Post by @halle@infosec.exchange

2026-09-28 11:13 UTC

I've heard some iOS researchers who use hyperscaler agents puzzle over a similar effect but on a much shorter timeframe. There's a cloud of similar reports after a first report, which would normally be unsurprising because they are all using the same tool. However, Apple is also using the tool and apparently didn't detect, so it looks more like there is a researcher doing directed research and then the vuln is more generally visible to the agentic product afterwards. I don't know it's real/apophenia/survivorship bias, but if it were real, I would attribute it sooner to not-understood agentic leakage rather than something intentional (but this shouldn't be reassuring). https://www.nytimes.com/2026/09/27/science/anthropic-biology-enzyme-mestre.html?unlocked_article_code=1.EVE.e8Mn._lRdB19pQprE

Replies (1)

@halle@infosec.exchange 2026-09-28 11:31

I had a great paper about leakage through tool use (without adversarial intent or backdoors or prompt injection) in one of my newsletter issues but I can't find it so maybe I hallucinated including it. Anyway, here is a paper about how tool use can leak data purely via argument and other artifacts that are easier to forget to set boundaries around than the actual inputs/outputs/prompt/"thinking" and can also propagate into logs, etc. I've personally seen a (local, thankfully) agent "deduce" an exploit chain via a brief commit message without being allowed to see the commit, which was alarming and made me think that it's totally possible that what looks like data leakage between agent instances might be...data leakage between agent instances. https://ieeexplore.ieee.org/document/11569042

Open ##4883164