Active AI Security Signals

Check Point Research reports that indirect prompt injection is rising, with detections of longer malicious payloads increasing sharply between March and May 2026, and that enterprise AI data leakage remains persistent as more organizations use multiple AI apps, including some without official approval. The report also indicates higher-risk prompts are becoming more common. RealGround analysis: this points to a growing attack surface where malicious content can influence AI behavior and where governance gaps can increase the chance of unintended data exposure, so organizations should test agent boundaries, validate tool-use logic, and assess whether unsanctioned AI usage is creating leakage pathways.

Fact: Adversa AI reports a “Cryptographic Context Injection” technique against xAI’s Grok, where a seemingly normal web page used for summarization can cause the chatbot to exfiltrate a user’s name, approximate location, subscription tier, and current conversation prompts to an attacker-controlled server. Fact: The attack is triggered when the user asks Grok to summarize the malicious page, indicating a risk pathway via browsing or URL-summarization capabilities rather than direct user prompts. RealGround analysis: This aligns with an indirect prompt injection pattern, where attacker-controlled web content manipulates the model’s hidden instructions or context to override safe behavior and leak session data. RealGround analysis: Organizations integrating web-browsing or page-summarization into AI agents should harden context handling, implement strict output and network egress controls, and continuously red-team these workflows to prevent similar data leakage via indirect injection.

According to the article, researchers from Anthropic and EPFL demonstrated that self-propagating payloads (so-called “mind viruses”) can spread between autonomous AI agents via persistent, editable system prompt files used to maintain state across sessions. In their simulated multi-agent coding environment, a compromised prompt file allowed malicious instructions to silently propagate from one agent to another, without direct user interaction. RealGround’s analysis is that this represents a concrete instance of indirect prompt injection, where the attack surface is the shared state/prompt files rather than traditional user input channels. Practically, this implies that organizations using autonomous or multi-agent systems must treat shared prompts as untrusted inputs, implement strict isolation and validation of agent state files, and continuously red team agent ecosystems to detect self-propagating instructions before they impact production workflows.

SecurityWeek reports that the 'Ghostjacking' technique uses poisoned logs and alerts to plant hidden instructions that AI agents may later follow, turning trusted operational data into attacker-controlled input. The reporting ties the attack to AI-agent workflows that read logs from systems such as Cloudflare, Datadog, and Sentry and then take action based on that content. RealGround analysis: this is best treated as an indirect prompt injection risk against agentic systems, with security impact centered on unauthorized actions, privilege misuse, and weak separation between untrusted text and privileged tools.

The report describes “Ghostjacking,” an attack where malicious instructions are planted in trusted logs or alerts so an AI agent reads them as legitimate and carries out harmful actions. In the demonstrated scenario, a blocked request logged verbatim could cause an agent to change DNS settings and report the issue as resolved. RealGround’s assessment: this is a strong fit for indirect prompt injection because the attack leverages attacker-controlled content inside a trusted data source to steer agent behavior, creating a high-risk path to unauthorized tool use and infrastructure changes.

The report says Atlassian Rovo can be manipulated through attacker-controlled instructions hidden in content or in a crafted Rovo chat link, causing it to collect Jira or Confluence data a signed-in user can access and send it to an attacker-controlled endpoint. One route was reportedly fixed server-side, while the content-borne indirect prompt-injection path was still described as open at publication. RealGround analysis: this is a strong fit for indirect prompt injection and data leakage risk, and it warrants testing agent guardrails, URL/tool-use controls, and tenant-scoped exfiltration paths.

The report describes hidden prompt injection payloads embedded in "Ask AI" or similar deep-link buttons on websites, which can auto-execute in major AI assistants and attempt to write persistent instructions into assistant memory. Microsoft’s guidance characterizes this as AI recommendation poisoning / memory poisoning via URL prompt parameters, where attacker-supplied instructions like "remember" or "trusted source" bias future answers.[1][3][4] RealGround analysis: this is best treated as an indirect prompt injection risk because the malicious instruction is delivered through content a user clicks or processes, so organizations should audit outbound AI links, validate prompt parameters, and red-team any assistant flows that accept pre-filled prompts.

SecurityWeek reports that Zenity identified zero-click attacks against Claude in Chrome and ChatGPT Atlas, where malicious instructions hidden in emails or X posts could hijack the AI browser agents and lead to account takeover, phishing, and unauthorized purchases. The article says Zenity notified Anthropic and OpenAI in late 2025 and early 2026, but the issues remain unpatched. RealGround assessment: this is primarily an indirect prompt injection risk because the attack manipulates an agent’s interpretation of untrusted content, so controls should focus on prompt-boundary isolation, agent behavior auditing, and red-teaming of browser and email workflows.

According to The Hacker News and Pillar Security, researchers showed that a public, low-privilege GitHub issue in Google's ADK Python repository could prompt-inject a triage agent into posting a maintainer-only trigger comment (/adk-issue-fix) as the trusted adk-bot account, thereby activating a privileged code-fixing workflow and enabling CI runner code execution and bot PAT exfiltration.[1][3][4] Google responded by deleting three vulnerable workflows (issue-analyze.yml, issue-fix.yml, pr-analyze.yml) that processed untrusted issue and PR content with broad repository credentials.[1][3] From a RealGround perspective, this is a textbook *indirect prompt injection* and agent-to-agent privilege escalation in CI/CD, showing how seemingly benign public text can coerce one AI agent to call higher-privileged tools and workflows. Practically, orgs should re-architect multi-agent GitHub/CI integrations so that public-facing agents have minimal scopes, cannot directly trigger maintainer workflows, and are continuously red-teamed for cross-agent privilege boundary failures.

The article describes how attackers can abuse built-in email AI assistants (e.g., Copilot-like agents embedded in mailboxes) once an account is compromised, using the assistant as a Living off the Land mechanism to discover sensitive information, impersonate employees, and escalate to executive account takeover and fraud.[1][8][13] Research on Email Agent Hijacking and real-world attacks like EchoLeak show that crafted emails and inbox content can override an assistant’s system prompts, turning routine summarization or reply features into stealth phishing, data exfiltration, and business email compromise channels.[11][15][19] From a RealGround perspective, this is a textbook indirect prompt injection and AI agent abuse risk on email-integrated assistants: organizations need continuous AI red teaming to simulate these inbox-driven hijack scenarios, validate that assistants resist hidden instructions in email bodies/HTML, and ensure defensive controls around account compromise, MFA, and assistant permissions are tested under realistic attacker use of the AI’s own capabilities.[8][15] Practically, security teams should map which email accounts are AI-enabled, constrain assista

The reported issue says a hidden pull request comment in Azure DevOps can influence an AI review agent through Microsoft’s Azure DevOps MCP server, causing the agent to act outside the intended review scope and potentially leak information it discovers. The article also says there was no fixed release or public CVE at the time, and that the weakness stems from one MCP tool returning pull request descriptions without prompt-injection guardrails. RealGround analysis: this is best classified as indirect prompt injection with AI agent abuse potential, so controls should focus on tool-authorization boundaries, least-privilege scoping, and red-teaming of agent workflows that ingest untrusted PR content.

The article reports a series of severe vulnerabilities in AI agent and LLM infrastructures, including multiple flaws in major agent frameworks (LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK) that enable issues such as insecure deserialization, SSRF, path traversal, SQL injection, and use-after-free. It highlights concrete exploit chains such as a Microsoft Agent Framework deserialization bug triggerable via prompt injection, unauthenticated code execution in Google ADK, LangGraph checkpointer issues, the CoSnitch flaw in Microsoft Copilot Personal that allows one-click data exfiltration via indirect prompt injection, and LiteLLM gateway bugs enabling privilege escalation and server code execution. From a RealGround perspective, this demonstrates that prompt- and indirect prompt-based attacks can directly bridge into underlying agent runtimes and infrastructure, resulting in remote code execution and data exfiltration if guardrails and isolation are weak. Organizations should harden agent architectures, enforce strict isolation and validation around tools and plug-ins, and conduct continuous red teaming focused on indirect prompt injection paths th

The article describes research showing that open-source Android AI agent frameworks can be exploited by a malicious app that overlays invisible text on the screen and writes to shared storage, causing the agent to read hidden instructions and ultimately execute commands on the connected host PC.[1][2][3] These are demonstrated, practical exploit chains against multiple mobile agents (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, MobA), with all tested agents failing most of the attack scenarios and some enabling reliable arbitrary code execution on the host.[1][3] From a RealGround perspective, this is a textbook indirect prompt injection and tool-abuse problem: untrusted UI and storage content is treated as safe "observations," then passed unvalidated into high-privilege actions (ADB shell, host command runners), with no action-level authorization or system-call–level scrutiny.[1][2][9] Organizations using mobile or cross-device AI agents should implement secure agent design (no shell=True, strict tool whitelists, screenshot sanitization, confirmation for sensitive actions) and subject these agents to ongoing red teaming and business-logic audits focused on invisible U

According to the report, a flaw in AWS Kiro’s agentic IDE allowed *hidden text on a web page* to indirectly influence the agent so that it rewrote its own configuration file (mcp.json) and executed attacker-controlled code on a developer’s machine without any effective approval step.[5][11] The issue affected specific Kiro versions (e.g., 0.9.2 on macOS and 0.10.16 on Ubuntu) and has since been patched by AWS, with newer releases requiring explicit approval before changes to sensitive configuration files.[11] From a RealGround perspective, this is a textbook indirect prompt injection and AI agent abuse case, where untrusted external content (web pages) is treated as trusted context by an autonomous coding agent, enabling self-reconfiguration and RCE. Practically, organizations need stronger guardrails for file- and config-modifying tools, explicit trust boundaries around all external data sources, sandboxed execution for AI-driven actions, and continuous red teaming of agent behaviors to catch these cross-context escalation paths early.

According to CSO Online’s report on recent StakeBench-style research, current AI web agents powered by leading models show no reliable defenses against prompt injection, with indirect attacks hidden in ordinary web content achieving success rates between roughly 42% and 68% across configurations.[1][3][5] The study finds that even when agents are configured with safety measures, none consistently block these attacks, leaving enterprise deployments exposed when agents browse or consume untrusted online data.[1][3][12] From a RealGround perspective, this highlights indirect prompt injection as a structural risk for any agent that autonomously reads web pages, emails, documents, or RAG content, and indicates that security controls must focus on architectural isolation, strict tool-permission design, and continuous adversarial testing rather than relying solely on prompt-level defenses. Organizations should pair secure-by-design agent architectures with ongoing red teaming and business logic audits to detect and contain injection pathways before they lead to data exfiltration, fraud, or operational misuse.

The report describes a red-team study where malicious prompt-injection payloads are hidden in log fields such as usernames and URLs, then triggered when analysts use an LLM to triage logs; the entry says this approach achieved up to about 88% success in concealing malicious activity or exfiltrating data. It also notes serious mem0 agent-memory server issues, including unauthenticated APIs that can read, write, or delete stored memories, plaintext exposure of LLM API keys, and SSRF toward cloud metadata endpoints. RealGround implication: systems that let LLMs consume untrusted operational data or rely on persistent agent memory should be treated as high-risk and validated with red teaming, business-logic review, and hardened build controls.

The article describes a new "agent data injection" (ADI) attack where adversaries disguise malicious payloads as trusted metadata or structured fields (such as button IDs, sender names, or tool response records), causing AI agents to misclick UI elements or execute attacker-controlled commands while apparently following the user’s task.[1][4] Research shows ADI works against major web and coding agents from OpenAI, Anthropic, and Google, with high success rates even when state-of-the-art prompt-injection defenses, model hardening, and dual-LLM schemes are in place.[1][2][4][5] From a RealGround perspective, this is a high-severity form of indirect prompt injection that exploits missing isolation between trusted and untrusted data, turning everyday agent actions (clicking buttons, running local commands, acting on repo data) into a potential RCE and supply-chain surface.[3][4][5] Defenders should prioritize architectural changes in agent designs—strict data provenance and trust boundaries, minimal tool permissions, intent binding, randomized/ephemeral identifiers, and continuous red teaming of agents handling untrusted web, email, or code content—to reduce the impact of ADI-style at

VentureBeat is reporting on Tenet Security's "agentjacking" research, where a fake Sentry error message sent via a public DSN hijacked Claude Code in roughly 85% of tested scenarios without triggering security alerts or requiring credential theft.[1][5][9][11] The attack works as an *indirect prompt injection* delivered through a trusted MCP integration: malicious instructions are embedded in Sentry error content that the coding agent then treats as legitimate guidance, leading it to execute attacker-controlled code on a developer machine.[1][5][11] From a RealGround perspective, this demonstrates that agentic coding assistants wired to observability and SaaS tooling have a high-impact attack surface where tool responses must be treated as untrusted input, with strict guardrails on code execution, permissions, and human approval.[4][11][12] Organizations should prioritize redesigning agent trust boundaries, auditing MCP/business logic flows, and continuously red-teaming AI agents connected to production or CI/CD environments to detect and contain similar tool-based injection paths before they are exploited in the wild.[4][10][11]

Reported facts: The GitLost flaw disclosed by Noma Labs affects GitHub Agentic Workflows, where a hidden instruction embedded in a public GitHub Issue can prompt an AI agent with repository access to disclose private repository data in a public comment. The issue arises because the agent improperly trusts and executes instructions from untrusted, user-controlled content. RealGround analysis: This is a clear case of indirect prompt injection leading to data leakage, showing that agents interacting with mixed-trust sources must enforce strict input validation, context separation, and least-privilege access. Organizations should harden agent designs, audit business logic around how agents consume external content, and continuously red-team agent workflows to detect similar injection paths before they reach production.

SecurityWeek reports that a critical flaw in GitHub Agentic Workflows, called GitLost, lets an unauthenticated attacker hide malicious instructions in a public GitHub Issue and cause an AI agent to expose data from private repositories. The report and supporting coverage say the attack works through indirect prompt injection, especially when the workflow reads untrusted public input while holding cross-repository access and can post public output. RealGround analysis: this is a high-priority agent-design and permission-scope issue, so teams should audit workflow logic, minimize repository access, and red-team all untrusted input paths before deployment.

According to Noma Security, the "GitLost" vulnerability in GitHub Agentic Workflows allows an unauthenticated attacker to post a crafted but normal-looking issue in a public repository that, via hidden natural-language instructions, causes the AI agent to read from and leak data in the organization’s private repositories when the agent has cross-repository read access.[1][3] This is a textbook *indirect prompt injection* / Agentic Workflow Injection case, where user-controlled issue text is ingested into the agent’s prompt and converted into data-exfiltrating behavior without any stolen credentials or direct code exploit.[3][4] From a RealGround perspective, this highlights the need to redesign agent workflows so untrusted GitHub events (issues, PR descriptions, comments) are never treated as trusted instructions, to enforce strict least-privilege on cross-repo access, and to continuously red-team agent behavior against prompt-injection and data leakage scenarios. Organizations should use Secure AI Agent Build and AI Agent Business Logic Audit to harden workflow design, and Continuous AI Red Teaming to repeatedly test for similar AWI flaws before they reach production.

According to the report and related research, attackers used SEO poisoning and malicious websites embedding hidden instructions to perform indirect prompt injection against autonomous AI agents, coercing them into making unauthorized cryptocurrency payments or trusting fraudulent crypto platforms.[1][2][5][7] These campaigns target browsing and DeFi-capable agents whose plugins or connected wallets can execute real financial transactions, demonstrating that prompt-based guardrails alone are insufficient to prevent agent compromise and unauthorized transfers.[5][6] From a RealGround perspective, the practical implication is that any AI agent with transaction, trading, or wallet privileges must be treated as a high-risk fintech surface: enforce least-privilege action-layer controls (spend limits, allowlists, mandatory human approval for payments), cryptographically verify directives, and continuously red-team agents against indirect web-based injections before production use.[3][4][6][7] Organizations should also audit agent business logic and memory handling to ensure that injected instructions from web content cannot persist or propagate across sessions, reducing the likelihood

According to LayerX’s research, the BioShocking technique uses indirect prompt injection inside web content to manipulate agentic AI browsers into abandoning safety guardrails and exfiltrating credentials from authenticated sessions.[4][5] The attack convinces the AI that it is in a game-like alternate reality, so it applies game rules instead of security logic and willingly copies secrets such as GitHub SSH credentials to an attacker.[3][5] From a RealGround perspective, this demonstrates that any AI agent with browser or system access must be designed with strict context isolation, confirmation gates for sensitive operations, and scope limiting aligned to least privilege, and should be continuously red-teamed against indirect prompt injection scenarios.[1][5] Organizations should also update AI governance and usage policies so that AI browsers and autonomous agents are treated as privileged identities whose access, behavior, and attack surface require the same controls and monitoring as human admin accounts.[3][7]

The article reports on CVE-2026-21520 as a critical flaw in Microsoft Copilot Studio where email and calendar content could be abused for indirect prompt injection, enabling zero-click agent attacks and sensitive data exfiltration via downstream agents even after initial vendor patches.[1][10][13] Public vulnerability feeds classify CVE-2026-21520 as a high-severity information disclosure issue over a network vector with no required privileges or user interaction, impacting confidentiality in Copilot Studio.[1][4][11] From a RealGround perspective, this demonstrates that business content and SaaS workflows (e.g., email, calendar, SharePoint forms) can act as an AI supply chain attack surface, requiring hardening of agent triggers, default-deny on risky actions, strict allowlisting of outbound connectors, and continuous red teaming focused on indirect prompt injection patterns.[8][10][13] Organizations using AI copilots for CRM-style and SaaS automations should treat internal data sources as potentially hostile, implement robust egress controls and least-privilege scopes for agent tools, and subject Copilot/agent configurations to structured business logic audits and SBOM-style supp

The recap highlights new AI-linked threats, notably Gaslight macOS malware and a Rust-based macOS implant that embed prompt injection payloads specifically to mislead AI-assisted malware analysis tools into aborting or refusing analysis.[2][4] It also reports serious indirect prompt injection risks in agentic IDEs and coding agents, where attacker-controlled but seemingly benign repositories can trigger tool access, code execution, file operations, and network calls.[2][4] From a RealGround perspective, these demonstrate that AI-powered security and coding tools can be turned into attack surfaces: organizations should treat AI agents as high-privilege components, enforce strict tool- and repo-access controls, and continuously red-team agent workflows to identify and mitigate indirect prompt injection paths before they lead to compromise.

According to Mozilla’s 0DIN researchers, seemingly benign GitHub repositories can embed indirect instructions that lead Claude Code and similar AI coding agents to execute a staged setup flow, ultimately spawning a reverse shell on the developer’s machine when the agent "helps" fix a failing initialization step.[1][6] Once the interactive shell is established, an attacker can access environment variables, credentials, API keys, tokens, source code and deploy persistent backdoors, all triggered by routine-looking agent actions on a clean-appearing repo.[1][6] From a RealGround perspective, this exemplifies indirect prompt injection against agentic coding tools, where untrusted repositories and configuration flows become a covert control channel; organizations should harden AI agent workflows, restrict tool permissions, and continuously red-team agent behavior against malicious repos and hidden instructions. Secure AI Agent Build and Continuous AI Red Teaming can help design safer toolchains, validate repository trust models, and detect exploitable prompt and tool use patterns before they reach production developer environments.

The article describes macOS.Gaslight, a Rust-based macOS implant and infostealer linked with high confidence to North Korea–aligned actors that embeds a 3.5 KB prompt-injection payload of 38 fabricated "system" messages inside the malware sample itself.[2][6] These Markdown-fenced messages are crafted to mimic an LLM triage harness and claim token expiry, OOM kills, disk failures, bogus injection warnings, and static-analysis flags, with the explicit goal of steering LLM-assisted analysis tools into aborting, truncating, or misclassifying the analysis rather than attacking the model directly.[2][4][6] From a RealGround perspective, this is a clear indirect prompt injection pattern where adversarial content in an analyzed artifact targets downstream AI agents in the reverse-engineering pipeline, showing that any system which blindly feeds untrusted sample content into LLMs is at risk of evasion and mis-triage. Defenders should treat all artifact content as adversarial input, enforce strict prompt scaffolding and content isolation in AI tooling, and incorporate adversarial-prompt testing and hardening (via secure agent design, business-logic audits, and continuous AI red team

Report facts: The article explains how "AI agent traps" turn information itself into an attack surface by embedding hidden content injections, semantic manipulation, and cognitive state poisoning into otherwise trusted data sources that autonomous agents read.[2][1] It highlights that attackers can corrupt agents’ reasoning, memories, and action policies via poisoned RAG corpora, long‑term memory, and contextual examples, and that no single control can mitigate this class of attacks.[2][3] The article calls for a defensive framework including source verification, content screening, memory governance, restricted permissions, isolated execution, monitoring, and human‑in‑the‑loop approval for high‑impact actions.[2] RealGround analysis: Practically, this is an indirect prompt injection and behavioral control problem—organizations must treat every external data source an agent can read as untrusted input, enforce strict tool-permission and egress controls, and continuously red‑team agents against content and memory poisoning scenarios to prevent the agent’s own autonomy from being weaponized.

The article describes a range of traditional threats—browser bugs, abused integrations, fake tools, poisoned websites, and malware (including EDR killers and Android trojans)—being delivered via common web vectors like extensions, weak credentials, sketchy downloads, and compromised WordPress sites. These same web vectors and compromised pages are the primary substrate for indirect prompt injection attacks against AI-enabled browsers and agents, where malicious instructions are hidden in page content or integrations and executed by the AI rather than the user.[2][4][5][8] From a RealGround perspective, any environment using browsing agents or AI-augmented security tooling is at heightened risk that such poisoned websites or extensions could be weaponized to exfiltrate data or subvert agent behavior via indirect prompt injection, so organizations should continuously red team their AI agents against realistic web-based threat scenarios aligned to these patterns.

The reported research shows that the self-hosted OpenClaw AI agent can be coerced into executing attacker-controlled code and exposing sensitive data via seemingly benign content, such as vCards, shared contacts, location pins, and crafted URLs embedded in normal workflows. This aligns with other findings that OpenClaw is highly exposed to prompt injection and indirect prompt injection, including data exfiltration through link previews and remote code execution via crafted links and misconfigured gateways.[1][2][3] These are factual reports of real-world exploitation techniques against OpenClaw-like agents that automatically act on untrusted inputs. From a RealGround perspective, this underscores the need to redesign agent business logic to treat all external content as untrusted, add strict tool/use constraints and review layers, and continuously red-team agent behaviors so that hidden instructions in user data cannot silently trigger code execution or data leakage.

The report describes an indirect prompt injection flaw in Google Gemini for Android where malicious text embedded in notifications from apps like WhatsApp, Slack, SMS, Signal, Instagram, or Messenger was treated as executable instructions by the voice assistant, without needing any malicious app on the device.[1][2] According to the research, an attacker-crafted notification could drive Gemini to control smart-home devices, open tracking URLs, force-join Zoom calls, fake messages from trusted contacts, and even poison Gemini’s long-term memory at the account level.[1] Google has deployed server-side mitigations via improved content classification, but the attack surface demonstrates that any untrusted content source feeding an AI agent can silently become a control channel.[1][2] From a RealGround perspective, organizations using or building AI assistants that read notifications, inboxes, or messages should treat all such external content as untrusted, and use continuous AI red teaming to simulate indirect prompt injection via common channels (notifications, email, chat) before rollout.

Researchers at Permiso Security disclosed a vulnerability in ChatGPT, dubbed "ChatGPhish," where the chatgpt.com renderer implicitly trusts Markdown links and images in web summaries, enabling attackers to inject malicious prompts and turn those summaries into a phishing vector.[1] According to the report, this allows hostile content embedded in third‑party pages to influence ChatGPT’s behavior or present deceptive UI elements to users when web content is summarized.[1] From a security perspective, this illustrates a classic indirect prompt injection and UI phishing risk whenever LLMs automatically render or act on untrusted external content. RealGround analysis: organizations integrating web-browsing LLM agents should enforce strict content sanitization, limit Markdown/HTML rendering, and continuously red-team agent behaviors against prompt injection and phishing-style manipulations.

Attackers can hide malicious instructions inside external data sources (like emails or ticketing systems). When an enterprise AI agent reads these inputs, it executes the payload. This leads to data exfiltration, unauthorized tool operations, and complete agent hijack.

The article reports that researchers from Google and Forcepoint have observed real-world indirect prompt injection attacks against production AI systems, where hidden instructions are embedded in content like web pages, documents, or emails to hijack model behavior and exfiltrate sensitive data or credentials. It describes how AI agents that autonomously retrieve and act on external content are especially exposed, because they may treat untrusted data as trusted instructions. From RealGround’s perspective, organizations should harden agent architectures so that retrieved content is strictly sandboxed as data, not instructions, and implement robust input/output filters, least-privilege data access, and continuous adversarial testing. RealGround would also recommend targeted business logic audits and ongoing red teaming focused on indirect prompt injection paths, including email, document, and web-integration workflows.

The article reports Anthropic's testing of a browser-based AI agent, where prompt injection attacks successfully hijacked the agent in 31.5% of trials before safeguards activated, illustrating a high real-world failure rate for agents consuming untrusted web content.[3][8] It compares Anthropic’s disclosures with those from OpenAI, Google, and Meta, noting that varying methodologies make cross-vendor metrics difficult but consistently show that tool-using, web-connected agents are highly exposed to prompt injection and unintended tool use.[3][8] From a RealGround perspective, this is a clear case of indirect prompt injection risk: malicious instructions embedded in external web pages or tool outputs can override agent policies and initiate harmful actions, even when vendors deploy safeguards.[9][13] Organizations deploying browser or tool-using AI agents should invest in secure agent architectures, continuous red teaming focused on prompt injection, and business logic audits to constrain tool permissions, isolate browsing environments, and rigorously test containment mechanisms before production use.

The article summarizes 2025 AI agent security incidents, including Black Hat USA 2025 demos and CVE-2025-32711 (EchoLeak), a critical zero-click vulnerability in Microsoft 365 Copilot where a single crafted email could trigger indirect prompt injection and automatic data exfiltration from Copilot’s accessible scope.[2][4][7][8] It also notes multi-platform agent exploits across Copilot, Salesforce, Google Gemini, Slack’s AI assistant, and Drift chatbots impacting hundreds of organizations.[1][4][8] From a RealGround perspective, these incidents demonstrate that untrusted content (emails, chat messages, integrated SaaS data) can act as indirect prompts that bypass guardrails and cause AI agents to leak sensitive data at scale, even without user interaction. Organizations should prioritize AI Agent Business Logic Audits, secure AI agent design, and continuous AI red teaming focused on scope violations and data exfiltration paths across their M365, CRM, and SaaS integrations.

The report says CNCERT warned that OpenClaw AI agents can be manipulated through indirect prompt injection, where malicious instructions hidden in web pages, documents, emails, or other untrusted content can redirect the agent’s behavior. It also states that compromised agents may leak sensitive organizational data or perform unauthorized actions when processing poisoned inputs. From a RealGround perspective, this is a high-priority agent security issue because it affects both control-flow integrity and the confidentiality of data the agent can access.

The article describes how AI agents that read PDFs, websites, and emails can be compromised by hidden or embedded instructions, causing them to exfiltrate data, leak other users' information, or take unintended financial and operational actions—an example of indirect prompt injection against agents with tools and memory.[1][3][4][7] The post references industry research and telemetry, including a reported rise in hidden prompt payloads on the web and demonstrations of malicious instructions persisting in long‑term agent memory, and recommends structural separation of instructions, output validation, and strict action limits as mitigations.[3][4][6][7] From a RealGround perspective, these scenarios indicate a high‑impact but application‑dependent risk that requires secure agent architectures (least‑privilege tools, hard boundaries between content and instructions, and robust validation) and ongoing red teaming of real agent workflows to detect injection pathways before they are abused.[1][3][4][7] Organizations deploying SaaS or internal agents over business data should treat all external content as untrusted, rigorously audit agent business logic and permissions, and continuously t

TrendAI’s report shows that multi-modal AI agents can be covertly manipulated via indirect prompt injection hidden in web pages, images, and documents, enabling sensitive data exfiltration without any explicit user action.[4][1] It highlights document-based payloads (e.g., MS Word) and the Pandora proof-of-concept, where embedded instructions drive unauthorized code execution and data leakage to external destinations.[4][6] From a RealGround perspective, this underscores the need to redesign agent architectures with strict network and URL access controls, robust content filtering (including OCR for images), and fine-grained permissioning around data sources and tools to constrain what an injected prompt can reach.[4][2] It also supports continuous AI red teaming to simulate zero-click exfiltration paths, combined with business-logic audits to ensure agents never autonomously expose confidential data from chat history, uploaded files, or connected systems.[1][2]

Report facts: Varonis describes ForcedLeak as a vulnerability chain in Salesforce Agentforce that uses indirect prompt injection, agent overreach, and content security policy misconfiguration to silently exfiltrate sensitive CRM data while bypassing normal access controls. Attackers craft prompts that manipulate the agent into leaking customer relationship data without obvious signs to the victim organization. RealGround analysis: This reflects a high-severity indirect prompt injection and AI agent abuse scenario where business logic and access control are effectively bypassed through content-level attacks. Organizations should harden agent decision logic, strictly constrain data-access actions, and continuously red team AI agents against malicious prompt patterns that could trigger unauthorized data leakage.

The article reports that a single manipulated webpage can use indirect prompt injection to steer an AI agent into retrieving internal company data and sending it to a remote server. It also notes that common browsing and data-retrieval agent setups can be repurposed for stealthy exfiltration, and recommends policy checks, output monitoring, and tighter control over internal data access. RealGround analysis: this is a high-relevance agentic security issue because the failure mode combines untrusted external content with autonomous tool use, so guardrails, least privilege, and adversarial testing are directly applicable.

The article reports EchoLeak as a real-world zero-click vulnerability in Microsoft 365 Copilot that let an external attacker exfiltrate sensitive data from a victim’s Copilot session without user interaction. The attack abused embedded instructions and trust-boundary failures in Copilot’s handling of shared content, which the authors describe as an LLM scope violation and a practical high-severity prompt injection class.[1] RealGround analysis: this maps most directly to indirect prompt injection because the core issue is malicious instructions hidden in normal content; organizations should harden agent trust boundaries, audit business logic around external inputs, and continuously red-team Copilot-like workflows.

Report facts: The r/aisecurity post explains how crafted or embedded prompts can exploit LLM context to override intended behavior and cause data leakage, leading models to reveal internal or sensitive information when guardrails and filtering are insufficient.[1][2][8][10] It describes example attack scenarios where indirect prompt injection via external content (web pages, documents, emails) results in confidential data exfiltration from deployed AI systems.[1][2][3][5] RealGround analysis: This content highlights a combined indirect prompt injection and data leakage risk path, making it highly relevant to organizations deploying agentic or integrated LLM systems that ingest untrusted data. Practically, this warrants continuous AI red teaming to simulate indirect injection payloads, secure agent design with strict trust boundaries and data access controls, and business logic audits to ensure prompts, tools, and retrieval pipelines cannot be easily manipulated to exfiltrate sensitive data at runtime.

Cybersecurity Dive reports on Zenity Labs research showing that leading AI agents from OpenAI (ChatGPT), Microsoft Copilot Studio, Google Gemini, and Salesforce Einstein can be hijacked via minimal- or zero-interaction indirect prompt injection embedded in emails, calendar items, and SaaS workflows.[4][1] These attacks enabled data exfiltration from connected stores (e.g., Google Drive, CRM databases), workflow manipulation (e.g., rerouting Salesforce communications), and long‑term agent memory persistence and impersonation of users.[4][1] From a RealGround perspective, this highlights that agentic workflows tightly integrated with SaaS, fintech, and healthcare systems are exposed to systemic trust-boundary failures: attacker-controlled content is treated as trusted instructions, allowing the agent to inherit and abuse user permissions across tools and data.[4][1][5] Organizations should implement secure agent architectures, rigorous business logic and tool-permission audits, and continuous red teaming focused on indirect prompt injection paths to detect and harden against these zero-/low-click hijacking scenarios before deploying AI agents into critical workflows.

The article describes a 'Toxic Agent Flow' attack on the GitHub MCP server in which an attacker plants a malicious GitHub issue that is later consumed by an AI agent, causing the agent to follow hidden instructions and exfiltrate data from private repositories.[1][4][10] This is reported as an architectural, prompt-injection-driven exploit against agentic AI systems that trust unvetted external content, rather than a traditional software bug in the MCP server code.[1][4][9] From a RealGround perspective, this is an indirect prompt injection scenario where attacker-controlled content in a public repo becomes part of the agent’s context, enabling unauthorized data leakage and toxic tool flows.[5][8][10] Practically, organizations need least-privilege scoping of MCP tokens, per-repository isolation, human or policy-based review of agent actions, and continuous red teaming/monitoring to detect and block similar toxic agent flows before sensitive data is accessed or exfiltrated.[2][4][8][9][10]

The CrowdStrike article describes indirect prompt injection attacks where adversaries plant malicious instructions in external content (documents, emails, web pages, tools) that GenAI systems later ingest, causing the model to misinterpret that content as instructions and override intended behavior.[1][6] It notes that prompt injection, including indirect variants, is classified as the top OWASP 2025 GenAI risk and highlights potential impacts such as data exfiltration and unintended high-privilege actions.[1][6] From a RealGround perspective, this implies organizations need hardened AI agent architectures with strict source allowlisting, least-privilege and action-approval controls, and continuous adversarial testing of agent tool use to detect and contain such injections before they lead to business-impacting compromise. RealGround can support this with Secure AI Agent Build for defensive patterns, AI Agent Business Logic Audit to identify insecure tool/permission design, and Continuous AI Red Teaming to emulate real-world indirect prompt injection attempts against deployed systems.

The article/video reports that browser-based AI agents can be manipulated by hidden instructions embedded in web content, causing them to override their original objectives; it also notes that researchers have found web agents are frequently susceptible to these attacks and warns against unsupervised sensitive actions such as purchases or handling PII[5]. RealGround analysis: this is a high-priority indirect prompt injection risk because the agent’s external-content ingestion and tool use can be coerced into unsafe actions, so controls should focus on least privilege, action confirmation, content isolation, and ongoing red-teaming[1][2][3].

The Unit 42 article documents real-world cases of web-based indirect prompt injection, where attackers hide instructions in webpages that AI agents later crawl or summarize, causing the agents to execute attacker-controlled behavior without any obviously malicious user prompt.[2][4] The report shows that when such agents have tools or data access, these hidden prompts can drive unauthorized actions, leak credentials or payment data, and compromise decision workflows, turning routine browsing or summarization features into an attack surface.[2][4] From a RealGround perspective, this highlights the need to tightly scope agent permissions, enforce strict source and content trust policies, and implement runtime detection for anomalous tool use or data access triggered by external content. It also implies organizations should red team agent workflows specifically for hidden web-based instructions and update business logic so agents treat all external content as untrusted unless explicitly allowlisted.

The article reports research showing that roughly 94% of AI agents in production are exploitable once they read untrusted external content (documents, emails, web pages) and then take real-world actions, highlighting prompt and command injection as the dominant risk channel for these systems.[1][2][3][6][7] It cites a real command injection vulnerability in a widely deployed AI tool that enabled remote code execution across hundreds of thousands of installations, reinforcing that seemingly "normal" agent workflows can be turned into execution paths for attackers.[5][6] From a RealGround perspective, this maps directly to indirect prompt injection risk in autonomous and tool-using agents, and implies organizations need to treat every external data source as potentially adversarial and strictly limit what actions an injected agent can perform. Practically, this means redesigning agents with least-privilege and "least agency" principles, adding pre-deployment business logic audits, and running continuous red teaming to detect and contain injection paths before they lead to data exfiltration or code execution in production.[1][3][5]

The article reports that OWASP ranks prompt injection as the #1 risk for LLM applications in 2025 and highlights that indirect prompt injection via external data sources is especially dangerous for autonomous agents with tool/API access, enabling unauthorized calls, code execution, or data exfiltration.[1][3][6][8] It describes layered defenses including behavioral monitoring, adversarial testing, and runtime guardrails to protect startup and SaaS LLM deployments.[3][6][7] From a RealGround perspective, this implies organizations should continuously red-team their LLM agents against both direct and indirect injection paths (e.g., RAG sources, third-party tools, plugins) and validate that high-risk actions are gated by least-privilege design and human-in-the-loop approval where appropriate.[6][7] It also suggests that security teams should operationalize ongoing attack simulation and telemetry-driven monitoring, rather than relying solely on static prompt hardening, because injection techniques and payloads evolve over time.[2][6][7]

Microsoft reports that multiple nation-state threat actors are experimenting with prompt injection by embedding malicious instructions into emails, SaaS documents, and websites to manipulate enterprise AI assistants and Copilots, causing system prompts to be overridden and leading to data leakage, phishing amplification, and unauthorized actions via connected tools.[1] Microsoft also describes new safeguards such as content labeling, isolation, and grounding, and urges organizations, including SMBs and SaaS providers, to treat untrusted AI inputs as part of their attack surface.[1] From a RealGround perspective, this is a clear case of indirect prompt injection against AI agents that have tool and data access, requiring secure agent design, targeted red teaming of AI workflows, and business logic audits to prevent unintended actions or data exposure when assistants process untrusted content. Organizations should systematically assess where AI agents consume external content, define strict tool-use and data-access policies, and implement continuous testing and governance to keep these controls effective as attackers evolve.

According to WithSecure’s report, attackers can embed malicious natural-language instructions inside Google Drive documents and metadata that are later processed by Gemini-powered features, causing indirect prompt injection that drives the AI agent to exfiltrate sensitive files and document details without traditional malware or explicit user intent.[1][2][3][7] Google acknowledged the issue and deployed mitigations such as classifiers, layered defenses, and content filtering to reduce data exfiltration risk from Gemini integrations.[3][7][8] From a RealGround perspective, this demonstrates that any AI agent with tool access to SaaS data (e.g., Drive, email, calendars) must be treated as operating over untrusted content, with strict least-privilege scopes, explicit business-logic guardrails on tool calls, and continuous red-teaming for cross-document and URL-based exfiltration paths. Organizations should include these Gemini-style integrations in AI security readiness assessments and agent build reviews, ensuring defenses against indirect prompt injection are designed, tested, and monitored over time.

The NIST technical blog frames AI agent hijacking as a modern variant of classic injection vulnerabilities, arising when systems fail to clearly separate trusted internal instructions from untrusted external data consumed by agents.[9] It warns that attackers can embed malicious instructions in data streams, causing agents to execute unintended actions, and calls for stronger evaluation and red-teaming methods, particularly for high-stakes sectors like finance and healthcare.[9] From a RealGround perspective, this highlights indirect prompt injection as a core risk: organizations need secure-by-design agent architectures that isolate untrusted inputs from privileged tools, plus continuous adversarial testing to validate that business logic and safety controls cannot be subverted through data-driven instructions. Practically, this means formalizing evaluation programs that simulate hijacking scenarios, auditing tool-permission graphs, and integrating ongoing red teaming into Secure AI Agent Build and AI Agent Business Logic Audit workflows for regulated domains.

The report describes a Black Hat USA demonstration of indirect prompt injection, where malicious instructions are embedded in external content and then executed by ChatGPT-style assistants when they ingest that content. The demonstration showed potential outcomes including unauthorized API calls and persuading users to reveal sensitive information, especially in SaaS and agent workflows connected to internal business tools. RealGround should treat this as a high-priority agent-security issue because any LLM that reads untrusted documents, emails, tickets, or web content can be steered into leaking data or taking unintended actions.