Topic
Attacks in which untrusted text carried into a model's context is treated as instructions, including the indirect carriers named here: web pages, email, uploaded PDFs, product reviews and calendar invites.
Adversa AI says a hostile page can ship its instructions as AES ciphertext, have Grok decrypt them in its own Python runtime, and then exfiltrate session data via a URL fetch.
Reality
Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.
Reality
A developer's noise filter and reranker fixed a retrieval bug and exposed a worse one. If ordinary retrieved text can hijack a prompt, injection is a property of your corpus, not your threat model.
Reality
A maintainer pointed his own multi-model CLI at its own repository and found both a prompt-injection hole and the passing test that was supposed to prove the hole did not exist.
Reality
An Anthropic and EPFL preprint shows plain-language goals hopping agent to agent through persistent files, and a one-paragraph warning in the system prompt stopping nearly all of it.
Reality
A dev.to post argues prompt hardening is the weakest defence against injection, not the strongest. If your security depends on the model choosing to obey, you have a suggestion.
Reality
The macOS feature is off by default, and Business and Enterprise tenants need administrator approval first. That approval is the entire policy decision, and it happens once.
Reality
A dev.to post argues most "read-only" Kubernetes MCP servers filter the tools/list response while the write path stays callable. One such filter is now a CVE at CVSS 8.8.
Reality
Self-propagating payloads did move between agents through editable soul files, but one inoculation paragraph held against 150-plus optimized strains, and nothing propagated in the wild.
Reality
CVE-2026-22708 let injected text rewrite a Cursor agent's environment, so an approved "git branch" ran something else. It worked with an empty allowlist too.
Reality
The open-source demo treats the model as untrusted and pushes controls outward: signed database writes, a gVisor sandbox with no network, and a deterministic gateway in front.
Reality
The 2026 GenAI LLM Top 10 leaves the first two entries untouched and promotes Excessive Agency three places. The list increasingly reads as guidance for containing damage rather than preventing it.
Reality
A Hacker News explainer makes the structural case: plaintext configs, unrotated tokens, broad scopes and prompt injection put agent plumbing outside secrets management.
Reality
Hidden white-on-white instructions to any reviewing AI cost a self-represented plaintiff his electronic filing rights. The court that caught him does not even use AI.
Reality
Anthropic's own study found users approved 97% of prompts and caught 13.6% of harmful actions. From August 14 the click stops being the safeguard, and deny rules become the job.
Reality
A Connecticut judge found white-on-white instructions to AI models in a pro se motion, then found more in the reply. Any team summarizing text it did not author is handling adversarial input now.
Reality
Hidden white-on-white instructions in a Connecticut filing failed because the court does not use AI. Every other document intake pipeline should read that as a warning, not an all-clear.
Reality
A developer's argument that .env access is an architectural bug in agent workflows, and a small Go CLI that brokers credentials at the process and transport boundary instead.
Reality
A dev.to argument worth taking literally: if your model reads untrusted text and can act, injection is already live. The only controls that held up sit outside the prompt.
Reality