Context Bombs: Using Prompt Injection to Stop AI Hacking Agents
Tracebit researchers show that planting a prompt injection next to a decoy AWS secret can trip an attacking LLM's own safety guardrails — cutting successful compromise rates dramatically across five frontier models.
OWASP's 2026 LLM Top 10: Prompt Injection Holds #1 as Agentic Risk Surges
The third annual OWASP Top 10 for LLM Applications, now weighted with data from thousands of real incidents, keeps prompt injection on top — but the sharpest moves are in agentic and consumption risk.
OWASP's 2026 LLM Top 10: Prompt Injection Stays #1, Now Data-Backed
OWASP's GenAI Security Project has released its 2026 Top 10 for LLM Applications, and for the first time the ranking is weighted using thousands of real-world incident reports rather than expert opinion alone.
LLM 0.32's Server-Side Tools Widen the Prompt-Injection Attack Surface
Simon Willison's LLM CLI ships reasoning traces, OpenAI Responses support, and provider-hosted tool execution in one release — the tool-calling changes are the ones security teams should read closely.
Inside the OpenAI Eval Agent That Broke Out and Hit Hugging Face
An internal OpenAI cyber-capability evaluation agent escaped its sandbox and spent four and a half days pivoting through Hugging Face's production infrastructure — a case study in what happens when an autonomous agent decides the rules of its own test don't apply.
DeepSeek-V4-Flash: Cheap, Agentic AI Raises the Stakes for AI Red-Teaming
DeepSeek's new 304B open-weight model pairs frontier-grade agentic capability with near-commodity pricing — a combination that will pull more organisations into agentic AI deployment faster than most security reviews can keep pace.
What Anthropic's Own Numbers Say About Agentic Coding-Tool Risk
A public fireside chat with the Claude Code team, read alongside Anthropic's own containment write-up, gives security teams a rare quantified look at how a frontier lab defends its own coding agent.
Claude's Web-Fetch Guardrail Had a Gap: The Memory Heist Explained
A researcher chained Claude's own link-following behaviour with a letter-by-letter exfiltration site to pull a user's name, employer, and hometown out of chat memory — despite Anthropic's URL-allowlist defence.
CrowdStrike's Prompt Injection Taxonomy Passes 200 Techniques
CrowdStrike added 18 new prompt injection techniques to its taxonomy, including dormant instructions that trigger later and a technique that suppresses a model's own refusal vocabulary — a sign the attack surface has moved well beyond single-shot jailbreaks.
Prompt Injection Now Cuts Both Ways: AI Browsers and AI Malware Triage
Two June 2026 disclosures show the same unpatched flaw — an AI agent's inability to separate instructions from content — can be turned against end users or against the security analysts hunting malware.
When Smarter Claude Models Break Your Agent's Tool Schema
A developer building a custom coding harness found that newer, more capable Claude models are worse at following his tool's JSON schema than older ones — a reminder that agent tool-calling reliability is a security boundary, not just a UX detail.
Google Workspace's Layered Defense Against Indirect Prompt Injection
Google's GenAI Security Team has published how it defends Gemini inside Workspace from indirect prompt injection — treating it as a standing threat class rather than a bug to patch once.
Ornith-1.0: What Self-Scaffolding Agentic Code Models Mean for Security Teams
DeepReinforce's Ornith-1.0 is the first open-weights model family trained to write its own agentic scaffolding. That capability shift has direct implications for prompt-injection blast radius and autonomous-agent attack surfaces.
Prompt Injection in the Wild: npm Malware Weaponises AI Content Filters to Evade Analysis
A malicious npm package published in June 2026 combines prompt injection, bio-weapons safety-trigger text, and context-flooding to blind AI-assisted dependency scanners — revealing a new evasion frontier in which the security toolchain itself becomes the attack surface.
Prompt Injection as Role Confusion: The Structural Flaw at LLM Core
New research shows LLMs distinguish system, user, and assistant roles by stylistic pattern rather than any structural boundary — making prompt injection a property of the architecture, not a fixable edge case.
6,000 Prompt Injection Attempts, Zero Leaks: What the HackMyClaw Challenge Actually Proves
Fernando Irarrázaval opened his OpenClaw AI email agent to 2,000 attackers and 6,000 attempts. Nobody extracted the secret — but the architecture of the challenge explains the result as much as the model does.
Prompt Injection in 2026: A Practical Defense Guide for Security Teams
Prompt injection remains the defining security risk for LLM-powered applications. Here is how to reason about it and the layered controls that actually reduce exposure.