搜索“GitHub”

details our system’s architecture, outlines several new scaling results, and discusses the promise and challenges of AI-generated science. Explore the code and generated papers on GitHub: AI Scientist-v1, AI Scientist-v2 Example sections of a paper produced by The AI Scientist that passed the peer-review process for a workshop at a top-tier international AI conference. The Journey So Far Our journey to this publication has been a 1.5-year process with distinct phases shaped by foundation model d

匹配字段正文

e use all 300 tasks. Our few failures come from unavailable sites, ambiguous prompts, or websites that changed since the benchmark was created. Rerunning our results is easy Clone github.com/browser-use/online-mind2web, set your Browser Use API key, and run. We also uploaded prompts, results, and judgments. We need harder benchmarks We're building a benchmark with everything users actually care about. Currently benchmarks ignore tasks like: "Extract 1000 products with subpages and compare them a

匹配字段正文

es to avoid penalizing agents for artifacts they were not instructed to remove prior to submission.3 We upload the patches to a private copy of the repo in its historical state on GitHub. For our main analysis, we only submit PRs for review if they pass the SWE-bench automated grader. We impute maintainer review as failure if the PR fails the automated grader. This amounts to assuming SWE-bench Verified has no false negatives (cases where the automated grader says fail, but the maintainer would

匹配字段正文

t add an additional check, the LLM can call any function from that namespace. To make the issue more concrete, I’ve made an end-to-end example, where sonnet gets limited access to github MCP client, only list issues, but yet it successfully calls get me to extract my github email. Have a look at Appendix: MCP Example Our libraries have this fixed, but it is not so hard to imagine it will keep appearing as developers adopt client-defined tools: MCP servers, IPython kernels, or get creative with ‘

匹配字段正文

ons was reported multiple times over the last two years to all major model vendors; Exploits depend a lot on the model that is being used. For instance, I also got it working with GitHub Copilot when using a Claude 4.5 model. Adding the instructions various places including prompt injection tricks inside a skill, reliability can be improved; For the Claude Code demo video auto-approval for the Bash tool was on; When retrying the demo on February 10, 2026, I consistently got invisible unicode det

匹配字段正文

er. This is what the documentation statesabout the configuration: “Allow network egress to package managers only (default): Claude can access approved package managers (npm, PyPI, GitHub, etc.) to install necessary software packages. This balances functionality with security, but some advanced features may be limited.” The default setting is called “Package managers only”: That list of allowed domains is short and documented here as “Approved network domains”: This list seems quite limited. At s

匹配字段正文

Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering of markdown images from untrusted domains in the chat box. This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by reading sensitive data (e.g. .env file) and appending its contents to the URL of an image. This issue is similar to an issue fou

匹配字段正文

f and achieve arbitrary code execution. An attacker could force this condition via indirect prompt injection, coming from source code, an uploaded image, or data returned from tool calls. As we have shown with GitHub Copilot and Amp earlier this month already, and now with AWS Kiro, Agents that can modify their own configuration to achieve arbitrary code execution enable sandbox-like escapes, where the AI breaks out and compromises the developer’s machine. References Newer →; Contact me; ← Older

匹配字段正文

I created a simple remote MCP server named Remote Matrix that correctly implements search and fetch tools to adhere to OpenAI’s specification. I also published the source code on GitHub. It includes extensive logging, because that was my primary goal to better understand what data is sent by the AI to the MCP server. The code might also be helpful because I noticed that OpenAI’s demo Connector does not correctly implement the correct schema that OpenAI Deep Research highlights in the docs. Data

匹配字段正文

ndboxing and automatic memory persistence can lead to SpAIware-style attacks. This is an attacker technique I first introduced last year with ChatGPT. In this post we showed how an attacker can exploit this via a prompt injection attack (e.g content in a GitHub issue, source code or from another website) to install persistent instructions into long-term memory that compromise the confidentiality, integrity and availability of all future chat conversations. References Newer →; Contact me; ← Older

匹配字段正文

r information as it analyzes the file, all without requiring user approval Attack Vector 2: Image Rendering The second attack vector is quite similar to a vulnerability I found in GitHub Copilot last year, which Microsoft has since fixed. You can read up details here. Image rendering from untrusted domains is actually one of the most common AI application security vulnerabilities to be aware of. We have seen dozens of examples of this vulnerability over the last two+ years. Exploit Demonstration

匹配字段正文

k me a bit to figure out how to report security vulnerabilities in Amazon’s AI products. This vulnerability was disclosed to AWS on July 5, 2025, via an email address found on the GitHub project for the Amazon Q Developer VS Code Extension. After some back and forth over email I was asked to submit to the VDP on HackerOne. Although Amazon’s AI products were not in scope for reporting on HackerOne, so it took a few more days to get it added. AWS reported the vulnerability as resolved per August 8

匹配字段正文

that matter) to run arbitrary commands on the host without the developer’s consent. The resulting impact of the vulnerability is the same as CVE-2025-53773 that Microsoft fixed in GitHub Copilot, however AWS did not issue a CVE when patching the vulnerabiliy. Let’s explore this in detail. As usual, the first step for me was to dump the system prompt. The Amazon Q VS Code extension has a set of tools defined, including reading files, writing files, and executeBash to run commands and so on. Under

匹配字段正文

ok me a bit to figure out how to report security vulnerabilities in Amazon’s AI products. This vulnerability was disclosed to AWS on July 5, 2025 via an email address found on the GitHub project for Amazon Q Developer. After some back and forth over email, I was asked to submit to the VDP on HackerOne. But turns out that Amazon’s AI products were not “in scope” for reporting on HackerOne, so it took a few more days to get it added. I rated the vulnerability wih CVSS High severity. This aligns wi

匹配字段正文

driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and

匹配字段正文

wnload malware, and execute it. What About Network Connectivity? Turns out Jules has unrestricted outbound Internet connectivity. Prompt injection instructions that originate from GitHub issues seem quite plausible, although not the only place an indirect prompt injection can occur. Recently, a new feature was added to Jules where one can tag a GitHub issue with jules and the agent will start working on it. For the C2 server, I used Sliver, and created a basic implant for Jules to download. The

匹配字段正文

ndering via Markdown Syntax; view text website tool; Generic RCE with unrestricted Internet access - we will talk more about that in tomorrow’s post! A realistic attack avenue are GitHub issues that contain instructions to trick the AI into initiating attacks. Since June one can tag a GitHub issue with jules and the agent will start working on it apparently, but as you know prompt injection can also come from other places. Let’s discuss the various scenarios in detail. Exfiltration Vector 1: Mar

匹配字段正文

ure, showing how an adversary can perform a prompt injection attack via untrusted data from a website. Consider a scenario where you ask Devin to look at websites or investigate a GitHub issue. You can just task Devin via Slack actually, and afterwards it works entirely unsupervised. A key concern arises when Devin interacts with potentially malicious websites that contains prompt injection instructions. Turns out initially Devin refused these requests, but one trick I learned over the last few

匹配字段正文

I haven’t mentioned it yet, Devin by default has unrestricted access to the Internet. Here is an indirect prompt injection demonstration that highlights how this works. We have a GitHub issue that asks to investigate a runtime error: Then we ask Devin to investigate the latest open GitHub issue: And observe how it is hijacked and follows the nefarious instructions. Here is the full screen version to show all the details: You can see that it encountered multiple errors, but figures out how to co

匹配字段正文

how this threat applies to your use case and apply a patch as needed. Anthropic’s Slack MCP Server When Anthropic introduced MCP they published reference server implementations on Github. One of the reference servers is a Slack MCP Server that is vulnerable to “link unfurling”. We previously described this vulnerability generically for AI agents that post to messaging apps. At a glance it allows an AI agent that posts to Slack or other messaging applications to leak data to third-party servers.

匹配字段正文