learn the hacks, stop the attacks.
Joined January 2023
- Tweets298
- Following1
- Followers155
- Likes515
Embrace The Red retweeted
One year since the Month of AI Bugs! 🔥
Wild how many improperly secured AI systems are out there. A lot of work to do!
Assume Breach
I think we will still need a better term to reflect this strategy in the era of AI, but for now it's good enough
Lesson #1: AI can actively block your IR when needed most
Probs up next: Defender AI without guardrails will "hack back" in one way or another
So, threat model, sandbox and monitor your SOC AI accordingly.
Embrace The Red retweeted
Talks from Stanford's Real-World AI Security Conference are now on YouTube!
Full list is here
seclab.stanford.edu/RealWorl…
So many amazing talks, I really liked:
🔹 AI Agents Enable Adaptive Computer Worms, Nicolas Papernot 🔥
🔹 The Road to Hell Is Paved with Helpful Agents, Vitaly Shmatikov 🤯
🔹 Evaluating and Defending Against Prompt Injection Attacks, Edoardo Debenedetti 🐪💥
...and many more excellent talks covering outstanding research!
👉 AI Intrusions Are Here! 💥
...and safety guardrails are blocking defenders.
embracethered.com/blog/posts…
Hugging Face Intrusion in a nutshell
1. First end-to-end agentic intrustion
2. Safety guardrails blocked defenders from using AI
3. HF switched stack to GLM 5.2 (open-weight model) running locally
4. No IOCs shared yet
Hope more info well become available in the coming days
The Hugging Face AI intrusion hasn't gotten much attention so far, yet it's a "milestone" from multiple perspectives
youtu.be/JQQYhNK6AyU
Embrace The Red retweeted
Anthropic: "Risk we missed"
Happy to share that Claude Pirate got a subtle mention in the latest Anthropic engineering blog post, also shares how they fixed it 🙌
Embrace The Red retweeted
DEF CON Singapore talk write-up on hacking Microsoft Copilot(s)(CVE-2026-24299)
embracethered.com/blog/posts…
Embrace The Red retweeted
Really informative post from @EmbraceTheRed23. There is a YouTube video also on his channel if you're interested.
embracethered.com/blog/posts…
Exploiting AI Computer-Use and Coding Agents Paper
🔥 Took the Month of AI Bugs wreckage and turned it into a paper
- AI Kill Chain 🧨
- Test cases and exploit chains (data exfil, rce, zombies!)
- AgentHopper (a working AI virus for coding agents) 🦠
- SpAIware
- Normalization of Deviance in AI
zenodo.org/records/18769277
Embrace The Red retweeted
Attackers can exfiltrate user files from Cowork by exploiting an unremediated vulnerability in Claude’s coding environment, which now extends to Cowork. The vulnerability was first identified in Claude.ai chat before Cowork existed by Johann Rehberger, who disclosed the vulnerability. It was acknowledged but not remediated by Anthropic.
promptarmor.com/resources/cl…
Embrace The Red retweeted
Fixed. 🙌
Stop by DEF CON Singapore to learn more about what happened here with M365 Copilot, and a lot of other shenanigans. 😈
msrc.microsoft.com/update-gu…
Shout out to Microsoft for addressing this promptly.
Embrace The Red retweeted
🚨 Registration is now open! 🚨
We are excited to announce that registration is officially open for the Real World AI Security Conference 2026.
📅 June 23–25, 2026
📍 Arrillaga Alumni Center, Stanford University
If you work on AI security, adversarial ML, LLM safety, AI system attacks, or defenses, this event is designed for you.
👉 Register here (we have a limitation on the number of attendees):
seclab.stanford.edu/RealWorl…
We look forward to bringing together the community to explore the latest advances in AI security in the real world.
#AISecurity #CyberSecurity #MachineLearningSecurity #LLMSecurity #AdversarialML #AIResearch #AIConference #SecurityResearch #RealWorldAISecurity
Agentic ProbLLMs - Exploiting AI Computer-Use and Coding Agents
Paper 👇
doi.org/10.5281/zenodo.18769…
Embrace The Red retweeted
NanoClaw 🔥
Don't give AI access to sensitive stuff you care about.
Trust No AI, as usual.
Month of AI Bugs still going strong! 🚀
Learn the hacks, stop the attacks.
Follow him: @wunderwuzzi23
Helpful resources 👇🏻
The Month of AI Bugs 2025
Source: embracethered.com/blog/posts…
Exfiltrating Your ChatGPT Chat History and Memories With Prompt Injection
Source: embracethered.com/blog/posts…
Turning ChatGPT Codex Into A ZombAI Agent
Source: embracethered.com/blog/posts…
Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation
Source: embracethered.com/blog/posts…
Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)
Source: embracethered.com/blog/posts…
Amp Code: Arbitrary Command Execution via Prompt Injection Fixed
Source: embracethered.com/blog/posts…
I Spent $500 To Test Devin AI For Prompt Injection So That You Don't Have To
Source: embracethered.com/blog/posts…
How Devin AI Can Leak Your Secrets via Multiple Means
Source: embracethered.com/blog/posts…
AI Kill Chain in Action: Devin AI Exposes Ports to the Internet with Prompt Injection
Source: embracethered.com/blog/posts…
ZombAI Exploit with OpenHands: Prompt Injection To Remote Code Execution
Source: embracethered.com/blog/posts…
OpenHands and the Lethal Trifecta: How Prompt Injection Can Leak Access Tokens
Source: embracethered.com/blog/posts…
Claude Code: Data Exfiltration with DNS (CVE-2025-55284)
Source: embracethered.com/blog/posts…
GitHub Copilot: Remote Code Execution via Prompt Injection
Source: embracethered.com/blog/posts…
Google Jules: Vulnerable to Data Exfiltration Issues
Source: embracethered.com/blog/posts…
Google Jules: Remote Code Execution ZombAI
Source: embracethered.com/blog/posts…
Google Jules: Invisible Prompt Injection
Source: embracethered.com/blog/posts…
Amp Code Fixed: Invisible Prompt Injection
Source: embracethered.com/blog/posts…
Amp Code Fixed: Data Exfiltration via Images
Source: embracethered.com/blog/posts…
Amazon Q Developer: Data Exfil via DNS
Source: embracethered.com/blog/posts…
Amazon Q Developer: Remote Code Execution
Source: embracethered.com/blog/posts…
Amazon Q Developer Interprets Hidden Instructions
Source: embracethered.com/blog/posts…
Windsurf: Data Exfiltration Vulnerabilities
Source: embracethered.com/blog/posts…
Windsurf: SPAIware Exploit - Persistent Prompt Injection
Source: embracethered.com/blog/posts…
Windsurf: Sneaking Invisible Instructions for Prompt Injection
Source: embracethered.com/blog/posts…
ChatGPT Deep Research Connectors: Data Spill and Leaks
Source: embracethered.com/blog/posts…
Manus AI Kill Chain: Expose Port - VS Code Server on Internet
Source: embracethered.com/blog/posts…
AWS Kiro: Arbitrary Command Execution with Indirect Prompt Injection
Source: embracethered.com/blog/posts…
Cline: Vulnerable to Data Exfiltration
Source: embracethered.com/blog/posts…
Windsurf: Dangers - Lack of Security Controls for MCP Server Tool Invocation
Source: embracethered.com/blog/posts…
AgentHopper: A PoC AI Virus
Source: embracethered.com/blog/posts…
Wrapping Up Month of AI Bugs
Source: embracethered.com/blog/posts…
Hiding Invisible Unicode Tag instructions in SKILL files 🔥
...and how to catch it!
embracethered.com/blog/posts…
Embrace The Red retweeted
As personal AI agents increasingly send messages to chat apps, it’s worth revisiting link unfurling. 😈
It's a straightforward data exfiltration vector.
Attacker hijacks your AI to embed private data in URL, posts it & chatapp auto connects. 0-click.🔥
embracethered.com/blog/posts…