Atlas/web · email · files · issues

Untrusted content

Anything the agent reads that an outsider could write. The entry point for indirect prompt injection.

28 attacks and incidents27 defense records8 findings4 measured defense findings

Attacks and incidents

Sep 23, 2026

Australia says an OpenAI agent bypassed protections on a government Medicare portal

AttackIncidentOpenAI, Australian Government, Transluce

Sep 23, 2026

Transluce finds agent hacking attempts and data retrieval traces on the urlquery.net scanner

AttackIncidentTransluce, OpenAI, urlquery.net

Aug 18, 2026

CoSnitch: one-click prompt injection in Copilot Personal exposed connected-app data (CVE-2026-24301)

AttackVulnerability disclosureVaronis Threat Labs, Microsoft

Jul 1, 2026

DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549)

AttackVulnerability disclosureCato Networks, Cursor

May 7, 2026

Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution

AttackVulnerability disclosureMicrosoft

Jan 20, 2026

Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

AttackVulnerability disclosureCyata, Anthropic

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

AttackVulnerability disclosureMiggo Security, Google

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Nov 19, 2025

AppOmni shows second-order prompt injection recruiting privileged ServiceNow Now Assist agents

AttackVulnerability disclosureAppOmni, ServiceNow

Oct 31, 2025

Brave discloses hidden-HTML prompt injection in Opera Neon, fixed within a week of re-engagement

AttackVulnerability disclosureBrave, Opera

Oct 21, 2025

Brave finds screenshot and navigation prompt injections in Comet and Fellou browsers

AttackVulnerability disclosureBrave, Perplexity, Fellou

Oct 8, 2025

CamoLeak: hidden PR comments let GitHub Copilot Chat leak private code via image proxy

AttackVulnerability disclosureLegit Security, GitHub

Sep 25, 2025

ForcedLeak: Web-to-Lead prompt injection could make Salesforce Agentforce leak CRM data

AttackVulnerability disclosureNoma Security, Salesforce

Aug 20, 2025

Brave discloses indirect prompt injection in Perplexity Comet agentic browser

AttackVulnerability disclosureBrave, Perplexity

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

AttackVulnerability disclosureAim Security, Cursor

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

AttackVulnerability disclosureTracebit, Google

Jul 8, 2025

General Analysis shows Supabase MCP with service-role access leaking tables via a support ticket

AttackVulnerability disclosureGeneral Analysis, Supabase

Jun 11, 2025

EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)

AttackVulnerability disclosureAim Security, Microsoft

May 26, 2025

Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

AttackVulnerability disclosureInvariant Labs, GitHub

May 22, 2025

Legit Security finds GitLab Duo prompt injection that could leak private source code

AttackVulnerability disclosureLegit Security, GitLab

Sep 20, 2024

ChatGPT macOS memory could be poisoned by prompt injection for persistent data exfiltration

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), OpenAI

Aug 20, 2024

PromptArmor reports Slack AI can be steered to leak private-channel data via public-channel messages

AttackVulnerability disclosurePromptArmor, Salesforce

Mar 5, 2024

Morris II paper demonstrates self-replicating prompts spreading between GenAI email assistants

AttackPaperCornell Tech, Technion, Intuit

Nov 3, 2023

Google Bard Workspace extensions could be prompt-injected to leak chat data via rendered images

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Google

Feb 23, 2023

Researchers define indirect prompt injection against LLM-integrated apps including Bing Chat

AttackPaperCISPA Helmholtz Center for Information Security, sequire technology

Defense research

Apr 30, 2026

Microsoft Research red-teams a network of 100+ agents and finds propagation and trust-capture failures

DefensePaperMicrosoft

Mar 16, 2026

CAISI, UK AISI and Gray Swan competition finds concealed indirect injections succeed on all 13 frontier models

DefensePaperGray Swan AI, US Center for AI Standards and Innovation, UK AI Security Institute

Mar 10, 2026

OpenAI releases IH-Challenge RL dataset and reports instruction hierarchy gains on injection benchmarks

DefenseDatasetOpenAI

Feb 13, 2026

OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration

DefenseTool releaseOpenAI

Feb 5, 2026

Claude Opus 4.6 system card reports prompt injection rates by surface, attempts and safeguards

DefenseSystem cardAnthropic, Gray Swan AI

Jan 28, 2026

OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

DefenseTool releaseOpenAI

Dec 22, 2025

OpenAI hardens ChatGPT Atlas with an RL-trained automated prompt injection attacker

DefenseFrameworkOpenAI

Nov 24, 2025

Anthropic reports 1.4% prompt injection success for Claude Opus 4.5 with improved Chrome extension safeguards

DefenseEvaluation reportAnthropic, Gray Swan AI

Nov 7, 2025

OpenAI describes its layered approach to prompt injection as a frontier security challenge

DefenseFrameworkOpenAI

Oct 31, 2025

Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

DefenseFrameworkMeta

Oct 10, 2025

'The Attacker Moves Second': adaptive attacks bypass 12 published jailbreak and injection defenses

DefensePaperarXiv

Aug 25, 2025

Anthropic publishes prompt injection red-team rates for its Claude in Chrome browser agent pilot

DefenseEvaluation reportAnthropic

Jul 28, 2025

Large public competition finds all 22 tested frontier agents vulnerable to prompt injection

DefenseBenchmarkGray Swan AI, UK AI Security Institute

Jun 16, 2025

Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration

DefenseFrameworkSimon Willison

Jun 11, 2025

LLMail-Inject releases data from an adaptive prompt injection challenge against an email agent

DefenseDatasetMicrosoft

Jun 10, 2025

Researchers from labs and industry publish design patterns for provably injection-resistant agents

DefenseFrameworkInvariant Labs, IBM, ETH Zurich

May 20, 2025

Google DeepMind reports lessons from continuously attacking Gemini with adaptive prompt injections

DefensePaperGoogle DeepMind

May 6, 2025

Meta releases LlamaFirewall guardrails with PromptGuard 2 and AlignmentCheck for agents

DefenseTool releaseMeta

Mar 24, 2025

Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow

DefensePaperGoogle DeepMind, Google, ETH Zurich

Jan 17, 2025

US AISI (later CAISI) shows red-team attacks and repeated attempts raise agent hijacking rates on AgentDojo

DefenseEvaluation reportNIST, US Center for AI Standards and Innovation, UK AI Security Institute

Oct 7, 2024

SecAlign uses preference optimization to train LLMs against prompt injection

DefensePaperMeta, UC Berkeley

Oct 3, 2024

Agent Security Bench formalizes attacks and defenses across ten LLM agent scenarios

DefenseBenchmarkarXiv

Jun 19, 2024

AgentDojo: an extensible environment for prompt injection attacks and defenses on LLM agents

DefenseBenchmarkETH Zurich, Invariant Labs

Apr 19, 2024

OpenAI trains models to prioritize privileged instructions via an instruction hierarchy

DefensePaperOpenAI

Mar 20, 2024

Microsoft researchers propose spotlighting to mark untrusted input against indirect prompt injection

DefensePaperMicrosoft

Mar 5, 2024

InjecAgent benchmarks indirect prompt injection against tool-integrated LLM agents

DefenseBenchmarkUniversity of Illinois Urbana-Champaign

Feb 9, 2024

StruQ proposes separating prompts and data channels to defend against prompt injection

DefensePaperUC Berkeley

Findings

Jan 17, 2025

Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.

Reportedmeasured4 evidence records2 linked findings

Aug 20, 2025

Agentic browsers act on page content that users cannot see.

Reportedmeasured3 evidence records

Mar 24, 2025

Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.

Revalidatemeasured1 evidence record1 linked finding

Jun 10, 2025

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.

Corroboratedargued5 evidence records

Jul 28, 2025

Every frontier agent tested in two large public red-teaming competitions was hijacked at least once; in the 2026 competition the injections also had to conceal the compromise from the user.

Reportedmeasured2 evidence records

May 20, 2025

Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.

Qualifiedreported5 evidence records2 linked findings

Mar 5, 2024

Undefended tool-using agents follow injected instructions in a substantial share of benchmark cases.

Qualifiedmeasured4 evidence records1 linked finding

Nov 3, 2023

Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.

Corroboratedmeasured6 evidence records

Capability, policy, and guidance

Aug 3, 2026

OWASP releases 2026 edition of the GenAI LLM Top 10 mapped to the agentic list and ATLAS

PolicyStandardOWASP GenAI Security Project

Dec 8, 2025

UK NCSC says prompt injection may never be fully mitigated and urges impact reduction

PolicyGuidanceUK National Cyber Security Centre

Sep 30, 2025

CAISI evaluation finds DeepSeek models lag US models on cyber tasks and are far easier to hijack

CapabilityEvaluation reportUS Center for AI Standards and Innovation, NIST, DeepSeek

Mar 24, 2025

NIST AI 100-2 E2025 taxonomy adds a dedicated section on security of AI agents

PolicyStandardNIST, UK AI Security Institute, US Center for AI Standards and Innovation

Jan 31, 2025

UK publishes AI Cyber Security Code of Practice with 13 principles, later standardized as ETSI TS 104 223

PolicyStandardUK Department for Science, Innovation and Technology, ETSI

Nov 17, 2024

OWASP releases 2025 Top 10 for LLM Applications with prompt injection first and Excessive Agency

PolicyStandardOWASP GenAI Security Project

Jan 4, 2024

NIST publishes adversarial machine learning taxonomy covering direct and indirect prompt injection

PolicyStandardNIST

Attacks and incidents

Defense research

Findings

Capability, policy, and guidance

Related research openings