Experimental News Clipping Site

Tag: assessment

  • Embrace The Red: AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/aws-kiro-aribtrary-command-execution-with-indirect-prompt-injection/ Source: Embrace The Red Title: AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection Feedly Summary: On the day AWS Kiro was released, I couldn’t resist putting it through some of my Month of AI Bugs security tests for coding agents. AWS Kiro was vulnerable to arbitrary command execution via indirect prompt…

  • The Register: Docker Desktop bug let containers hop the fence with barely a nudge

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/26/docker_desktop_bug/ Source: The Register Title: Docker Desktop bug let containers hop the fence with barely a nudge Feedly Summary: Isolation? We’ve heard of it Docker has patched a critical hole in Docker Desktop that let a container break out and take control of the host machine with laughable ease.… AI Summary and Description:…

  • The Register: One long sentence is all it takes to make LLMs misbehave

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/26/breaking_llms_for_fun/ Source: The Register Title: One long sentence is all it takes to make LLMs misbehave Feedly Summary: Chatbots ignore their guardrails when your grammar sucks, researchers find Security researchers from Palo Alto Networks’ Unit 42 have discovered the key to getting large language model (LLM) chatbots to ignore their guardrails, and it’s…

  • Embrace The Red: Sneaking Invisible Instructions by Developers in Windsurf

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/windsurf-sneaking-invisible-instructions-for-prompt-injection/ Source: Embrace The Red Title: Sneaking Invisible Instructions by Developers in Windsurf Feedly Summary: Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI. This is a vulnerability discovered in Windsurf Cascade, it follows invisible instructions. This means there can be instructions in a file or…

  • The Register: Search-capable AI agents may cheat on benchmark tests

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/23/searchcapable_ai_agents_may_cheat/ Source: The Register Title: Search-capable AI agents may cheat on benchmark tests Feedly Summary: Data contamination can make models seem more capable than they really are Researchers with Scale AI have found that search-based AI models may cheat on benchmark tests by fetching the answers directly from online sources rather than deriving…

  • The Register: Criminal background checker APCS faces data breach

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/22/apcs_breach/ Source: The Register Title: Criminal background checker APCS faces data breach Feedly Summary: The attack first affected an upstream provider of bespoke software Exclusive A leading UK provider of criminal record checks for employers is handling a data breach stemming from a third-party development company.… AI Summary and Description: Yes Summary: The…

  • The Register: Honey, I shrunk the image and now I’m pwned

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/21/google_gemini_image_scaling_attack/ Source: The Register Title: Honey, I shrunk the image and now I’m pwned Feedly Summary: Google’s Gemini-powered tools tripped up by image-scaling prompt injection Security researchers with Trail of Bits have found that Google Gemini CLI and other production AI systems can be deceived by image scaling attacks, a well-known adversarial challenge…