Manipulating-Web-Agents

利用间接提示注入攻击操纵基于LLM的自主Web代理 随着LLM集成应用的普及，调查潜在的安全风险至关重要。这些系统中最重大的漏洞之一是它们容易受到通过间接提示注入进行的对抗性攻击。在本仓库中，我们展示了一种方法，恶意行为者可以利用该方法生成一个通用触发器，从而控制源自LLM的远程Web导航代理的行为。我们希望展示这些信息能帮助从业者认识到其潜在漏洞，并激励研究人员开发针对此类攻击的防护措施。 环境设置 克隆此仓库后，需要使用以下命令来搭建来自 Browser Gym 的Web导航基础设施： root@kitploit: conda create -n browser-gym conda...

IPI-exposure-signal

IPI Exposure Signal 这是我们论文的代码仓库：Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure。 ArXiv 版本和论文链接：https://arxiv.org/abs/2608.02657 本仓库实现了潜在 IPI 暴露信号的探测流水线：AgentDojo 轨迹收集、IPI 风险标注、隐藏状态特征化，以及 IPI 暴露探测器训练/评估。 引用 root@kitploit: @miscdong2026agenticllmssecretlyencod...

ROPE

ROPE：路由来源策略执行（Routed Origin Policy Enforcement） 我们论文的源代码： ROPE：针对间接提示注入的路由来源策略执行 作者：Xinhang Ma、Chaowei Xiao、William Yeoh、Ning Zhang、Yevgeniy Vorobeychik 摘要 间接提示注入（IPI）在使用工具的 LLM...

ActGuard

ActGuard ActGuard es una defensa de auditoría de acciones previa a la ejecución contra la inyección indirecta de prompts en agentes LLM que utilizan herramientas. Este repositorio contiene la implementación final de ActGuard y el entorno de ejecución basado en AgentDojo necesario para evaluarla. ...

leash-poc

leash-poc: MCP tool-poisoning, contained by an independent pol...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

EUVD-2026-57929

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions...

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely...

EUVD-2026-47652

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

CVE-2026-44192

CVE-2026-44192 affects the Ansible Lightspeed Model Context Protocol (MCP) server. The vulnerability is a path traversal flaw that can be triggered to manipulate an AI agent via indirect prompt injection, allowing writing of files to unauthorized locations on the user’s system, which may expose s...

CVE-2026-44192

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the...

CVE-2026-14898

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-14898

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-13341

A vulnerability exists in the Kong Konnect Model Context Protocol MCP server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests...

CVE-2026-13341 Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP

A vulnerability exists in the Kong Konnect Model Context Protocol MCP server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests...

PT-2026-55525

Name of the Vulnerable Software and Affected Versions Kong Konnect MCP server versions prior to 1.0.0 Description An issue exists where the server fails to properly validate content returned to the Large Language Model LLM. This allows a remote attacker to perform an indirect prompt injection by...

New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials

Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking , a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. The targets...

Linux Distros Unpatched Vulnerability : CVE-2026-44688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...

GHSA-M973-PR9R-HP2W [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the...