Loading story…
Researchers and vendors reported that prompt injection remains a primary security risk for AI systems, with attacks increasingly affecting autonomous agents, multimodal models, and mobile assistants rather than only text chatbots. Google outlined a risk-based framework for evaluating prompt injection in AI applications, emphasizing that exposure depends on factors such as access to external content, tool use, autonomy, and the sensitivity of connected systems. Separately, security research into OpenAI-style operator agents showed how malicious web content can manipulate browsing agents into leaking data, following attacker instructions, or misusing connected capabilities, underscoring that indirect prompts embedded in untrusted content can override user intent.
Newer research extended the threat to multimodal and device-resident assistants. Analysis of the AudioHijack attack described adversarial audio injections hidden in background sound that reportedly achieved 79–96% success rates against 13 audio-language models and, in some cases, triggered unauthorized tool use in commercial voice-agent deployments. A separate assessment of ByteDance's Doubao Phone Assistant found that despite protections such as app authentication, mTLS, TEE-backed keys, and restrictions on sensitive actions, the assistant could still be influenced by malicious on-screen content and GUI race conditions, potentially exposing SMS messages, emails, photos, recordings, banking codes, and other private data stored or displayed on the device.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
A Codeby article summarized the AudioHijack research, emphasizing that transcript-based defenses are insufficient for multimodal systems and arguing that audio prompt injection is an emerging production security issue for voice-enabled AI agents.
DarkNavy published a security analysis concluding Doubao Assistant had comparatively strong built-in protections but remained exposed to prompt injection via on-screen content and GUI TOCTOU risks inherent to screenshot-based automation.
At Black Hat USA 2026, Zenity Labs disclosed 'PleaseFix,' a zero-click attack class against agentic browsers that uses hidden instructions in emails, calendar invites, webpages, and shared content to trigger 'Intent Collision' and hijack the agent. The researchers said the issue affects products including Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge, and demonstrated impacts including data exfiltration, account takeover, credential theft, phishing, and fraudulent purchases.
At Black Hat USA 2026, Brave security engineer Artem Chaikin presented research showing prompt injection attacks against Opera's AI browser, Perplexity Comet, and ChatGPT Atlas. He demonstrated bypasses using hidden or disguised webpage content and concluded that layered mitigations can reduce, but not eliminate, risks such as data exfiltration and account takeover.
A blog post documented prompt injection exploit scenarios and defensive considerations for ChatGPT Operator, adding practical discussion of agent prompt injection risks.
Google Security Blog published an analysis of how to estimate risk from prompt injection attacks on AI systems, framing prompt injection as a security problem requiring structured risk evaluation.
Doubao Phone Assistant was launched at the end of 2025 as an AI agent with system-level smartphone control across apps, using cloud inference and GUI automation to execute tasks.
A 2025 arXiv preprint identified as arXiv:2507.05587 described AudioHijack, reporting 79–96% attack success rates against 13 large audio-language models and documenting induced behaviors including prompt leakage, harmful output, and unauthorized tool calls.
After Zenity demonstrated that a malicious calendar invite could drive Perplexity Comet to take over a PC by accessing and writing local files, Perplexity fixed the flaw. The issue was tied to Comet's ability to read and modify local files, which Zenity said enabled rapid compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedarkreading.com
Open sourcedarkreading.com
Open sourcecodeby.net
Open sourcedarknavy.org
Open sourcedarknavy.org
Open sourceembracethered.com
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Prompt injection has emerged as a critical security concern in the deployment of large language models (LLMs) and AI agents, with attackers exploiting the way these systems interpret and execute instructions. Security researchers have drawn parallels between prompt injection and earlier vulnerabilities like SQL injection, highlighting its potential to undermine the intended behavior of AI models. Prompt injection involves manipulating the input prompts to override or bypass the system-level instructions set by developers, leading to unauthorized actions or data leakage. The attack surface is broad, as LLMs are increasingly integrated into applications and workflows, making them attractive targets for adversaries. Multiple organizations, including OpenAI, Microsoft, and Anthropic, have initiated efforts to address prompt injection, but the problem remains unsolved due to the complexity and adaptability of AI models. Real-world demonstrations have shown that prompt injection can be used to break out of agentic applications, bypass browser security rules, and even persistently compromise AI systems through mechanisms like memory manipulation. Security conferences such as BlackHat USA 2024 have featured research on exploiting AI-powered tools like Microsoft 365 Copilot, where attackers can escalate privileges or exfiltrate data by crafting malicious prompts or leveraging markdown image vectors. Researchers have also identified that AI agents can be tricked into ignoring browser security policies, such as CORS, leading to potential cross-origin data leaks. Defensive measures, such as intentionally limiting AI capabilities or implementing stricter input filtering, have been adopted by some vendors, but these often come at the cost of reduced functionality. The security community is actively developing standards, such as the OWASP Agent Observability Standard, to improve monitoring and detection of prompt injection attempts. Despite these efforts, adversaries continue to find novel ways to exploit prompt injection, including dynamic manipulation of tool descriptions and bypassing image filtering mechanisms. The rapid evolution of AI technologies and the proliferation of agentic applications have made it challenging to keep pace with emerging threats. Security researchers emphasize the need for ongoing vigilance, robust testing, and collaboration across the industry to mitigate the risks associated with prompt injection. The use of AI in sensitive environments, such as enterprise productivity suites and web browsers, amplifies the potential impact of successful attacks. As AI adoption accelerates, organizations must prioritize understanding and defending against prompt injection to safeguard their systems and data. The ongoing research and public disclosures serve as a call to action for both developers and defenders to address this evolving threat landscape.
Jun 29, 2026
Security researchers reported multiple **prompt-injection-driven attack paths** that exploit how AI assistants and agentic systems process untrusted content. Microsoft researchers described **AI recommendation/memory poisoning** (mapped in MITRE ATLAS as **`AML.T0080: Memory Poisoning`**) in which attackers insert instructions that cause an assistant to persistently “remember” certain companies, sites, or services as trusted or preferred, shaping future recommendations in later, unrelated conversations. Observed activity over a 60-day period included **50 distinct prompt samples** tied to **31 organizations across 14 industries**, with potential downstream impact in high-stakes domains like health, finance, and security where manipulated recommendations can mislead users without obvious signs of tampering. A separate finding highlighted how **AI agents embedded in messaging apps** can be coerced into leaking secrets via **malicious link previews**. PromptArmor demonstrated that an attacker can use chat-based prompt injection to trick an AI agent into generating an attacker-controlled URL that includes sensitive data (e.g., API keys) as parameters; when messaging platforms (e.g., Slack/Telegram) automatically fetch **link preview** metadata, the preview request can become a **zero-click exfiltration channel**—no user needs to click the link for the data-bearing request to be sent. Together, the reports underscore that agent features intended to improve usability—*persistent memory*, URL-based prompt prepopulation (e.g., “Summarize with AI” buttons), and automatic preview fetching—can be repurposed into scalable manipulation and data-loss mechanisms when untrusted prompts are processed implicitly.
Jun 29, 2026
Security researchers and commentators warned that attacks on **LLM-based systems** are evolving beyond simple “prompt injection” into a broader execution mechanism dubbed **promptware**, with a proposed seven-step **promptware kill chain** to describe how malicious instructions enter and propagate through AI-enabled applications. The core risk highlighted is architectural: LLMs treat system instructions, user input, and retrieved content as a single token stream, enabling **indirect prompt injection** where hostile instructions are embedded in external data sources (web pages, emails, shared documents) that an LLM ingests at inference time; the attack surface expands further as models become **multimodal**, allowing instructions to be hidden in images or audio. Related academic work demonstrated a concrete multimodal variant against **embodied AI** using large vision-language models: **CHAI (Command Hijacking Against Embodied AI)**, which embeds deceptive natural-language instructions into visual inputs (e.g., road signs) to influence agent behavior in scenarios including drone emergency landing, autonomous driving, and object tracking, reportedly outperforming prior attacks in evaluations. Separately, reporting on a viral “AI caricature” social-media trend framed the risk as downstream **social engineering** and potential **LLM account takeover** leading to exposure of prompt histories and employer-sensitive data; while largely hypothetical, it underscores how widespread consumer LLM use and public oversharing can increase the likelihood and impact of prompt-driven compromise paths.
Jun 29, 2026