Loading vulnerability…
Prompt Injection Defense Bypass in PraisonAI
PraisonAI versions before 4.6.78 contain a misconfiguration in InjectionDefense: the default blocking threshold is ThreatLevel.CRITICAL, so prompt injection attempts classified as HIGH severity are logged but passed unchanged to the downstream LLM. Single-vector attacks, including instruction overrides and financial manipulation, can bypass this default defense. Depending on downstream agent capabilities, exploitation can expose system prompts or session context and trigger unauthorized tool invocations or financial transaction manipulation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Applications relying on the vulnerable default configuration detect but fail to block HIGH-severity prompt injection attempts. Successful exploitation can disclose system prompts or session context and induce unauthorized tool invocations. Financial transactions may also be manipulated when the downstream agent has the necessary capabilities.
If you can’t patch tonight, do this now.
Explicitly configure InjectionDefense with block_threshold=ThreatLevel.HIGH rather than relying on the vulnerable default. Until patched versions are deployed, restrict or monitor tool invocation capabilities, monitor prompt injection attempts, and review system prompt security.
Patch, then assume compromise.
Upgrade PraisonAI and its related packages to version 4.6.78 or later. The fix changes the default block_threshold from ThreatLevel.CRITICAL to ThreatLevel.HIGH. Review explicitly configured thresholds to ensure HIGH-severity detections are blocked.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.