Independent researcher known for prompt-injection disclosures.
Johann Rehberger showed that injected instructions in project content could make GitHub Copilot in VS Code edit workspace settings to switch off command confirmations, after which it could run arbitrary terminal commands. He reported it on 2025-06-29 and Microsoft patched it in the August 2025 Patch Tuesday.
Johann Rehberger showed that prompt injection from a web page or document could write attacker instructions into ChatGPT's long-term memory, which then persisted into later conversations and exfiltrated what the user typed. OpenAI fixed the exfiltration vector in the macOS app version 1.2024.247; the researcher notes memory injection itself remained possible.
Researcher Johann Rehberger reported that a shared Google Doc carrying hidden instructions could cause Bard, with Workspace extensions enabled, to render images whose URLs carried conversation data to an attacker endpoint. The researcher reports disclosure on 2023-09-19 and a Google fix on 2023-10-19.