering LLM-assisted analysis tools into aborting, truncating, or misclassifying the analysis rather than attacking the model directly.[2][4][6] From a RealGround perspective, this is a clear indirect prompt injection pattern where adversarial content in an analyzed artifact targets downstream AI agents in the reverse-engineering pipeline, showing that any system which blindly feeds untrusted sample content into LLMs is at risk of evasion and mis-triage. Defenders should treat all artifact content as adversarial input, enforce strict prompt scaffolding and content isolation in AI tooling, and incorporate adversarial-prompt testing and hardening (via secure agent design, business-logic audits, and continuous AI red team

Report facts: The article explains how "AI agent traps" turn information itself into an attack surface by embedding hidden content injections, semantic manipulation, and cognitive state poisoning into otherwise trusted data sources that autonomous agents read.[2][1] It highlights that attackers can corrupt agents’ reasoning, memories, and action policies via poisoned RAG corpora, long‑term memory, and contextual examples, and that no single control can mitigate this class of attacks.[2][3] The article calls for a defensive framework including source verification, content screening, memory governance, restricted permissions, isolated execution, monitoring, and human‑in‑the‑loop approval for high‑impact actions.[2] RealGround analysis: Practically, this is an indirect prompt injection and behavioral control problem—organizations must treat every external data source an agent can read as untrusted input, enforce strict tool-permission and egress controls, and continuously red‑team agents against content and memory poisoning scenarios to prevent the agent’s own autonomy from being weaponized.

The article describes a range of traditional threats—browser bugs, abused integrations, fake tools, poisoned websites, and malware (including EDR killers and Android trojans)—being delivered via common web vectors like extensions, weak credentials, sketchy downloads, and compromised WordPress sites. These same web vectors and compromised pages are the primary substrate for indirect prompt injection attacks against AI-enabled browsers and agents, where malicious instructions are hidden in page content or integrations and executed by the AI rather than the user.[2][4][5][8] From a RealGround perspective, any environment using browsing agents or AI-augmented security tooling is at heightened risk that such poisoned websites or extensions could be weaponized to exfiltrate data or subvert agent behavior via indirect prompt injection, so organizations should continuously red team their AI agents against realistic web-based threat scenarios aligned to these patterns.

The reported research shows that the self-hosted OpenClaw AI agent can be coerced into executing attacker-controlled code and exposing sensitive data via seemingly benign content, such as vCards, shared contacts, location pins, and crafted URLs embedded in normal workflows. This aligns with other findings that OpenClaw is highly exposed to prompt injection and indirect prompt injection, including data exfiltration through link previews and remote code execution via crafted links and misconfigured gateways.[1][2][3] These are factual reports of real-world exploitation techniques against OpenClaw-like agents that automatically act on untrusted inputs. From a RealGround perspective, this underscores the need to redesign agent business logic to treat all external content as untrusted, add strict tool/use constraints and review layers, and continuously red-team agent behaviors so that hidden instructions in user data cannot silently trigger code execution or data leakage.

The report describes an indirect prompt injection flaw in Google Gemini for Android where malicious text embedded in notifications from apps like WhatsApp, Slack, SMS, Signal, Instagram, or Messenger was treated as executable instructions by the voice assistant, without needing any malicious app on the device.[1][2] According to the research, an attacker-crafted notification could drive Gemini to control smart-home devices, open tracking URLs, force-join Zoom calls, fake messages from trusted contacts, and even poison Gemini’s long-term memory at the account level.[1] Google has deployed server-side mitigations via improved content classification, but the attack surface demonstrates that any untrusted content source feeding an AI agent can silently become a control channel.[1][2] From a RealGround perspective, organizations using or building AI assistants that read notifications, inboxes, or messages should treat all such external content as untrusted, and use continuous AI red teaming to simulate indirect prompt injection via common channels (notifications, email, chat) before rollout.

Researchers at Permiso Security disclosed a vulnerability in ChatGPT, dubbed "ChatGPhish," where the chatgpt.com renderer implicitly trusts Markdown links and images in web summaries, enabling attackers to inject malicious prompts and turn those summaries into a phishing vector.[1] According to the report, this allows hostile content embedded in third‑party pages to influence ChatGPT’s behavior or present deceptive UI elements to users when web content is summarized.[1] From a security perspective, this illustrates a classic indirect prompt injection and UI phishing risk whenever LLMs automatically render or act on untrusted external content. RealGround analysis: organizations integrating web-browsing LLM agents should enforce strict content sanitization, limit Markdown/HTML rendering, and continuously red-team agent behaviors against prompt injection and phishing-style manipulations.

Attackers can hide malicious instructions inside external data sources (like emails or ticketing systems). When an enterprise AI agent reads these inputs, it executes the payload. This leads to data exfiltration, unauthorized tool operations, and complete agent hijack.

The article describes how AI agents that read PDFs, websites, and emails can be compromised by hidden or embedded instructions, causing them to exfiltrate data, leak other users' information, or take unintended financial and operational actions—an example of indirect prompt injection against agents with tools and memory.[1][3][4][7] The post references industry research and telemetry, including a reported rise in hidden prompt payloads on the web and demonstrations of malicious instructions persisting in long‑term agent memory, and recommends structural separation of instructions, output validation, and strict action limits as mitigations.[3][4][6][7] From a RealGround perspective, these scenarios indicate a high‑impact but application‑dependent risk that requires secure agent architectures (least‑privilege tools, hard boundaries between content and instructions, and robust validation) and ongoing red teaming of real agent workflows to detect injection pathways before they are abused.[1][3][4][7] Organizations deploying SaaS or internal agents over business data should treat all external content as untrusted, rigorously audit agent business logic and permissions, and continuously t

TrendAI’s report shows that multi-modal AI agents can be covertly manipulated via indirect prompt injection hidden in web pages, images, and documents, enabling sensitive data exfiltration without any explicit user action.[4][1] It highlights document-based payloads (e.g., MS Word) and the Pandora proof-of-concept, where embedded instructions drive unauthorized code execution and data leakage to external destinations.[4][6] From a RealGround perspective, this underscores the need to redesign agent architectures with strict network and URL access controls, robust content filtering (including OCR for images), and fine-grained permissioning around data sources and tools to constrain what an injected prompt can reach.[4][2] It also supports continuous AI red teaming to simulate zero-click exfiltration paths, combined with business-logic audits to ensure agents never autonomously expose confidential data from chat history, uploaded files, or connected systems.[1][2]

Report facts: The r/aisecurity post explains how crafted or embedded prompts can exploit LLM context to override intended behavior and cause data leakage, leading models to reveal internal or sensitive information when guardrails and filtering are insufficient.[1][2][8][10] It describes example attack scenarios where indirect prompt injection via external content (web pages, documents, emails) results in confidential data exfiltration from deployed AI systems.[1][2][3][5] RealGround analysis: This content highlights a combined indirect prompt injection and data leakage risk path, making it highly relevant to organizations deploying agentic or integrated LLM systems that ingest untrusted data. Practically, this warrants continuous AI red teaming to simulate indirect injection payloads, secure agent design with strict trust boundaries and data access controls, and business logic audits to ensure prompts, tools, and retrieval pipelines cannot be easily manipulated to exfiltrate sensitive data at runtime.

The CrowdStrike article describes indirect prompt injection attacks where adversaries plant malicious instructions in external content (documents, emails, web pages, tools) that GenAI systems later ingest, causing the model to misinterpret that content as instructions and override intended behavior.[1][6] It notes that prompt injection, including indirect variants, is classified as the top OWASP 2025 GenAI risk and highlights potential impacts such as data exfiltration and unintended high-privilege actions.[1][6] From a RealGround perspective, this implies organizations need hardened AI agent architectures with strict source allowlisting, least-privilege and action-approval controls, and continuous adversarial testing of agent tool use to detect and contain such injections before they lead to business-impacting compromise. RealGround can support this with Secure AI Agent Build for defensive patterns, AI Agent Business Logic Audit to identify insecure tool/permission design, and Continuous AI Red Teaming to emulate real-world indirect prompt injection attempts against deployed systems.

The article/video reports that browser-based AI agents can be manipulated by hidden instructions embedded in web content, causing them to override their original objectives; it also notes that researchers have found web agents are frequently susceptible to these attacks and warns against unsupervised sensitive actions such as purchases or handling PII[5]. RealGround analysis: this is a high-priority indirect prompt injection risk because the agent’s external-content ingestion and tool use can be coerced into unsafe actions, so controls should focus on least privilege, action confirmation, content isolation, and ongoing red-teaming[1][2][3].

The Unit 42 article documents real-world cases of web-based indirect prompt injection, where attackers hide instructions in webpages that AI agents later crawl or summarize, causing the agents to execute attacker-controlled behavior without any obviously malicious user prompt.[2][4] The report shows that when such agents have tools or data access, these hidden prompts can drive unauthorized actions, leak credentials or payment data, and compromise decision workflows, turning routine browsing or summarization features into an attack surface.[2][4] From a RealGround perspective, this highlights the need to tightly scope agent permissions, enforce strict source and content trust policies, and implement runtime detection for anomalous tool use or data access triggered by external content. It also implies organizations should red team agent workflows specifically for hidden web-based instructions and update business logic so agents treat all external content as untrusted unless explicitly allowlisted.

The article reports research showing that roughly 94% of AI agents in production are exploitable once they read untrusted external content (documents, emails, web pages) and then take real-world actions, highlighting prompt and command injection as the dominant risk channel for these systems.[1][2][3][6][7] It cites a real command injection vulnerability in a widely deployed AI tool that enabled remote code execution across hundreds of thousands of installations, reinforcing that seemingly "normal" agent workflows can be turned into execution paths for attackers.[5][6] From a RealGround perspective, this maps directly to indirect prompt injection risk in autonomous and tool-using agents, and implies organizations need to treat every external data source as potentially adversarial and strictly limit what actions an injected agent can perform. Practically, this means redesigning agents with least-privilege and "least agency" principles, adding pre-deployment business logic audits, and running continuous red teaming to detect and contain injection paths before they lead to data exfiltration or code execution in production.[1][3][5]

The article reports that OWASP ranks prompt injection as the #1 risk for LLM applications in 2025 and highlights that indirect prompt injection via external data sources is especially dangerous for autonomous agents with tool/API access, enabling unauthorized calls, code execution, or data exfiltration.[1][3][6][8] It describes layered defenses including behavioral monitoring, adversarial testing, and runtime guardrails to protect startup and SaaS LLM deployments.[3][6][7] From a RealGround perspective, this implies organizations should continuously red-team their LLM agents against both direct and indirect injection paths (e.g., RAG sources, third-party tools, plugins) and validate that high-risk actions are gated by least-privilege design and human-in-the-loop approval where appropriate.[6][7] It also suggests that security teams should operationalize ongoing attack simulation and telemetry-driven monitoring, rather than relying solely on static prompt hardening, because injection techniques and payloads evolve over time.[2][6][7]

Microsoft reports that multiple nation-state threat actors are experimenting with prompt injection by embedding malicious instructions into emails, SaaS documents, and websites to manipulate enterprise AI assistants and Copilots, causing system prompts to be overridden and leading to data leakage, phishing amplification, and unauthorized actions via connected tools.[1] Microsoft also describes new safeguards such as content labeling, isolation, and grounding, and urges organizations, including SMBs and SaaS providers, to treat untrusted AI inputs as part of their attack surface.[1] From a RealGround perspective, this is a clear case of indirect prompt injection against AI agents that have tool and data access, requiring secure agent design, targeted red teaming of AI workflows, and business logic audits to prevent unintended actions or data exposure when assistants process untrusted content. Organizations should systematically assess where AI agents consume external content, define strict tool-use and data-access policies, and implement continuous testing and governance to keep these controls effective as attackers evolve.

According to WithSecure’s report, attackers can embed malicious natural-language instructions inside Google Drive documents and metadata that are later processed by Gemini-powered features, causing indirect prompt injection that drives the AI agent to exfiltrate sensitive files and document details without traditional malware or explicit user intent.[1][2][3][7] Google acknowledged the issue and deployed mitigations such as classifiers, layered defenses, and content filtering to reduce data exfiltration risk from Gemini integrations.[3][7][8] From a RealGround perspective, this demonstrates that any AI agent with tool access to SaaS data (e.g., Drive, email, calendars) must be treated as operating over untrusted content, with strict least-privilege scopes, explicit business-logic guardrails on tool calls, and continuous red-teaming for cross-document and URL-based exfiltration paths. Organizations should include these Gemini-style integrations in AI security readiness assessments and agent build reviews, ensuring defenses against indirect prompt injection are designed, tested, and monitored over time.

The report describes a Black Hat USA demonstration of indirect prompt injection, where malicious instructions are embedded in external content and then executed by ChatGPT-style assistants when they ingest that content. The demonstration showed potential outcomes including unauthorized API calls and persuading users to reveal sensitive information, especially in SaaS and agent workflows connected to internal business tools. RealGround should treat this as a high-priority agent-security issue because any LLM that reads untrusted documents, emails, tickets, or web content can be steered into leaking data or taking unintended actions.