Prompt Injection Experiments with Opus-5 in Claude Code - Auto-Mode Edition
Disclaimer: Prompt injection is an unsolved problem.
IT meets OT
Research blog on AI agent security, prompt injection, and OT/IoT offensive security.
Latest posts
From /init to Code Execution - Prompt Injection Experiments with Opus-5 in Claude Code
Disclaimer: Prompt injection is an unsolved problem. Use sandbox and human review.
[UPDATE] The Prompt Injection Quest to RCE with Fable-5 and Gpt-5.6-Sol
Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem. Use sandbox and human review (and your own judgement).
The Prompt Injection Quest to RCE with Fable-5 in Claude Code
Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem (but running Claude Code in a sandbox would mostly solve this problem).
Indirect Prompt Injection in Claude Code with (Fable-5) Opus-4.8
Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem.
YOLO is Russian Roulette: Indirect Prompt Injection Experiments in Coding Harnesses
I really wanted to play around with Fable-5... But then this happened.
BrokenClaw Part 7: Opus-4.8 Edition - All Emails Lead to RCE
Another day, another model. Opus-4.8 is said to be reliable. In OpenClaw, it reliably executes a reverse shell when asked to summarize an email. However, a few tricks are needed...
BrokenClaw Part 6: GPT-5.5 & Opus-4.7 Edition - Avoid the Guardrails
The last (for how long?) frontier models of Openai and Anthropic are there: gpt-5.5 and opus-4.7! We will exploit a few pathological habits of these models to get remote code...
BrokenClaw Part 5: GPT-5.4 Edition
Lastly the openai model gpt-5.4 gained in popularity within the OpenClaw community (maybe this is the reason). Let's have a look at the prompt injection behaviour of this model.
BrokenClaw Part 4: From Web Fetch to Code Execution
Another BrokenClaw! Today, from web fetch to remote code execution. A human user asks 'Please fetch a webpage'. After many tool calls, the lobster is confused and eventually...
BrokenClaw Part 3: Remote Code Execution in OpenClaw via Email Again - This Time via Tool
Third part of the BrokenClaw saga! This time, Remote Code Execution via email using gogcli as email tool, no hook. Based only on the email content from a tool, the model (opus4.6)...
XSS in Dify could lead to Workspace Takeover
In Dify, I found a cross site scripting vulnerability (XSS) in the web application chat frontend when using echarts. User or llm inputs containing echarts with a specific...
Indirect Prompt Injection in Github Copilot - Now with Opus4.6
You remember this experiment with sonnet 4.5? I tried with opus4.6, a frontier model with excellent prompt injection robustness.
BrokenClaw Part 2: Escape the Sub-Agent Sandbox with Prompt Injection in OpenClaw
In the first part of this saga (read first), I described a 0-Click RCE in OpenClaw using prompt injection and exploiting the insecure plugin handling. As a countermeasure...
BrokenClaw Part 1: 0-Click Remote Code Execution in OpenClaw via Gmail Hook
This post is not related to OT but I could not resist. There's a new popular agent in town: OpenClaw. It's 'The AI that actually does things'. It does: a simple email can silently...
RCE via Indirect Prompt Injection in VSCode with Github Copilot
Classic but still up-to-date. You clone a repo in VSCode, ask Github Copilot (GHCP) to summarize it and 💥 you get Remote Code Execution (RCE) on your machine:
Data Exfiltration via Image Rendering in RAG Chatbot Frontend
Today we will use dify, an 'open-source platform for developing LLM applications' to show how data exfiltration works - a classical problem in Retrieval Augmented Generation (RAG)...
Prompt Injection 101 with n8n
In my last post, I experimented with a python agent and prompt injection using different LLMs. This time we will explore prompt injection with n8n, the low-code automation...
Models, Agents and Prompt Injections - Some Experiments.
Inspired by this blog post and out of curiousity, I vibe-built a simple LLM agent in the terminal with a few tools and MCP capability. Then I ran a some experiments with prompt...
[UPDATE] Playing with Gemini CLI: Riddles, Magic and some security Vibes
This post is an update of Playing with Gemini CLI: Riddles, Magic and some security Vibes.