#prompt_injection

New post: Open Tabs CW31/2026 A new Gnome extension, a word worm (I thought we got over Office worms ages ago) and an OpenAI parrot attacked Hugging Face. Interesting week and some stuff to read. Have fun. https://stoeps.de/posts/2026/open-tabs-cw31/ Reply to this toot to leave a comment - replies will appear below the article automatically. #ai #cw31_2026 #extension #gnome #m365 #openai #prompt_injection #tiu #word #worm

---------------- 🎯 AI =================== Arcanum AI Security Resource Hub is a curated directory of challenge platforms for practicing AI security. The collection spans beginner to advanced levels and covers the core attack surfaces in modern LLM deployments. Core Features The directory organizes platforms by difficulty and deployment model. Hosted options like Lakera Gandalf, Wiz AI CTF, and Forces Unseen's prompt injection games require zero setup. Self-hosted labs, including the OWASP LLM Top 10 CTF and the "Juice Shop for Agentic AI," run locally with Python and Ollama using open models such as Mistral and Llama3. Technical Coverage • Prompt injection: Direct and indirect techniques, including cross-user data leakage and authentication bypass through LLM manipulation • Jailbreaking: Progressive challenges from basic password extraction to advanced guardrail circumvention • Agentic AI attacks: Goal manipulation against tool-using AI agents, multi-step agentic workflow exploitation, and attacks on chained LLM systems performing data transformation in banking contexts • RAG and document processing: Vulnerabilities in retrieval-augmented generation systems and document-focused AI security • OWASP LLM Top 10: CTF-style challenges mapped to recognized risk categories • Adversarial ML: Model inversion, data poisoning, and adversarial attacks via Garak's 80+ challenge set Notable Platforms • Lakera Gandalf: Classic progressive prompt injection challenge • PortSwigger Labs: Four labs covering indirect injection, data exfiltration, cross-user leakage, and auth bypass • OWASP LLM Goat: Deliberately vulnerable chatbot lab for the OWASP LLM Top 10 • Garak: Professional platform with 80+ challenges including DEFCON and Black Hat content • Wiz AI CTF: Five challenges manipulating a customer-service chatbot Strengths The directory provides breadth across difficulty levels and attack categories. The mix of hosted and self-hosted options accommodates different environments, including air-gapped setups. Limitations Some platforms are marked buggy or offline. The "Juice Shop for Agentic AI" public Render demo is currently down. The directory provides minimal context beyond difficulty level and brief descriptions, so practitioners need to evaluate relevance independently. 🔹 bookmark #prompt_injection #LLM_security #AI_CTF #OWASP_LLM 🔗 Source: https://arcanum-sec.github.io/ai-sec-resources/

🎯 AI =================== Executive summary: The article documents "AI tool poisoning," an attack in which attackers publish seemingly benign tools whose descriptions or metadata contain hidden instructions. When AI agents ingest those descriptions via Model Context Protocol (MCP) or similar interfaces, the hidden instructions can alter the agent's reasoning and parameter construction, causing sensitive data exposures without changes to tool code. Technical details: • Example artifact: a published tool called add_numbers whose description superficially states "Adds two integers and returns the result," but whose metadata contains an instruction to read ~/.ssh/id_rsa and pass its contents as the sidenote parameter. • Threat mechanism: the agent parses the description during planning; the reasoning layer treats the buried instruction as legitimate guidance and constructs a call that sources local secrets into tool parameters. • Scope: this is a context/metadata manipulation vector rather than code injection; the attacker leverages how agents interpret human-readable tool descriptions. Analysis: • Impact arises from conflating tool interface documentation with operational instructions inside the agent's planning phase. The attacker can compel the agent to access local files, secrets, or other sensitive context values and include them in tool calls, enabling exfiltration without exploiting the tool binary. • This bypasses protections focused solely on tool code integrity because the malicious element is in descriptive metadata consumed by the agent. Detection considerations: • Monitor tool registry metadata for anomalous or imperative phrasing that references local paths, secret identifiers, or data access directives. • Instrument agent reasoning logs to flag parameter sources that originate from sensitive file paths or environment values. Mitigation concepts: • Treat tool descriptions and metadata as untrusted input: validate and sanitize natural-language instructions in metadata before inclusion in agent planning. • Enforce principle of least privilege around what context the agent may access and which local values can be used to populate tool parameters. Limitations: • The article focuses on the conceptual attack and illustrative example; it does not provide exhaustive IoCs or a catalog of affected agent implementations. 🔹 AI #MCP #tool_poisoning #prompt_injection #metadata_manipulation 🔗 Source: https://www.crowdstrike.com/en-us/blog/ai-tool-poisoning/