Skip to content
What are you looking for?. Open searchSR

Tags

Prompt injection

8 items
AI Chatbot Assistants on Glass Blocks, Artificial Intelligence Technology Concept. Digitally generated image. 3d render.
Connectorsstrong signal

The same SSRF bug turned up in MCP servers at Google, JPMorgan, and two governments

An independent researcher reported one class of server-side request forgery to five organizations that share no code, and all five confirmed and fixed it. Google's MCP Toolbox for Databases carried a high-severity CVE until version 1.5.0. Five US federal servers are still open. If you run an MCP server with any tool that fetches a web address, the four checks at the end apply to you.

Ars Technicaverified

MICROSOFT2.3Mmessages a day at the peak
Toolsmedium signal

Invisible Unicode characters from AI research turned up in a phishing campaign of 2.3 million messages a day

Microsoft published telemetry on September 3, 2026 for a phishing campaign that split financial words apart with invisible Unicode tag characters, the same block that AI security research made famous under the name ASCII smuggling. In the messages Microsoft sampled there were no hidden instructions for a model. The characters were there to break keyword matching, and daily volume passed 2.3 million messages. The defensive rule Microsoft draws from it fits in one line: normalize before you match, and do it upstream of anything a model reads as well.

Microsoft Security Blogverified

Modelsstrong signal

Gemini 3.8 Flash arrives at $0.75 per million input tokens, and that price has an end date

Google released Gemini 3.8 Flash and a security variant, 3.8 Flash Cyber, on September 2, 2026. The general model costs $0.75 per million input tokens and $3.75 per million output tokens, the same introductory rate Gemini 3.7 Flash launched with. Google states that the rate holds until December 31, 2026. From January 1, 2027 it becomes $1.50 and $7.50. The Cyber variant is not on the price list at all, because it is handed out through a vetted access program called Fairwind.

Google DeepMindverified

Agentsmedium signal

Simon Willison counted what ChatGPT Work actually has: 223 tools, 44 skills, open internet access

Willison reports that OpenAI announced ChatGPT Work on July 9, 2026 and has been changing it since, without documenting what the agent can do. He spent weeks testing it, then had the product describe itself: 223 registered tools and 44 skills, six of the tools his own. The inventory shows a code sandbox with open internet access, a full headless Chrome, and a filesystem shared across sessions.

Simon Willisonverified

Agentsstrong signal

The classifier let the malware start and then refused to let Claude kill it

Johann Rehberger chained benign-looking steps until Claude Code wrote its own loader for an attacker's Python module. Three variants succeeded in three, three and four runs out of five. In some runs Claude noticed the compromise and tried to stop the process, and Auto Mode denied that command. Anthropic closed the report as informative.

Embrace The Redverified

Agentsstrong signal

Claude in Chrome is generally available, and it now clicks without asking first

Claude in Chrome has left the pilot and is available on every paid Claude plan. The change that matters is not availability but autonomy: Claude now approves safe actions itself, using the same mechanism as Claude Code, instead of stopping for every click. Anthropic published the prompt injection numbers behind that decision, and the one worth reading is the baseline: before extra safeguards, attacks that reached Opus 5 succeeded 3.8% of the time.

Anthropicverified

Agentsstrong signal

Gemini Spark vs Claude's browser toolset: whose account, whose risk

Both drive a web browser, both stop before the step that cannot be undone, and their lists of stopping points are nearly the same. The difference is what each assumes about the session it runs in: one is built on the accounts you are already signed into, the other tells you to give it a browser with no credentials in it. That single assumption decides which of the two belongs anywhere near your work.

Google, Anthropicverified

Agentsstrong signal

Encrypting the instruction walks it straight past the guardrail

Researchers at Adversa hid a prompt injection as ciphertext with the key next to it. Grok decrypted it in its own sandbox and sent the user's name, location, and chat history to an attacker's server, without a warning and without asking.

Ars Technicaverified