Recent content on Embrace The Red
LiteLLM is a popular AI gateway. It provides a unified interface to LLMs and simplifies governance. It also has access to the backend LLM provider keys. 
 All of that makes it a high-value target. Not only for IP and data theft, but also for response modification and tool invocation. 
 
 This post walks through a set of TTPs that red teams can integrate into authorized operations to…
This post walks through a sandbox escape from a Flatpak application via PipeWire. The vulnerability was discovered using my automated research pipeline with Claude Code and Opus 4.6 back in April 2026. It was an exciting find, as this was the first bug I submitted to Red Hat. 
 Claude Code was also excited finding this: 
 
 Once discovered, I repro’d it manually to make sure…
Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system. 
 
 Along similar lines, Sysdig recently published a blog on JADEPUFFER , which it assesses to be an agent-driven ransomware capable of adapting in real time. The report does not identify the victim or fully explain how Sysdig obtained visibility into the operation. 
…
This is a follow-up to my previous Terminal DiLLMa research , and there is a positive outcome: Apple fixed a macOS Terminal behavior that enabled a DNS-based data exfiltration technique. 
 
 DNS Requests via ANSI Escape Codes 
 David Leadbeater originally discovered an interesting behavior in the macOS Terminal app that allowed a special sequence of ANSI escape codes to issue DNS…
Last year, Jun Kokatsu disclosed an interesting vulnerability with ChatGPT Operator by exploiting a race condition. I was wondering if I could reproduce this attack chain, and this post describes the results of that research. 
 I had this post drafted for months, and yesterday at the Real-world AI security conference I included a video demo of this attack in my talk and that reminded me that I…
This is a writeup of my DEF CON Singapore talk that walks through vulnerabilities and exploits in M365 Copilot and Consumer Copilot. I disclosed these to Microsoft last year. MSRC assigned CVE-2026-24299 and the issues are now patched. 
 Contents 
 This turned out to be a long post, covering the 45 minute talk. I added an index page, so you know what’s in here. The talk had a more…
In this post, we explore how ChatGPT generated an adversarial image that hijacked my Claude Opus 4.7 to invoke the memory tool and persist false memories for future chats. 
 
 This matters because Opus 4.6+ is genuinely a lot harder to attack than previous models, but it still fell for a ChatGPT generated image. A trick that works well with reasoning models is to challenge them with…
Agents are becoming extremely effective at finding security vulnerabilities. They are relentless in analyzing code and you can spin up multiple of them to go through source code quickly. 
 given enough agents, all bugs are shallow — Johann Rehberger (@wunderwuzzi23) February 10, 2026 
 


 It is an emerging capability that many security researchers and bug bounty hunters…
This post is about prompt-based command and control (C2), which is becoming more relevant. 
 What is Promptware-Powered C2? 
 Three years ago, when ChatGPT introduced the browsing tool, we already experimented with the idea of prompt-based command and control. And when ChatGPT got memories we showed that this can be combined and abused for a full command and control channel . 
 Recent…
There is a lot of talk about Skills recently, both in terms of capabilities and security concerns. However, so far I haven’t seen anyone bring up hidden prompt injection. So, I figured to demo a Skills supply chain backdoor that survives human review. 
 
 Additionally, I also built a basic scanner , and had my agent propose updates to OpenClaw to catch such attacks. 
 Attack…
Last week I saw this paper from OpenAI called “Preventing URL-Based Data Exfiltration in
Language-Model Agents”, which goes into detail on new mitigations they’ve added. 
 
 This is a great read. I like this transparency. 
 Initial Disclosure in 2023 
 Nearly three years ago I reported the zero-click data exfiltration exploit to OpenAI. Back in early 2023 OpenAI did…
In this post, we’ll look how an adversary can mint authentication cookies for Next.js ( next-auth/Auth.js ) applications to maintain persistent access to the application as any user. 
 
 The reason this is important is because of React2Shell , which is a deserialization vulnerability that allows an adversary to run arbitrary code. Much has been discussed about this vulnerability, and…
It was great to attend the 39C3 - Power Cycles in Hamburg this year. The Chaos Communication Congress was once again packed with great talks, amazing people, awesome events and side quests - and I even got to present! 
 You can watch the talk with translation options on media.ccc.de . 
 I also uploaded the English version to the Embrace The Red YouTube channel. I hope it’s…
The AI industry risks repeating the same cultural failures that contributed to the Space Shuttle Challenger disaster: Quietly normalizing warning signs while progress marches forward. 
 The original term Normalization of Deviance comes from the American sociologist Diane Vaughan, who describes it as the process in which deviance from correct or proper behavior or rule becomes culturally…
Last week Google released an IDE called Antigravity. It’s basically the outcome of the Windsurf licensing deal from a few months ago, where Google paid some $2.4 billion for a non-exclusive license to the code . 
 Because it’s based on Windsurf, I was curious if vulnerabilities that I reported to Windsurf back in May 2025, long before the deal, would have been addressed in the…
Recently, Anthropic added the capability for Claude’s Code Interpreter to perform network requests. This is obviously very dangerous as we will see in this post. 
 At a high level, this post is about a data exfiltration attack chain, where an adversary (either the model or third-party attacker via indirect prompt injection) can exfiltrate data the user has access to. 
 
 The…


 During the Month of AI Bugs , I described an emerging vulnerability pattern that shows how commonly agentic systems have a design flaw that allows an agent to overwrite its own configuration and security settings. 
 This allows the agent to break out of its sandbox and escape by executing arbitrary code. 
 My research with GitHub Copilot , AWS Kiro and a few others demonstrated…


 That’s it. 
 The Month of AI Bugs is done. There won’t be a post tomorrow, because I will be at PAX West. 
 
 Overview of Posts 
 
 ChatGPT: Exfiltrating Your Chat History and Memories With Prompt Injection | Video 
 ChatGPT Codex: Turning ChatGPT Codex Into a ZombAI Agent | Video 
 Anthropic Filesystem MCP Server: Directory Access Bypass Via…


 As part of the Month of AI Bugs, serious vulnerabilities that allow remote code execution via indirect prompt injection were discovered. There was a period of a few weeks where multiple arbitrary code execution vulnerabilities existed in popular agents, like GitHub Copilot, Amazon Q, AWS Kiro,… 
 During that time I was wondering if it would be possible to write an AI virus.…


 Part of my default test cases for coding agents is to check how MCP integration looks like, especially if the agent can be configured to allow setting fine-grained controls for tools. 
 Sometimes there are basic security controls missing. 
 Especially when running an agent on your local computer. Stakes are much higher. And it seems important to empower users to be able to…


 Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. 
 Unfortunately, Cline is vulnerable to data exfiltration through the rendering of markdown images from untrusted domains in the chat box. 
 
 This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by…


 On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents. 
 
 AWS Kiro was vulnerable to arbitrary command execution via indirect prompt injection. This means that a remote attacker, who controls data that Kiro processes, could hijack it to run arbitrary operating system commands or write and run…


 Today we will cover a powerful, easy to use, autonomous agent called Manus. Manus is developed by the Chinese startup Butterfly Effect , headquartered in Singapore. 
 This post demonstrates an end-to-end indirect prompt injection attack leading to a compromise of Manus’ dev box. 
 
 This is achieved by tricking Manus to expose it’s internal VS Code Server to the…


 Recently, many of our favorite AI chatbots have gotten autonomous research capabilities. This allows the AI to go off for an extended period of time, while having access to tools, such as web search, integrations, connectors and also custom-built MCP servers. 
 
 This post will explore and explain in detail how there can be data spill between connected tools during Deep…


 Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI. This is a vulnerability discovered in Windsurf Cascade, it follows invisible instructions. This means there can be instructions in a file or result of a tool call that the developer cannot see, but the LLM does. 
 
 Some LLMs interpret invisible Unicode Tag characters as instructions,…


 In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated. 
 
 While inspecting the system prompt of Windsurf Cascade I noticed that it has a create_memory tool. 
 Creating Memories 
 The question…


 This is the first post in a series exploring security vulnerabilities in Windsurf. If you are unfamiliar with Windsurf, it is a fork of VS Code and the coding agent is called Windsurf Cascade . 
 The attack vectors we will explore today allow an adversary during an indirect prompt injection to exfiltrate data from the developer’s machine. 
 These vulnerabilities are a…


 The Amazon Q Developer VS Code Extension (Amazon Q) is a very popular coding agent, with over 1 million downloads . 
 In previous posts we showed how prompt injection vulnerabilities in Amazon Q could lead to: 
 
 Exfiltration of sensitive information from the user’s machine , and also to a 
 System compromise by running arbitrary code 
 
 Today we will…


 The Amazon Q Developer VS Code Extension (Amazon Q) is a popular coding agent, with over 1 million downloads . 
 The extension is vulnerable to indirect prompt injection, and in this post we discuss a vulnerability that allowed an adversary (or also the AI for that matter) to run arbitrary commands on the host without the developer’s consent. 
 
 The resulting impact…


 The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q Developer), which is a very popular coding agent, with over 1 million downloads. 
 It is vulnerable to prompt injection from untrusted data and its security depends heavily on model behavior. 
 
 At a high level Amazon Q Developer can leak sensitive information…


 In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information. 
 
 This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed . 
 Exploit…


 In this post we will look at Amp, a coding agent from Sourcegraph. The other day we discussed how invisible instructions impact Google Jules . 
 
 Turns out that many client applications are vulnerable to these kinds of attacks when they use models that support invisible instructions, like Claude. 
 Invisible Unicode Tag Characters Interpreted as Instructions 
 We have…


 The latest Gemini models quite reliably interpret hidden Unicode Tag characters as instructions . This vulnerability, first reported to Google over a year ago, has not been mitigated at the model or API level, hence now affects all applications built on top of Gemini. 
 This includes Google’s own products and services, like Google Jules. 
 
 Hopefully, this post helps…


 In the previous post , we explored two data exfiltration vectors that Jules is vulnerable to and that can be exploited via prompt injection. This post takes it further by demonstrating how Jules can be convinced to download malware and join a remote command & control server. 
 
 This research was performed in May 2025 and findings were shared with Google. 
 Remote Command &…


 This post explores data exfiltration attacks in Google Jules, an asynchronous coding agent. This is the first of three posts that will highlight my research on Google Jules in May 2025. All information provided was also shared with Google at that time. 
 This first post will focus on data exfiltration, the lethal trifecta . 
 
 But let’s first talk about Jules’…


 This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub Copilot and VS Code . 
 It is achieved by placing Copilot into YOLO mode by modifying the project’s settings.json file. 
 
 As described a few days ago with Amp , a vulnerability pattern in agents that might be overlooked…


 Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June. The vulnerability allowed an attacker to hijack Claude Code via indirect prompt injection and leak sensitive information from the developer’s machine, e.g. API keys, to external servers by issuing DNS requests. 
 Prompt Injection Hijacks Claude 
 When reviewing or interacting…


 Today we have another post about OpenHands from All Hands AI. It is a popular agent, initially named “OpenDevin”, and recently the company also provides a cloud-based service . Which is all pretty cool and exciting. 
 Prompt Injection to Full System Compromise 
 However, as you know, LLM powered apps and agents are vulnerable to prompt injection. That also applies to…


 Another day, another AI data exfiltration exploit. Today we talk about OpenHands , formerly referred to as OpenDevin. It’s created by All-Hands AI. 
 The OpenHands agent renders images in chat, which enables zero-click data exfiltration. 
 Simon Willison recently gave this data exfiltration attack pattern a great name: Lethal Trifecta . 
 
 We discuss this specific…


 Today let’s explore Devin’s system prompt a bit more. Specifically, an interesing tool that I discovered when reading through it. 
 Hidden in Devin’s capabilities is a tool that can open any local port to the public Internet. That means, with the right indirect prompt injection nudge, Devin can be tricked into publishing sensitive files or services for anyone to access.…


 In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means. This post assumes that you read the first post about Devin as well. 
 
 But here is a quick recap: During an indirect prompt injection Devin can be tricked into download malware and extract sensitive information on the machine. But there is more…


 Today we cover Devin AI from Cognition, the first AI Software Engineer. 
 
 We will cover Devin proof-of-concept exploits in multiple posts over the next few days. In this first post, we show how a prompt injection payload hosted on a website leads to a full compromise of Devin’s DevBox. 
 GitHub Issue To Remote Code Execution 
 By planting instructions on a…


 Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files. 
 That was the case with Amp , an agentic coding tool built by Sourcegraph . 
 
 The AI coding agent could update its own configuration and: 
 
 Allowlist bash commands or 
 Add a malicious MCP server on the fly to run…


 Cursor is a popular AI code editor. In this post I want to share how I found an interesting data exfiltration issue, the demo exploits built and how it got fixed. 
 
 When using Cursor I noticed that it can render Mermaid diagrams. 
 Cursor Renders Mermaid Diagrams 
 If you are not familiar with Mermaid, it has a simple syntax: 
 graph TD 
 User --> Computer
…


 A few months ago I was looking at the filesystem MCP server from Anthropic. 
 The server allows to give an AI, like Claude Desktop, access to the local filesystem to read files or edit them and so forth. 
 I was curious about access control and in the documentation there is a configuration setting to set allowedDirectories , which the AI should be allowed access to: 
 
…


 Today we cover ChatGPT Codex as part of the Month of AI Bugs series. 
 ChatGPT Codex is a cloud-based software engineering agent that answers codebase questions, executes code, and drafts pull requests. 
 In particular, this post will demonstrate how Codex is vulnerable to prompt injection, and how the use of the “Common Dependencies Allowlist” for Internet access…


 In this post we demonstrate how a bypass in OpenAI’s “safe URL” rendering feature allows ChatGPT to send personal information to a third-party server. This can be exploited by an adversary via a prompt injection via untrusted data. 
 
 If you process untrusted content, like summarizing a website, or analyze a pdf document, the author of that document can…


 This year I spent a lot of time reviewing, exploiting and working with vendors to fix vulnerabilities in agentic AI systems. 
 As a result, I’m excited to announce the Month of AI Bugs 2025! 
 
 Goal Of The Initiative 
 The main purpose of the Month of AI Bugs is to raise awareness about novel security vulnerabilities in agentic systems, primarily focusing on AI…


 This is a security advisory for a data leakage and exfiltration vulnerability in a popular, but now deprecated and unmaintained, Slack MCP Server from Anthropic. 
 
 If you are using this MCP server, or run an “MCP Store” that hosts it, it is advised that you analyze how this threat applies to your use case and apply a patch as needed. 
 Anthropic’s Slack…
When the Model Context Protocol (MCP) came out it reminded me of the Common Object Model (COM) from Microsoft. 
 COM has been around for decades and it’s used for programming, scripting, sharing of functionality at a binary/object level across languages and hosts. Via DCOM all of this can even be done remotely, and well, it’s also useful for red teaming. A lot of software on…