Loading story…
OpenAI announced it is acquiring Promptfoo, an AI security startup focused on testing and hardening LLMs against adversarial abuse. OpenAI said Promptfoo’s technology will be integrated into OpenAI Frontier (its enterprise AI-agent platform) to support automated red-teaming, security evaluation of agentic workflows, and monitoring for risk and compliance, while continuing to develop Promptfoo’s open-source tooling.
Separately, red-team startup CodeWall reported that its autonomous AI agent compromised McKinsey’s internal generative AI platform (Lilli) and obtained full read/write access to the chatbot environment within roughly two hours, without using credentials. CodeWall claimed access to large volumes of sensitive data in plaintext (including chat logs, files, user accounts, and system prompts), and emphasized that writable system prompts could enable response poisoning and manipulation of outputs at scale—highlighting how agentic AI can be used to accelerate intrusions and why enterprises are prioritizing agent security controls and continuous adversarial testing.
Track how attackers are adapting to this technology.
8 events from the most recent confirmed update back to the earliest known activity.
On March 9, 2026, OpenAI announced it had acquired Promptfoo, an AI security startup focused on protecting LLMs from adversarial abuse. OpenAI said Promptfoo’s technology would be integrated into OpenAI Frontier after the deal closes.
McKinsey stated that, with support from a third-party forensics firm, it found no evidence that client confidential data was accessed by the researchers or other unauthorized parties.
After receiving the disclosure, McKinsey patched unauthenticated endpoints, took a development environment offline, and blocked public API documentation. McKinsey said it remediated the issues within hours.
On March 1, 2026, CodeWall disclosed the full attack chain to McKinsey after identifying the vulnerabilities in Lilli.
CodeWall reported that an autonomous AI red-team agent chained the discovered flaws and, in about two hours, obtained read/write access to Lilli’s production database, potentially exposing tens of millions of plaintext chat messages and hundreds of thousands of files.
In late February 2026, CodeWall researchers found multiple weaknesses in McKinsey’s internal generative-AI platform Lilli, including exposed API documentation, unauthenticated endpoints, and a SQL injection path.
In July 2025, Promptfoo was valued at $86 million after a funding round, having raised $23 million in total according to the report.
Promptfoo was founded in 2024 by Ian Webster and Michael D’Angelo to build tools for testing large language model security vulnerabilities, including an open-source interface and library.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting highlighted escalating risks from *LLM-powered tools and autonomous agents*, including prompt-injection-driven attack chains and weak governance around enterprise and clinical deployments. Research coverage described “**promptware**” as a multi-stage threat model for LLM applications—moving beyond single-step prompt injection to campaigns resembling traditional malware kill chains (initial access, privilege escalation/jailbreak, persistence, lateral movement, and actions on objectives), with proposed intervention points for defenders. A concrete example was reported in Anthropic’s *Cowork* research preview, where **PromptArmor** demonstrated a Files API exfiltration chain: a user connects the agent to sensitive folders, then a document containing hidden instructions triggers the agent to upload files to an attacker-controlled Anthropic account without further user approval once access is granted. Separately, a VA Office of Inspector General report warned the Veterans Health Administration lacked a **formal mechanism** to identify, track, and resolve risks from clinical generative AI chatbots (including *VA GPT* and *Microsoft 365 Copilot chat*), citing oversight and patient-safety concerns tied to inaccurate outputs and insufficient coordination with patient safety functions.
Jun 29, 2026
Security researchers warned that **AI agents and retrieval-augmented generation (RAG) systems** can be turned into data-exfiltration channels when attackers poison inputs or embed malicious instructions in content the model is expected to process. One report described a **0-click indirect prompt injection** against *OpenClaw* agents in which hidden instructions cause the agent to generate an attacker-controlled URL containing sensitive data such as API keys or private conversations in query parameters; messaging platforms like *Telegram* or *Discord* can then automatically request that URL for link previews, silently delivering the data to the attacker. The same reporting noted concerns about insecure defaults that allow agents to browse, execute tasks, and access local files, expanding the blast radius of prompt-injection abuse. Related analysis highlighted that the same core weakness extends beyond standalone agents to **enterprise RAG deployments**, where the integrity of the knowledge base becomes part of the security boundary. If attackers can poison indexed documents in systems such as SharePoint or Confluence, they can manipulate retrieval results and influence model outputs, including security workflows and analyst guidance. Broader commentary on **agentic AI threat convergence** reinforced that prompt engineering is no longer just a productivity technique but an emerging exploit class, with adversaries using prompt injection and context manipulation against AI-enabled security operations. Together, the reporting shows that enterprise AI risk increasingly depends on controlling untrusted content, hardening agent permissions, and treating prompts, retrieved documents, and downstream integrations as attack surfaces.
Aug 11, 2026
Security researchers and industry reporting describe **prompt injection—especially web-based indirect prompt injection (IDPI)**—as an increasingly practical technique for compromising or manipulating **LLM-powered agents** embedded in browsers and automated content pipelines. Palo Alto Networks Unit 42 reported in-the-wild IDPI activity where malicious instructions are hidden in web content that an agent later ingests, with observed objectives including **AI-based ad review evasion** and **SEO manipulation** that promotes phishing infrastructure. Separately, Zenity Labs detailed a now-patched issue in Perplexity’s *Comet* AI browser where attackers could embed instructions in a **calendar invite** to coerce the agent into accessing `file://` resources and potentially pivoting into sensitive data such as an unlocked **1Password** extension vault, illustrating how agentic tooling can bypass traditional browser-origin assumptions. Threat reporting also shows adversaries operationalizing AI to scale exploitation. Team Cymru linked an AI-assisted Fortinet FortiGate targeting campaign (previously reported by Amazon Threat Intelligence as compromising **600+ devices across 55 countries** using services like **Claude** and **DeepSeek**) to use of **CyberStrikeAI**, an open-source Go-based platform that integrates 100+ security tools and was observed from multiple IPs (primarily hosted in China/Singapore/Hong Kong, with additional infrastructure elsewhere). Multiple commentaries and briefings emphasize that conventional “filter the prompt” defenses are insufficient because LLMs lack a native separation between instructions and data; they call for **defense-in-depth** around AI pipelines, including least-privilege agent permissions, auditable tool use, and stronger identity/workload controls as agent deployments multiply. Several items in the set are unrelated (geopolitical cyber activity, workforce/culture pieces, jobs, and product/market commentary) and do not materially inform the prompt-injection/agent-abuse story.
Aug 19, 2026