Loading story…
A newly discovered zero-click attack, dubbed Shadow Escape, is enabling threat actors to exfiltrate vast amounts of sensitive data—including Social Security numbers, financial information, and medical records—from organizations using popular AI assistants. The attack exploits the Model Context Protocol (MCP), a standard used to connect large language models such as ChatGPT, Claude, and Gemini to internal databases and tools. By embedding concealed instructions within seemingly benign documents, attackers can trigger AI assistants to extract and transmit private data without any user interaction or awareness.
Researchers from Operant AI warn that the attack leverages default MCP permissioning, making it easy to perpetrate and difficult to detect, with the potential for trillions of records to be compromised and sold on the dark web. The attack does not require traditional phishing or user error; instead, it relies on the AI assistant's legitimate access to sensitive information, which is then abused for stealthy data exfiltration. Organizations are urged to audit their AI agent deployments and review MCP configurations to mitigate this emerging threat.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting emphasized that the newly disclosed Shadow Escape attack could lead to data exposure in AI assistant environments. This appears to be additional coverage of the same disclosure rather than a separate real-world incident.
Shadow Escape was publicly reported as a new zero-click attack technique affecting AI assistants, with claims that it could expose sensitive data at large scale. Coverage described the issue as putting vast numbers of records at risk through AI assistant interactions.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
CrowdStrike and external reporting warn that attackers are increasingly abusing legitimate enterprise AI tools, chatbots, and autonomous agents to conduct stealthy intrusions in a shift described as **"living off the AI land."** Findings cited from CrowdStrike’s threat reporting say more than 90 organizations experienced misuse of legitimate AI tools to generate malicious commands, exfiltrate sensitive data, steal credentials, and support financially motivated crime including cryptocurrency theft. The reporting also says **ChatGPT** was referenced on criminal forums far more often than rival models, with mentions reportedly **550% higher** than competitors, underscoring growing attacker interest in AI-enabled tradecraft. Security leaders are being warned that compromised AI agents may pose greater risk than traditional living-off-the-land tools such as **PowerShell** because they can inherit broad privileges and operate across multiple enterprise systems. CrowdStrike Field CTO Zeki Turedi said many organizations lack the governance, identity controls, and telemetry needed to distinguish AI-agent activity from human behavior, creating blind spots for detection and response. Survey data cited from the Cloud Security Alliance found **68%** of respondents could not accurately identify agent activity versus human activity, highlighting a widening visibility gap as AI becomes both an attack amplifier and a new attack surface.
Jul 17, 2026