Topic
A security flaw where instructions hidden in content an AI reads—web pages, documents, emails—are executed as if they were user commands.
A dev.to walkthrough of MCP internals locates the integration saving in deployment coupling and leaves the residual risk with the host process that validates each tool call and raises the consent prompt.
Reality
The paper's enforcement point reads a whole session's provenance before committing any action, so a read-email, call-payroll, send-externally sequence gets judged as a flow. Adoption means instrumenting every execution path.
Reality
Embrace The Red reports 60 to 80 percent success on a small sample where an Anthropic-commissioned evaluation scored 0.00 percent across 720 runs, and the difference is mostly in what each test could measure.
Reality
Johann Rehberger's chain landed 60% to 80% of the time in the mode Claude Code has run by default since mid-August. Anthropic closed the report as informative and pointed customers at OS-level isolation.
Reality
All ten injected runs in Forcepoint's test produced the manipulated summary. The remedy it recommends puts a human back on the original email, which is most of the work the assistant was bought to remove.
Reality
Version 0.2.0 decides admission by propagating integrity labels through a plan's dependency graph. The interesting cost is that the harness now has to declare, before acting, what the agent intends to do.
Reality
Hidden Word runs and PowerPoint speaker notes survive text extraction intact, which leaves the boundary between a source file and the bundle an agent trusts as the only useful checkpoint. The new library is rule-based on purpose.
Reality
The repository shipped setup instructions for a tool that did not exist, and the payload only arrived later, pulled from a DNS TXT record and handed to a shell. Approving the final command covers less of that than most teams assume.
Reality
A hostile Git repository was enough to run code on a developer's machine, and three more agent failures landed the same month. The blast radius is whatever the developer can reach.
Reality
The exfiltration path runs through Grok's own code sandbox, and the recommended fix sits in xAI's agent harness rather than the model. Treat anything typed into Grok as readable.
Reality
PromptArmor says 1-point white text hidden in an attachment is enough to push tickets to an outside server. Turning off web search org-wide leaves the agent's URL-fetch tool live.
Reality