Embrace The Red

Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio.

In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size.

A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published.

LiteLLM is a popular AI gateway.

This post walks through a sandbox escape from a Flatpak application via PipeWire.

Hugging Face disclosed an intrusion that, according to them, was driven end to end by an autonomous AI agent system.

This is a follow-up to my previous Terminal DiLLMa research, and there is a positive outcome: Apple fixed a macOS Terminal behavior that enabled a DNS-based data exfiltration technique.

Last year, Jun Kokatsu disclosed an interesting vulnerability with ChatGPT Operator by exploiting a race condition.

This is a writeup of my DEF CON Singapore talk that walks through vulnerabilities and exploits in M365 Copilot and Consumer Copilot.

In this post, we explore how ChatGPT generated an adversarial image that hijacked my Claude Opus 4.7 to invoke the memory tool and persist false memories for future chats.

Agents are becoming extremely effective at finding security vulnerabilities.

This post is about prompt-based command and control (C2), which is becoming more relevant.

There is a lot of talk about Skills recently, both in terms of capabilities and security concerns.

Last week I saw this paper from OpenAI called “Preventing URL-Based Data Exfiltration in Language-Model Agents”, which goes into detail on new mitigations they’ve added.

In this post, we’ll look how an adversary can mint authentication cookies for Next.js (next-auth/Auth.js) applications to maintain persistent access to the application as any user.

It was great to attend the 39C3 - Power Cycles in Hamburg this year.

The AI industry risks repeating the same cultural failures that contributed to the Space Shuttle Challenger disaster: Quietly normalizing warning signs while progress marches forward.

Last week Google released an IDE called Antigravity.

Recently, Anthropic added the capability for Claude’s Code Interpreter to perform network requests.

During the Month of AI Bugs, I described an emerging vulnerability pattern that shows how commonly agentic systems have a design flaw that allows an agent to overwrite its own configuration and security settings.

That’s it.

As part of the Month of AI Bugs, serious vulnerabilities that allow remote code execution via indirect prompt injection were discovered.

Part of my default test cases for coding agents is to check how MCP integration looks like, especially if the agent can be configured to allow setting fine-grained controls for tools.

Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub.

On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents.

Today we will cover a powerful, easy to use, autonomous agent called Manus.

Recently, many of our favorite AI chatbots have gotten autonomous research capabilities.

Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI.

In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration.

This is the first post in a series exploring security vulnerabilities in Windsurf.

The Amazon Q Developer VS Code Extension (Amazon Q) is a very popular coding agent, with over 1 million downloads.

The Amazon Q Developer VS Code Extension (Amazon Q) is a popular coding agent, with over 1 million downloads.

The next three posts will cover high severity vulnerabilities in the Amazon Q Developer VS Code Extension (Amazon Q Developer), which is a very popular coding agent, with over 1 million downloads.

In this post we discuss a vulnerability that was present in Amp Code from Sourcegraph by which an attacker could exploit markdown driven image rendering to exfiltrate sensitive information.

In this post we will look at Amp, a coding agent from Sourcegraph.

The latest Gemini models quite reliably interpret hidden Unicode Tag characters as instructions.

In the previous post, we explored two data exfiltration vectors that Jules is vulnerable to and that can be exploited via prompt injection.

This post explores data exfiltration attacks in Google Jules, an asynchronous coding agent.

This post is about an important, but also scary, prompt injection discovery that leads to full system compromise of the developer’s machine in GitHub Copilot and VS Code.

Today we cover Claude Code and a high severity vulnerability that Anthropic fixed in early June.

Today we have another post about OpenHands from All Hands AI.

Another day, another AI data exfiltration exploit.

Today let’s explore Devin’s system prompt a bit more.

In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means.

Today we cover Devin AI from Cognition, the first AI Software Engineer.

Sandbox-escape-style attacks can happen when an AI is able to modify its own configuration settings, such as by writing to configuration files.

Cursor is a popular AI code editor.

A few months ago I was looking at the filesystem MCP server from Anthropic.

Today we cover ChatGPT Codex as part of the Month of AI Bugs series.

In this post we demonstrate how a bypass in OpenAI’s “safe URL” rendering feature allows ChatGPT to send personal information to a third-party server.