Loading story…
Security researchers reported that prompt injection is enabling practical attacks against agentic AI systems that have access to tools and user data, and argued the industry is underestimating the threat. A proposed framing, “promptware,” describes malicious prompts as a malware-like execution mechanism that can drive an LLM to take actions via its connected tools—potentially leading to data exfiltration, cross-system propagation, IoT manipulation, or even arbitrary code execution, depending on the permissions and integrations available.
Trail of Bits disclosed results from an adversarial security assessment of Perplexity’s Comet browser, showing how prompt injection techniques could be used to extract private information from authenticated sessions (e.g., Gmail) by abusing the browser’s AI assistant and its tool access (such as reading page content, using browsing history, and interacting with the browser). Their threat-model-driven testing emphasized that agentic assistants can treat external web content as instructions unless it is explicitly handled as untrusted input, and they published recommendations intended to reduce prompt-injection-driven data paths between the user’s local trust zone (profiles/cookies/history) and vendor-hosted agent/chat services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Following LayerX's BioShocking disclosure, OpenAI reportedly patched the issue in ChatGPT Atlas and Genspark later told SC Media it had fixed the problem. Anthropic's attempted fix for its Chrome plugin was reportedly ineffective at the time of reporting, while Perplexity closed the report without a fix and Fellou and Sigma Browser initially did not respond.
LayerX disclosed a prompt-injection technique called BioShocking that manipulates AI-powered browsers and agentic browsing tools into accepting false contextual rules and leaking sensitive data. The researchers demonstrated credential exfiltration from a private GitHub repository and said multiple AI-enabled browsing products were affected, with mixed vendor responses.
After the assessment, Trail of Bits published five recommendations for teams building AI agents, including ML-centered threat modeling, strict trust boundaries between system instructions and external content, systematic prompt-injection red-teaming, least-privilege tool access, and treating AI inputs as untrusted data. The write-up also noted that one exploit variant depended on misspellings in a fake warning to bypass fraud detection.
During the assessment, Trail of Bits built multiple proof-of-concept exploits showing that Comet could be induced to exfiltrate private Gmail content from an authenticated user session to attacker-controlled infrastructure when asked to summarize a page. The researchers identified four prompt injection techniques and showed multi-step attack flows using redirects, fragment collection, and social-engineering lures such as CAPTCHAs and fake system warnings.
Before Comet's launch, Trail of Bits performed an adversarial security assessment of Perplexity's LLM-powered browser assistant using its TRAIL threat-modeling approach. The review focused on how prompt injection delivered through attacker-controlled web pages could affect the agentic browsing assistant.
The paper introduced a seven-stage kill chain for promptware, distinguishing prompt injection from jailbreaking and describing how attacks can progress to data exfiltration, lateral movement, IoT manipulation, or code execution depending on connected tools and permissions. It also highlighted persistence mechanisms through poisoned retrieved content and long-term memory features.
A research paper by authors from Tel Aviv University, Ben-Gurion University of the Negev, and Harvard University reviewed 36 real-world attacks over a three-year period and found that prompt injection incidents were becoming more sophisticated. The authors argued these attacks should be treated as a distinct malware class, which they call "promptware."
According to the report, Roy Paz notified six affected AI browser and plugin vendors about the BioShocking prompt-injection issue in October 2025. The disclosures covered products including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome extension.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourcexakep.ru
Open sourcemalwarebytes.com
Open sourcescworld.com
Open sourcearstechnica.com
Open sourcecybersecuritynews.com
Open sourceblog.trailofbits.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and security outlets reported multiple indirect prompt injection weaknesses affecting AI-driven browsing and assistant features, showing how hidden instructions embedded in untrusted web content can manipulate model behavior and steer users into credential theft or data exposure. Cato Networks disclosed **WebPromptTrap** in BrowserOS, where malicious webpage content abused Agent Chat Mode summarization to insert a convincing call to action and attacker-selected link; in the proof of concept, victims could be pushed into a GitHub authorization flow that exposed access tokens and repository access. Cato said the issue affected BrowserOS `0.30.0` and earlier, was identified in `0.29.0`, and was fixed in `0.32.0` after responsible disclosure. Separate reporting described similar risks in OpenAI's **ChatGPT Atlas** browser and in Microsoft **Copilot**, underscoring that the problem extends beyond a single product. LayerX said Atlas could be fed malicious instructions through web content in a "tainted memories" attack, while Axios, TechSpot, and commentary from OpenAI CISO Dane Stuckey highlighted broader security and privacy concerns around prompt injection in AI browsers. Varonis also detailed **Reprompt**, a single-click Copilot attack that could silently exfiltrate personal data. Together, the disclosures show that AI systems that summarize pages, retain context, or act on behalf of users can be turned into phishing and data-theft intermediaries unless untrusted content is strictly isolated from model instructions.
Jun 29, 2026
Security researchers reported multiple **prompt-injection-driven attack paths** that exploit how AI assistants and agentic systems process untrusted content. Microsoft researchers described **AI recommendation/memory poisoning** (mapped in MITRE ATLAS as **`AML.T0080: Memory Poisoning`**) in which attackers insert instructions that cause an assistant to persistently “remember” certain companies, sites, or services as trusted or preferred, shaping future recommendations in later, unrelated conversations. Observed activity over a 60-day period included **50 distinct prompt samples** tied to **31 organizations across 14 industries**, with potential downstream impact in high-stakes domains like health, finance, and security where manipulated recommendations can mislead users without obvious signs of tampering. A separate finding highlighted how **AI agents embedded in messaging apps** can be coerced into leaking secrets via **malicious link previews**. PromptArmor demonstrated that an attacker can use chat-based prompt injection to trick an AI agent into generating an attacker-controlled URL that includes sensitive data (e.g., API keys) as parameters; when messaging platforms (e.g., Slack/Telegram) automatically fetch **link preview** metadata, the preview request can become a **zero-click exfiltration channel**—no user needs to click the link for the data-bearing request to be sent. Together, the reports underscore that agent features intended to improve usability—*persistent memory*, URL-based prompt prepopulation (e.g., “Summarize with AI” buttons), and automatic preview fetching—can be repurposed into scalable manipulation and data-loss mechanisms when untrusted prompts are processed implicitly.
Jun 29, 2026
The launch of ChatGPT Atlas, an AI-powered web browser with agentic capabilities, has raised significant concerns about prompt injection attacks. As browsers become more integrated with large language models (LLMs), attackers can exploit both direct and indirect prompt injection techniques to manipulate AI agents, potentially causing them to divulge sensitive information or perform unintended actions. The accessibility of such agentic browsers, combined with their ability to automate complex tasks, amplifies the risk landscape for organizations adopting these technologies. Security experts warn that the browser now represents a critical control point for AI security, as it serves as the main interface between users and generative AI systems. The rapid increase in GenAI browser traffic has led to a surge in data security incidents, including inadvertent exposure of confidential information through LLM prompts. Traditional network security measures are often insufficient to address these browser-borne threats, making it imperative for organizations to reassess their security strategies and implement controls specifically designed to mitigate risks associated with AI-powered browsers and prompt injection attacks.
Jun 29, 2026