Loading story…
Security researchers have discovered that IBM's AI coding agent, 'Bob', is susceptible to prompt injection attacks that allow malicious actors to bypass command validation and execute malware without human intervention. The vulnerability is particularly acute when users configure the system to 'always allow' command execution, which can be exploited by attackers to run harmful scripts. Both the Bob CLI and Bob IDE are affected, with the CLI vulnerable to direct malware execution and the IDE exposed to known AI-specific data exfiltration techniques. IBM's documentation acknowledges the risk, warning users against auto-approving commands and recommending the use of allow lists and avoidance of wildcards.
The attack chain demonstrated by researchers involves manipulating Bob through crafted instructions in a repository's README file, leading the agent to execute a dangerous command after gaining elevated permissions from the user. This results in the installation and execution of malware from an external server. The findings highlight the broader security challenges of AI agent software, which often require human oversight to mitigate risks associated with automated actions. IBM is expected to address these vulnerabilities before Bob's general release, but users are urged to exercise caution during the closed beta phase.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
PromptArmor published its findings showing how Bob's safeguards could be bypassed through techniques such as malicious README content, command chaining, process substitution, and permissive markdown image handling. The disclosure demonstrated paths to malware execution and AI-specific data exfiltration in developer workflows.
IBM was notified of the Bob security issues by the researchers before public reporting. As of the initial reports, IBM had not issued a public response.
PromptArmor researchers identified multiple vulnerabilities in IBM's closed-beta AI coding assistant Bob, including prompt injection in the CLI and zero-click data exfiltration in the IDE. The issues could let malicious repository content trigger unauthorized commands, malware installation, credential theft, or data exfiltration from developer environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed two critical vulnerabilities in its **Semantic Kernel** AI agent framework that could let prompt injection escalate into host compromise. `CVE-2026-26030` affected the Python implementation before version `1.39.4`, where unsafe `eval()`-based lambda construction in the Search Plugin’s default In-Memory Vector Store filter path enabled remote code execution, while `CVE-2026-25592` affected the .NET SDK before version `1.71.0` and allowed arbitrary file write through `SessionsPythonPlugin`’s `DownloadFileAsync`, creating a path to sandbox escape and host takeover; a related arbitrary file read issue was also present in upload handling. Microsoft said it hardened AST validation, restricted callable functions and attributes, removed unintended tool exposure, added path validation, and urged customers to patch and review endpoint telemetry for signs of exploitation. The disclosure lands amid broader warnings that AI agents can preserve and amplify malicious instructions through memory and context reuse. Cisco researchers recently showed that poisoned memory files in Anthropic’s **Claude Code** could persist across projects and sessions, steering the assistant to insert hard-coded secrets, choose insecure packages and configurations, and spread tainted changes to another developer. Researchers and defenders say the incidents reinforce that AI models are not security boundaries and that any model-influenced tool parameter, memory file, or context artifact should be treated as attacker-controlled input, with mitigations including patching vulnerable frameworks, scanning memory and dependency files, and purging stored agent memory after suspected compromise.
Jun 29, 2026
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026