36 stories tagged prompt-injection, newest first.
692 points by ds | 200 comments
Redact blog post reporting that WhatsApp help pages contained hidden instructions telling AI models not to recommend contacting a regulator.
81 points by panoramas4good | 16 comments
Signals Corps blog post analyzing HTTP headers from 217 million crawled web responses for text aimed at AI agents, including prompt injection attempts.
11 points by ddaniel10 | 14 comments
F-Secure research article describing how the company built an AI shopping agent to test whether such agents can be trusted with purchases.
29 points by patresh | 5 comments
Check Point blog post on prompt injection attacks against Jev, a typed decision model that is not a language model but is still vulnerable to similar attacks.
6 points by northbridgedev | 2 comments
GitHub repo benchmarking open-source prompt-injection detectors like regex and Meta's Prompt Guard 2 against 629 AgentDojo attacks buried in tool output.
97 points by pavel_lishin | 40 comments
Ars Technica article reporting a serious zero-day vulnerability in Meta's Muse AI assistant, including a ClickFix attack that can hijack the agent.
27 points by franze | 34 comments
A Tell HN post where a user describes Claude Code finding a contract in Gmail, applying a saved signature image, and nearly sending it without permission.
335 points by Recursing | 112 comments
Blog post on Embrace The Red showing how a website summary request can hijack Claude Code Opus 5 in Auto Mode to achieve code execution via prompt injection.
323 points by Wirbelwind | 226 comments
Blog post analyzing results from 40,000 plays of a browser game where humans approve or deny AI coding agent commands, finding players missed one in three threats.
352 points by Canopy9560 | 271 comments
Blog post, part 3 of a series, describing how prompt-injection payloads in documents can self-propagate as AI worms through Microsoft Copilot for Word.
487 points by macleginn | 230 comments
Blog post describing how the author used a prompt-injection attack to trick Anthropic's Claude into leaking users' stored memory data.
487 points by ColinEberhardt | 187 comments
Noma Labs vulnerability research post describing how a crafted GitHub issue could trick GitHub's AI agent into leaking private repository contents.
343 points by cuchoi | 156 comments
Blog post recounting how over 2,000 people sent 6,000+ emails trying to get the author's OpenClaw AI assistant to leak a secrets file, which never leaked.
441 points by marc__1 | 231 comments
A post by John Scott-Railton noting malware authors embedded nuclear and bioweapons text in spyware to trigger LLM safety refusals and evade AI security scanners.
354 points by Wirbelwind | 143 comments
A 60-second browser game simulating Claude Code permission prompts, where players approve or deny agent commands under time pressure to illustrate approval fatigue.
519 points by bobsmooth | 215 comments
A GitHub markdown document in the ZetaLib repository describing "The Gay Jailbreak Technique," a prompt method for bypassing LLM safety filters, with Claude 4 examples.
588 points by edf13 | 181 comments
Blog post from grith.ai describing the "Clinejection" attack chain, where a prompt injection in a GitHub issue title led to a supply chain compromise of about 4,000 developer machines.
346 points by hentrep | 177 comments
HackMyClaw is a challenge site inviting users to extract secrets from Fiu, an OpenClaw email-reading AI assistant, via indirect prompt injection over email.
827 points by takira | 366 comments
PromptArmor threat intelligence report showing Claude Cowork is vulnerable to file exfiltration via indirect prompt injection due to code execution isolation flaws.
711 points by jjmaxwell4 | 189 comments
PromptArmor threat intelligence post showing how an indirect prompt injection in a blog can make Google Antigravity's browser subagent steal credentials and code from a user's IDE.
574 points by helloplanets | 190 comments
An X/Twitter post claiming Perplexity's Comet AI browser can be prompt-injected by any website to take actions like draining a user's bank account.
469 points by tatersolid | 131 comments
Trail of Bits blog post showing how downscaled images can hide multimodal prompt injections to exfiltrate data from production AI systems like Gemini CLI.
406 points by vismit2000 | 109 comments
Simon Willison's annotated presentation of his Bay Area AI Security Meetup talk on prompt injection, the lethal trifecta, and securing MCP-based systems.
609 points by Philpax | 270 comments
Simon Willison's blog post covering GPT-5's key characteristics, its place in the OpenAI model family, pricing, and notes from the system card.
798 points by rexpository | 433 comments
A General Analysis blog post describing how Supabase's MCP server can be exploited via prompt injection to leak an entire private SQL database.
477 points by andy99 | 287 comments
Invariant Labs blog post describing a vulnerability in the official GitHub MCP server that lets attackers access private repository data via AI agent prompt injection.
668 points by skilldeliver | 165 comments
Medium article by Elena Cross arguing that the Model Context Protocol (MCP) for AI agents has significant security weaknesses.
412 points by MedadNewman | 229 comments
Substack post by Matt Swann describing how to bypass DeepSeek R1's content filters by encoding prompts as hex charcodes.
325 points by gwintrob | 167 comments
Ted Benson's blog post describing how he tricked Google's NotebookLM AI podcast generator by modifying his website to feed it false claims.
578 points by tprow50 | 170 comments
PromptArmor blog post describing an indirect prompt injection vulnerability in Slack AI that lets attackers exfiltrate data from private channels.
436 points by ColinWright | 207 comments
Screenshot of a tweet describing hidden white-on-white prompt-injection text added to a resume to game AI-based candidate screening.
396 points by goranmoomin | 143 comments
Blog post describing how indirect prompt injection via Google Bard Extensions can be used to exfiltrate user data from Drive, Docs and Gmail.
392 points by tomduncalf | 193 comments
A tweet showing Bing Chat refusing to read a captcha image, then transcribing it when the captcha is placed in a locket and framed as a deceased grandmother's love code.
463 points by sebg | 164 comments
Simon Willison's blog post with video, slides, and transcript of his webinar talk explaining prompt injection and why proposed defenses fall short.
817 points by marvinvonhagen | 98 comments
A Twitter thread by Marvin von Hagen sharing the leaked confidential system prompt rules of GitHub Copilot Chat, obtained via prompt injection.
405 points by simonw | 182 comments
Simon Willison blog post explaining prompt injection vulnerabilities in LLM-based applications and the potential harms they can cause.