搜索“GitHub”

d AI, not AI that leads humans. Conclusion Since the early ChatGPT Plugin days 2+ years ago we know about the risks of automatic tool invocation. From stealing emails, to exposing GitHub repositories and even remote code execution there is a lot that can go wrong. AI Apps and Agents over-rely on model behavior to enforce security. This is often a fundamental design flaw in agentic systems. The model might have a backdoor or hallucinate, and even worse, if there is no attacker in the loop (indire

匹配字段正文

Cline is quite a popular AI coding agent, according to the product website it has 2+ million downloads and over 47k stars on GitHub. Unfortunately, Cline is vulnerable to data exfiltration through the rendering of markdown images from untrusted domains in the chat box. This allows an adversary to exfiltrate sensitive user information during a prompt injection attack by reading sensitive data (e.g. .env file) and appending its contents to the URL of an image. This issue is similar to an issue fou

匹配字段正文

d to enable the next wave of startups and AI progress to be built on open rails and open models. Quick Links Environments Hub; Environments Hub Documentation; prime CLI; verifiers github; verifiers docs; prime-rl github Features Developing and Sharing Environments Create, manage and share environments for reinforcement learning and evaluation on the Environments Hub: Evals Create and explore evaluation reports for environments for various models. RL Training Environments are natively supported i

匹配字段正文

f and achieve arbitrary code execution. An attacker could force this condition via indirect prompt injection, coming from source code, an uploaded image, or data returned from tool calls. As we have shown with GitHub Copilot and Amp earlier this month already, and now with AWS Kiro, Agents that can modify their own configuration to achieve arbitrary code execution enable sandbox-like escapes, where the AI breaks out and compromises the developer’s machine. References Newer →; Contact me; ← Older

匹配字段正文

I created a simple remote MCP server named Remote Matrix that correctly implements search and fetch tools to adhere to OpenAI’s specification. I also published the source code on GitHub. It includes extensive logging, because that was my primary goal to better understand what data is sent by the AI to the MCP server. The code might also be helpful because I noticed that OpenAI’s demo Connector does not correctly implement the correct schema that OpenAI Deep Research highlights in the docs. Data

匹配字段正文

ndboxing and automatic memory persistence can lead to SpAIware-style attacks. This is an attacker technique I first introduced last year with ChatGPT. In this post we showed how an attacker can exploit this via a prompt injection attack (e.g content in a GitHub issue, source code or from another website) to install persistent instructions into long-term memory that compromise the confidentiality, integrity and availability of all future chat conversations. References Newer →; Contact me; ← Older

匹配字段正文

r information as it analyzes the file, all without requiring user approval Attack Vector 2: Image Rendering The second attack vector is quite similar to a vulnerability I found in GitHub Copilot last year, which Microsoft has since fixed. You can read up details here. Image rendering from untrusted domains is actually one of the most common AI application security vulnerabilities to be aware of. We have seen dozens of examples of this vulnerability over the last two+ years. Exploit Demonstration

匹配字段正文

k me a bit to figure out how to report security vulnerabilities in Amazon’s AI products. This vulnerability was disclosed to AWS on July 5, 2025, via an email address found on the GitHub project for the Amazon Q Developer VS Code Extension. After some back and forth over email I was asked to submit to the VDP on HackerOne. Although Amazon’s AI products were not in scope for reporting on HackerOne, so it took a few more days to get it added. AWS reported the vulnerability as resolved per August 8

匹配字段正文

://peter.sh/experiments/chromium-command-line-switches/; user data dir state can drastically affect browser behavior, there are preferences files, state dbs, cookie stores https://github.com/thewh1teagle/rookie and more; Profile Preferences (e.g. theme color, downloads dir, extension display settings, etc.), enterprise / registry options, and chrome://flags options Ignoring These for Now /session/{id}/url; /session/{id}/element/{eid}/click; /session/{id}/actions; ... etc. These are not actually

匹配字段正文

ntly reduce both cold (first time) and warm (second time and on) start up for vLLM, especially as related to Dynamo and Inductor compilation. Please follow the startup-ux label on GitHub or join the feat-startup-ux channel on vLLM Slack to stay updated on the progress! An important UX improvement is the planned revamp of the -O command-line flag. By specifying -O on the vLLM CLI (where n is an integer between 0-3), users will get easier direct control over trading off startup time for performanc

匹配字段正文

that matter) to run arbitrary commands on the host without the developer’s consent. The resulting impact of the vulnerability is the same as CVE-2025-53773 that Microsoft fixed in GitHub Copilot, however AWS did not issue a CVE when patching the vulnerabiliy. Let’s explore this in detail. As usual, the first step for me was to dump the system prompt. The Amazon Q VS Code extension has a set of tools defined, including reading files, writing files, and executeBash to run commands and so on. Under

匹配字段正文

ok me a bit to figure out how to report security vulnerabilities in Amazon’s AI products. This vulnerability was disclosed to AWS on July 5, 2025 via an email address found on the GitHub project for Amazon Q Developer. After some back and forth over email, I was asked to submit to the VDP on HackerOne. But turns out that Amazon’s AI products were not “in scope” for reporting on HackerOne, so it took a few more days to get it added. I rated the vulnerability wih CVSS High severity. This aligns wi

匹配字段正文

e practically speaking. To prove the point, we wrote an AI agent that looks for such functions that static scanners might miss. We instructed the agent to search relatively common GitHub repositories such as numpy and pytorch, for functions that are wrappers around known unsafe python functions (such as subprocess.Popen or exec). By doing so we were able to quickly find dozens of examples that static scanners do not include in their denylist. One of the examples the agent found was the following

匹配字段正文

mpt-processing) and decode (token generation) operations of LFM2-1.2B-Q4 0.gguf. For a fair comparison we use the publicly released llama-bench executables from the main llama.cpp GitHub repository with all available pre-built backends, including all available GPU backends, as well as for the CPU backend we vary the number of threads (4, 8, and 12), and report the maximum values observed for each hardware. The integrated GPU handles prompt processing at speeds comparable to discrete GPUs—without

匹配字段正文

driven image rendering to exfiltrate sensitive information. This vulnerability is common in AI applications and agents, and it’s actually similar to one we discussed last year in GitHub Copilot which Microsoft fixed. Exploit Demonstration For the proof-of-concept I use a pre-existing demo that created a longer time ago. It happened to just work with Amp as well. The prompt injection is hosted on a website which asks the AI to “backup” information to a third-party site by rendering an image and

匹配字段正文

wnload malware, and execute it. What About Network Connectivity? Turns out Jules has unrestricted outbound Internet connectivity. Prompt injection instructions that originate from GitHub issues seem quite plausible, although not the only place an indirect prompt injection can occur. Recently, a new feature was added to Jules where one can tag a GitHub issue with jules and the agent will start working on it. For the C2 server, I used Sliver, and created a basic implant for Jules to download. The

匹配字段正文

ndering via Markdown Syntax; view text website tool; Generic RCE with unrestricted Internet access - we will talk more about that in tomorrow’s post! A realistic attack avenue are GitHub issues that contain instructions to trick the AI into initiating attacks. Since June one can tag a GitHub issue with jules and the agent will start working on it apparently, but as you know prompt injection can also come from other places. Let’s discuss the various scenarios in detail. Exfiltration Vector 1: Mar

匹配字段正文

ure, showing how an adversary can perform a prompt injection attack via untrusted data from a website. Consider a scenario where you ask Devin to look at websites or investigate a GitHub issue. You can just task Devin via Slack actually, and afterwards it works entirely unsupervised. A key concern arises when Devin interacts with potentially malicious websites that contains prompt injection instructions. Turns out initially Devin refused these requests, but one trick I learned over the last few

匹配字段正文

I haven’t mentioned it yet, Devin by default has unrestricted access to the Internet. Here is an indirect prompt injection demonstration that highlights how this works. We have a GitHub issue that asks to investigate a runtime error: Then we ask Devin to investigate the latest open GitHub issue: And observe how it is hijacked and follows the nefarious instructions. Here is the full screen version to show all the details: You can see that it encountered multiple errors, but figures out how to co

匹配字段正文

copy patterns from other services. Before changing the retry logic, they need to understand how similar failures are handled elsewhere. Instead of switching to Slack or searching GitHub manually, they enter a query directly in the IDE: “How do we handle Stripe timeouts in the checkout flow?” The embedding index, running locally, returns a helper module from another service that wraps retry logic with exponential backoff. They copy the pattern into their own handler—but realize three other servi

匹配字段正文