Viewing profile — wunderwuzzi23

One of the latest mitigations is to make sure that a URL an agent visits has been indexed by a search engine crawler. At least that is what OpenAI does now in ChatGPT. That makes s…

Nice. A BASIC for game development takes me back to AMOS on the Commodore Amiga. https://en.wikipedia.org/wiki/AMOS_(programming_language)

Correct. Good to see this get more coverage. Check out my research about unfurling in common messenger apps and also mitigations here: https://embracethered.com/blog/posts/2023/ai-…

Agreed. In December I reported a data exfil in OpenAI Agent Builder and it was also closed as Not Applicable, so it's probably still there. It's also unclear if anyone from OpenAI …

Claude (generally, even non Cowork mode) is vulnerable to exfil via their APIs, and Anthropic's response was that you should click the stop button if exfiltration occurs. This is a…

Relevant prior post, includes a response from Anthropic: https://embracethered.com/blog/posts/2025/claude-abusing-net...

Excited! It's such a great event. I'm currently on a plane towards Hamburg and will be speaking on Day 2. "Agentic ProbLLMs - Exploiting AI Computer-Use and Coding Agents" https://…

In case some of you find it entertaining. When MCP came out I had a flashback to COM/DCOM days, like IDispatch and list/tools. So, I built an MCP server that can host any COM serve…

Cool stuff. Interestingly, I responsibly disclosed that same vulnerability to Google last week (even using the same domain bypass with webhook.site). For other (publicly) known iss…

It still is. plus there are many more issue. i documented some here: https://embracethered.com/blog/posts/2025/security-keeps-goo...

The system prompt contains a lot more information about you. Just ask it to print all information under User Interaction Metadata. More details here: https://embracethered.com/blog…

Good point. Few thoughts I would add from my perspective: - The model is untrusted. Even if prompt injection is solved, we probably still would not be able to trust the model, beca…

It gets even worse with LLMs and agents. Many LLMs can interpret invisible Unicode Tag characters as instructions and follow them (eg invisible comment or text in a GitHub issue). …

Great point. It's actually possible for one agent to "help" another agent to run arbitrary code and vice versa. I call it "Cross-Agent Privilege Escalation" and described in detail…

Thanks for sharing! I'm actually the person the Ars Technica article references. :) For recent examples check out my Month of AI bugs with of a focus on coding agents at https://em…

Much longer actually, Bing Chat in Edge came out more than 2+ years ago.