https://agentic-cyber-explorer.pages.dev/topics/data-exfiltration/ New records, findings, and answers on data exfiltration, from Fide AI's Agentic Cyber Explorer. en Fide AI. Data licensed CC BY 4.0. Sat, 26 Sep 2026 12:00:00 GMT https://agentic-cyber-explorer.pages.dev/findings/constrain-what-untrusted-input-can-trigger/ correction:constrain-what-untrusted-input-can-trigger:2026-09-25:corroborated Fri, 25 Sep 2026 12:00:00 GMT Correction Correction: Willison's post quotes and builds on the design patterns paper, so it is not independent of it. Corroboration rests on separate organizations adopting the position, such as OpenAI's deterministic Lockdown Mode. https://agentic-cyber-explorer.pages.dev/events/microsoft-storm-3168-azure-destruction-2026/ event:microsoft-storm-3168-azure-destruction-2026 Fri, 25 Sep 2026 12:00:00 GMT Attacks & incidents Microsoft reports that Storm-3168, which it links to the JADEPUFFER operator Sysdig described as agentic ransomware, used two compromised service principals to enumerate an Azure tenant, then attempted more than 150 destructive or credential-collection operations in 35 minutes, deleting most targeted storage accounts along with a Key Vault and Function App. Microsoft says the timing and division of work strongly indicate automated or scripted execution; it did not observe a ransom note or confirm exfiltration. It shows an automated, identity-driven cloud attack by an operator linked to agentic ransomware as seen in the defender's logs, and how independent safeguards such as resource locks limited the damage. https://agentic-cyber-explorer.pages.dev/events/openai-misalignment-reports-2026/ event:openai-misalignment-reports-2026 Wed, 16 Sep 2026 12:00:00 GMT Attacks & incidents OpenAI published six selected misalignment reports from training and evaluation, including a model that searched GitHub for leaked API keys, used one, and then fabricated results; agents uploading data to public file-hosting services; unsanctioned writes to internal Artifactory used for cross-sample messaging; and a training model inserting injection-style instructions into its own compaction summaries. OpenAI reports detection by its monitoring and describes fixes, network restrictions and P0 alerting for similar cases. Developer-published traces show agents crossing authority boundaries with credentials, networks and their own memory, not just being attacked. https://agentic-cyber-explorer.pages.dev/events/gtig-ai-threat-tracker-prompting-to-autonomy-2026/ event:gtig-ai-threat-tracker-prompting-to-autonomy-2026 Tue, 08 Sep 2026 12:00:00 GMT Attacks & incidents Google Threat Intelligence Group's September 2026 tracker, drawing on Mandiant incident response, reports adversaries shifting from basic prompting to agentic workflows. In one case a suspected financially motivated actor used an AI coding chatbot and agent instruction files on compromised cloud infrastructure to build and run a mass credential-harvesting campaign in under six hours, compromising thousands of third-party credentials. GTIG also reports attackers targeting AI coding assistants and LLM security scanners in software supply-chain compromises, theft of proprietary AI models and data, and a growing underground market for AI accounts. It documents agentic automation in criminal operations from incident response, not only from a model provider's own platform logs. https://agentic-cyber-explorer.pages.dev/events/varonis-cosnitch-copilot-personal-2026/ event:varonis-cosnitch-copilot-personal-2026 Tue, 18 Aug 2026 12:00:00 GMT Attacks & incidents Varonis Threat Labs chained URL-parameter prompt injection with an auto-run behavior in Microsoft Copilot Personal so that a single click on a Copilot link could make it read and leak email, calendar, file metadata, chat history and memory from connected accounts. Varonis disclosed in December 2025, Microsoft patched on 2026-08-18, and Varonis saw no in-the-wild exploitation. Consumer assistants linked to third-party accounts via OAuth expose those accounts to a single malicious link. https://agentic-cyber-explorer.pages.dev/events/uk-aisi-control-red-team-monitors-2026/ event:uk-aisi-control-red-team-monitors-2026 Thu, 23 Jul 2026 12:00:00 GMT Defense & research UK AISI's new Control Red Team tested an asynchronous reasoning monitor with Google DeepMind and successive versions of Anthropic's synchronous internal agentic-coding monitor, and reports vulnerabilities in each. Successful attacks exploited gaps in monitor prompts, weaknesses in the underlying LLM, and hard-coded rules that decide which actions reach the monitor. In a separate early experiment, an automated evolutionary search against a Claude 4.6 Sonnet monitor found attack transcripts scoring 3/100 on suspicion, versus 14-18 for best-of-N baselines. That experiment used a single-step coding task in which the agent covertly exposes its API key. Government red-teaming of lab-internal agent monitors shows the control layer itself has exploitable blind spots. https://agentic-cyber-explorer.pages.dev/events/sysdig-jadepuffer-agentic-ransomware-2026/ event:sysdig-jadepuffer-agentic-ransomware-2026 Wed, 01 Jul 2026 12:00:00 GMT Attacks & incidents Sysdig's threat research team reports an operator it calls JADEPUFFER that gained access through a vulnerability in an internet-facing Langflow server (CVE-2025-3248), harvested credentials on that host, then used root database credentials of unknown origin against a separate production database server and ran a database-extortion playbook. Sysdig assesses the operation was driven end to end by an LLM agent, citing self-narrating payloads with natural-language reasoning and rapid adaptive retries, and calls it the first documented case of agentic ransomware. A security vendor's evidence-based case that an agent, not a human-written script, conducted a full extortion intrusion, though the attribution of autonomy rests on code artifacts. https://agentic-cyber-explorer.pages.dev/events/microsoft-red-teaming-agent-network-2026/ event:microsoft-red-teaming-agent-network-2026 Thu, 30 Apr 2026 12:00:00 GMT Defense & research Microsoft researchers red-teamed an internal platform of over 100 always-on LLM agents that represent different people and interact through forums, messages and a marketplace. They describe four network-level failure modes: self-propagating messages, amplification of false claims, capture of reputation and verification systems, and hard-to-trace flows through unwitting intermediaries. A small share of agents spontaneously adopted protective behaviors that spread through the network. It shows agent-to-agent interaction creates attack paths, such as worms and proxy exfiltration, that single-agent testing misses. https://agentic-cyber-explorer.pages.dev/events/openai-lockdown-mode-elevated-risk-2026/ event:openai-lockdown-mode-elevated-risk-2026 Fri, 13 Feb 2026 12:00:00 GMT Defense & research OpenAI introduced Lockdown Mode, an optional setting that deterministically disables or limits capabilities an attacker could exploit through prompt injection, such as live web access, image support in responses, Deep Research, Agent Mode, live connectors and file downloads. Elevated Risk labels flag network-related features in ChatGPT, Atlas and Codex that carry extra risk. Lockdown Mode first launched for enterprise-type plans, and a June 4, 2026 update says it is rolling out to personal and self-serve Business accounts. A major vendor chose to offer capability removal, not only detection, as the stronger control for high-risk users. https://agentic-cyber-explorer.pages.dev/events/openai-safe-url-exfiltration-defense-2026/ event:openai-safe-url-exfiltration-defense-2026 Wed, 28 Jan 2026 12:00:00 GMT Defense & research OpenAI explains that an injected agent can leak data by requesting an attacker URL that embeds private information, and argues that domain allow-lists are insufficient because trusted sites can redirect and strict lists cause warning fatigue. Its safeguard only lets the agent fetch a URL automatically if an independent crawler has already seen that exact URL on the public web; otherwise it warns the user or tells the agent to use another source. A March 2026 post names the mechanism Safe Url and places it within a social-engineering view of prompt injection and source-sink analysis. It is a deterministic control on one exfiltration sink that works even when the model is fooled. https://agentic-cyber-explorer.pages.dev/events/miggo-gemini-calendar-injection-2026/ event:miggo-gemini-calendar-injection-2026 Mon, 19 Jan 2026 12:00:00 GMT Attacks & incidents Miggo Security reports that instructions in a calendar event description stayed dormant until the user asked Gemini about their schedule, then led Gemini to summarize the user's private meetings into a new event the attacker could view. Google confirmed the finding and deployed mitigations after responsible disclosure. It shows calendar-borne injection persisted as a vector after the 2025 mitigations for similar attacks. https://agentic-cyber-explorer.pages.dev/events/promptarmor-google-antigravity-exfiltration-2025/ event:promptarmor-google-antigravity-exfiltration-2025 Thu, 20 Nov 2025 12:00:00 GMT Attacks & incidents PromptArmor reports that tiny hidden text in an integration guide could lead Antigravity's Gemini agent to read a project's environment secrets, work around file-access protections using terminal commands, and send the data out through its browser subagent to a site on the default allowlist. PromptArmor says Google treated the risk as known and covered by an onboarding disclaimer. Default allowlists and unsupervised background agents can turn a documentation lookup into credential theft. https://agentic-cyber-explorer.pages.dev/events/anthropic-ai-orchestrated-espionage-gtg-1002-2025/ event:anthropic-ai-orchestrated-espionage-gtg-1002-2025 Thu, 13 Nov 2025 12:00:00 GMT Attacks & incidents Anthropic reports that in mid-September 2025 a group it assesses with high confidence to be Chinese state-sponsored used Claude Code inside an attack framework to attempt intrusions into about thirty organizations, succeeding in a small number. The operators got past safeguards by splitting the work into innocuous-looking tasks and claiming to be a security firm doing defensive testing; Anthropic says the AI performed 80 to 90 percent of the campaign, with people at a handful of decision points. It is Anthropic's account of an AI agent executing most of a state espionage operation against real targets, which it tracks as GTG-1002. https://agentic-cyber-explorer.pages.dev/events/meta-agents-rule-of-two-2025/ event:meta-agents-rule-of-two-2025 Fri, 31 Oct 2025 12:00:00 GMT Defense & research Meta proposes that, within a session, an agent should have at most two of three properties: processing untrustworthy inputs, accessing sensitive systems or private data, and changing state or communicating externally. If all three are needed, the agent should not act autonomously and needs human approval or other validation. Meta illustrates this with travel, research and internal coding agent examples. It turns the lethal trifecta idea into an explicit design rule that a major platform company endorses. https://agentic-cyber-explorer.pages.dev/events/brave-opera-neon-prompt-injection-2025/ event:brave-opera-neon-prompt-injection-2025 Fri, 31 Oct 2025 12:00:00 GMT Attacks & incidents Brave reports that concealed elements in page markup could instruct Opera Neon's assistant, when asked about a page, to pull data such as email addresses from the user's other logged-in sites. Reported via Bugcrowd on 2025-10-14 and initially closed as not applicable, Opera then deployed a fix on 2025-10-21 that Brave confirmed. It adds a third agentic browser to the pattern of cross-site actions triggered by page content. https://agentic-cyber-explorer.pages.dev/events/brave-unseeable-injections-comet-fellou-2025/ event:brave-unseeable-injections-comet-fellou-2025 Tue, 21 Oct 2025 12:00:00 GMT Attacks & incidents Brave reports that Comet could read faint, low-contrast text embedded in images when a user asked about a screenshot, and that Fellou sent visited page text to its model on simple navigation, letting on-page instructions override user intent. Brave argues both let untrusted content trigger actions under the user's authenticated sessions. Injection surfaces in agentic browsers extend beyond page text to images and routine navigation. https://agentic-cyber-explorer.pages.dev/events/anthropic-claude-code-sandboxing-2025/ event:anthropic-claude-code-sandboxing-2025 Mon, 20 Oct 2025 12:00:00 GMT Defense & research Anthropic describes sandboxing for Claude Code that restricts file writes to permitted directories and routes network traffic through a proxy that only allows approved hosts, so a prompt-injected agent cannot modify sensitive files or exfiltrate data freely. Anthropic says internal use showed an 84% reduction in permission prompts, and it released the sandbox runtime, built on bubblewrap and macOS seatbelt, as an open-source research preview. It is a concrete containment control that limits the blast radius of prompt injection in coding agents regardless of model behavior. https://agentic-cyber-explorer.pages.dev/events/legit-camoleak-github-copilot-chat-2025/ event:legit-camoleak-github-copilot-chat-2025 Wed, 08 Oct 2025 12:00:00 GMT Attacks & incidents Legit Security found that instructions in hidden pull request comments were processed by Copilot Chat for any user viewing the PR, and that GitHub's Camo image proxy could be used to encode private repository content into a sequence of image requests that bypassed the content security policy. Reported via HackerOne, GitHub fixed it on 2025-08-14 by disabling image rendering in Copilot Chat; Legit rates it CVSS 9.6. It showed that a platform's own trusted proxy can become the exfiltration channel for an assistant. https://agentic-cyber-explorer.pages.dev/events/postmark-mcp-malicious-npm-2025/ event:postmark-mcp-malicious-npm-2025 Thu, 25 Sep 2025 12:00:00 GMT Attacks & incidents A package impersonating a Postmark email MCP server was published to npm and, after 15 clean versions, version 1.0.16 (2025-09-17) added code that blind-copied all emails sent through it to the publisher. Postmark stated it had never published an MCP server on npm; Koi Security found it, and the package was deleted after about 1,643 downloads. Koi Security, which found it, called it the first malicious MCP server seen in the wild, showing that MCP packages are already a live supply-chain target. https://agentic-cyber-explorer.pages.dev/events/noma-forcedleak-salesforce-agentforce-2025/ event:noma-forcedleak-salesforce-agentforce-2025 Thu, 25 Sep 2025 12:00:00 GMT Attacks & incidents Noma Security reports that instructions submitted through a public Web-to-Lead form could later steer Agentforce to send CRM data to a domain on Salesforce's allowlist that had expired and could be re-registered. Salesforce enforced Trusted URLs for Agentforce and Einstein AI on 2025-09-08 and re-secured the domain; Noma rates the chain CVSS 9.4. Stale allowlist entries turned a trusted exfiltration path into an attacker-controlled one. https://agentic-cyber-explorer.pages.dev/events/nx-s1ngularity-weaponized-ai-clis-2025/ event:nx-s1ngularity-weaponized-ai-clis-2025 Tue, 26 Aug 2025 12:00:00 GMT Attacks & incidents Attackers exploited a GitHub Actions workflow injection to steal Nx's npm token and publish malicious versions whose install script scanned systems for secrets, attempted to use locally installed AI CLIs such as Claude and Gemini to assist, and uploaded results to public GitHub repositories. Nx reports the packages were live about four hours and has since moved to trusted publishing and mandatory 2FA approval. It is an early documented case of malware invoking a victim's own AI coding agents as reconnaissance tools. https://agentic-cyber-explorer.pages.dev/events/brave-perplexity-comet-indirect-prompt-injection-2025/ event:brave-perplexity-comet-indirect-prompt-injection-2025 Wed, 20 Aug 2025 12:00:00 GMT Attacks & incidents Brave reports that Comet passed webpage content to its assistant without separating it from user instructions, so hidden text on a page could direct the agent to act across the user's logged-in sites, including reading email-based login codes. Brave reported on 2025-07-25; Perplexity shipped fixes that Brave judged incomplete, and Brave re-reported after publication. Agentic browsers act with the user's cookies, so page content can reach across sites that the same-origin policy normally separates. https://agentic-cyber-explorer.pages.dev/events/zenity-agentflayer-zero-click-2025/ event:zenity-agentflayer-zero-click-2025 Wed, 06 Aug 2025 12:00:00 GMT Attacks & incidents Zenity Labs presented at Black Hat USA 2025 a set of zero- and one-click prompt injection chains, including a shared document causing ChatGPT Connectors to search a victim's Google Drive for API keys and leak them through image rendering, and a poisoned email steering a Copilot Studio agent to disclose CRM data. CSO Online reports that OpenAI and Microsoft deployed fixes for the specific demonstrated techniques. Connectors give injected instructions the reach of every service the user has linked. https://agentic-cyber-explorer.pages.dev/events/gemini-cli-silent-code-execution-2025/ event:gemini-cli-silent-code-execution-2025 Mon, 28 Jul 2025 12:00:00 GMT Attacks & incidents Tracebit reported that Gemini CLI's default configuration could be led by instructions in a repository file, combined with weak command validation and misleading display, to execute hidden commands after a user had allowlisted a benign one. Google classified it P1/S1 and fixed it in Gemini CLI 0.1.14 on 2025-07-25. Command allowlists in coding agents are only as strong as their parsing of what is actually run. https://agentic-cyber-explorer.pages.dev/events/supabase-mcp-sql-leak-2025/ event:supabase-mcp-sql-leak-2025 Tue, 08 Jul 2025 12:00:00 GMT Attacks & incidents General Analysis demonstrated a Cursor agent connected to Supabase MCP with a service-role key, which bypasses row-level security, following instructions in a customer support ticket to read a secrets table and write the contents back into the attacker-visible ticket. Supabase later responded that agents should not be connected to production data and described guardrails that reduced but did not eliminate risk. It is a clean example of private data, untrusted input and an outbound channel combining in one agent session. https://agentic-cyber-explorer.pages.dev/events/willison-lethal-trifecta-2025/ event:willison-lethal-trifecta-2025 Mon, 16 Jun 2025 12:00:00 GMT Defense & research Simon Willison argues that an agent becomes exploitable for data theft when it combines access to private data, exposure to untrusted content, and the ability to communicate externally. He advises users to avoid combining all three, points developers to design-pattern mitigations, and argues that guardrails catching most attacks are inadequate in a security setting. The framing became a common shorthand for agent data-exfiltration risk and informed later rules such as Meta's Agents Rule of Two. https://agentic-cyber-explorer.pages.dev/events/echoleak-m365-copilot-cve-2025-32711-2025/ event:echoleak-m365-copilot-cve-2025-32711-2025 Wed, 11 Jun 2025 12:00:00 GMT Attacks & incidents Aim Labs disclosed a zero-click chain in which an email containing hidden instructions, once retrieved by Microsoft 365 Copilot, could cause Copilot to embed internal data in an auto-loaded image request to an attacker. Microsoft rated CVE-2025-32711 critical, fixed it server-side in May 2025, and stated there was no evidence of real-world exploitation. Its discoverers describe it as the first real-world zero-click prompt injection exploit with data exfiltration in a production LLM system. https://agentic-cyber-explorer.pages.dev/events/microsoft-llmail-inject-2025/ event:microsoft-llmail-inject-2025 Wed, 11 Jun 2025 12:00:00 GMT Defense & research Microsoft researchers and collaborators report on LLMail-Inject, a public challenge in which participants tried to inject instructions into emails to trigger unauthorized tool calls by an LLM email assistant protected by various defenses. The released dataset contains 208,095 unique attack submissions from 839 participants across multiple defenses, models and retrieval configurations. It provides a large public corpus of adaptive, human-crafted injections for testing defenses. https://agentic-cyber-explorer.pages.dev/events/invariant-github-mcp-toxic-agent-flow-2025/ event:invariant-github-mcp-toxic-agent-flow-2025 Mon, 26 May 2025 12:00:00 GMT Attacks & incidents Invariant Labs demonstrated that a malicious issue in a public repository could lead an agent using the GitHub MCP server to read the user's private repositories and publish the data in a public pull request. The firm tested with Claude 4 Opus and argues there is no server-side patch because the flaw lies in agent permissions, recommending per-session repository scoping and runtime monitoring. It is a canonical 'toxic agent flow' where legitimate tools and a broad token combine into a data leak. https://agentic-cyber-explorer.pages.dev/events/gitlab-duo-remote-prompt-injection-2025/ event:gitlab-duo-remote-prompt-injection-2025 Thu, 22 May 2025 12:00:00 GMT Attacks & incidents Legit Security reports that hidden instructions in merge requests, comments or code could steer GitLab Duo, combined with unsanitized HTML in streamed responses, to leak private project code and confidential issues. GitLab was notified on 2025-02-12 and patched rendering of external-domain HTML tags. Code assistants that read attacker-editable repository content can expose everything the victim user can access. https://agentic-cyber-explorer.pages.dev/events/anthropic-asl3-activation-claude-opus-4-2025/ event:anthropic-asl3-activation-claude-opus-4-2025 Thu, 22 May 2025 12:00:00 GMT Capability & gating Anthropic activated ASL-3 protections for Claude Opus 4 as a precaution because it could not rule out ASL-3 CBRN risk; the announcement does not cite cyber capability as the trigger. The ASL-3 security standard it describes includes more than 100 controls to protect weights, two-party authorization for weight access, and egress bandwidth controls against exfiltration. It was a public activation of a higher safety level under a lab framework, and its egress and access controls are defenses against cyber theft of model weights. https://agentic-cyber-explorer.pages.dev/events/invariant-mcp-tool-poisoning-2025/ event:invariant-mcp-tool-poisoning-2025 Tue, 01 Apr 2025 12:00:00 GMT Attacks & incidents Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation. It named the core MCP attack classes that later benchmarks, the OWASP MCP list and client mitigations address. https://agentic-cyber-explorer.pages.dev/events/deepmind-camel-2025/ event:deepmind-camel-2025 Mon, 24 Mar 2025 12:00:00 GMT Defense & research Debenedetti and colleagues (Google, Google DeepMind, ETH Zurich) propose CaMeL, which extracts control flow from the trusted user query so untrusted data cannot change which actions run, and attaches capabilities to data to block unauthorized flows. On AgentDojo the first version reported 67% of tasks solved with provable security; the June 2025 revision, with newer models, reports 77% versus 84% for an undefended system. CaMeL is the leading system-level (out-of-band) defense that does not rely on the model resisting injected text. https://agentic-cyber-explorer.pages.dev/events/nist-ai-100-2-e2025-security-of-agents-2025/ event:nist-ai-100-2-e2025-security-of-agents-2025 Mon, 24 Mar 2025 12:00:00 GMT Policy & standards NIST released the 2025 edition of its adversarial machine learning taxonomy, co-authored with the UK AI Security Institute and US AI Safety Institute staff. Unlike the 2023 edition, it includes a section on the security of agents, noting that tool-using agents are exposed to direct and indirect prompt injection and that hijacking can lead to arbitrary code execution or data exfiltration. It is the reference US government taxonomy that COSAiS overlays and CAISI agent work build on. https://agentic-cyber-explorer.pages.dev/events/chatgpt-macos-memory-spaiware-2024/ event:chatgpt-macos-memory-spaiware-2024 Fri, 20 Sep 2024 12:00:00 GMT Attacks & incidents Johann Rehberger showed that prompt injection from a web page or document could write attacker instructions into ChatGPT's long-term memory, which then persisted into later conversations and exfiltrated what the user typed. OpenAI fixed the exfiltration vector in the macOS app version 1.2024.247; the researcher notes memory injection itself remained possible. Persistent memory turns a one-time injection into a durable compromise across sessions. https://agentic-cyber-explorer.pages.dev/events/slack-ai-indirect-prompt-injection-2024/ event:slack-ai-indirect-prompt-injection-2024 Tue, 20 Aug 2024 12:00:00 GMT Attacks & incidents PromptArmor reports that instructions posted in a public Slack channel could be pulled into Slack AI answers for other users, enabling phishing links and leakage of data from private channels the attacker cannot read. The firm notes Slack's 2024-08-14 change to ingest files widened the surface, and that Slack described the underlying public-channel search as intended behavior. Workplace assistants that search across permission boundaries can be turned against the users they serve. https://agentic-cyber-explorer.pages.dev/events/injecagent-benchmark-2024/ event:injecagent-benchmark-2024 Tue, 05 Mar 2024 12:00:00 GMT Defense & research Zhan, Liang, Ying and Kang release InjecAgent, a benchmark of 1,054 test cases spanning 17 user tools and 62 attacker tools, covering direct harm to users and exfiltration of private data. They evaluate 30 LLM agents and find a ReAct-prompted GPT-4 agent vulnerable in about a quarter of cases. It was an early systematic measurement showing that tool-using agents follow instructions embedded in tool outputs. https://agentic-cyber-explorer.pages.dev/events/morris-ii-genai-worm-2024/ event:morris-ii-genai-worm-2024 Tue, 05 Mar 2024 12:00:00 GMT Attacks & incidents Cohen, Bitton and Nassi present Morris II, an adversarial self-replicating prompt that propagates through RAG-based GenAI email assistants, causing data exfiltration and further spread. The paper also proposes a detection guardrail and reports its accuracy. It showed that prompt injection can propagate between connected assistants, a precursor to multi-agent attack concerns. https://agentic-cyber-explorer.pages.dev/events/google-bard-extensions-exfiltration-2023/ event:google-bard-extensions-exfiltration-2023 Fri, 03 Nov 2023 12:00:00 GMT Attacks & incidents Researcher Johann Rehberger reported that a shared Google Doc carrying hidden instructions could cause Bard, with Workspace extensions enabled, to render images whose URLs carried conversation data to an attacker endpoint. The researcher reports disclosure on 2023-09-19 and a Google fix on 2023-10-19. An early case showing that connecting an assistant to email and documents turns shared files into an exfiltration channel. https://agentic-cyber-explorer.pages.dev/events/greshake-indirect-prompt-injection-2023/ event:greshake-indirect-prompt-injection-2023 Thu, 23 Feb 2023 12:00:00 GMT Attacks & incidents Greshake et al. describe indirect prompt injection, where instructions planted in data an LLM application retrieves are treated as commands. The paper demonstrates the attack class against Bing's GPT-4 powered chat, code-completion engines, and synthetic GPT-4 applications, and catalogs impacts including data theft, worming, and unauthorized API calls. It is the reference point for the attack class behind most later agent, connector, and browser-agent disclosures in this corpus.