wunderwuzzi23
Joined 6 years ago
Karma
363
Submissions
147
Member since
Apr 27
Recent submissions
Comment · 2 months ago
Part of the attack happens via the readme in the zip file, which is something the agent reads and follows (or better said in this attack, it does explicitly not follow those instructions for safety reasons, but decides to do something else).
Comment · 2 months ago
One of the latest mitigations is to make sure that a URL an agent visits has been indexed by a search engine crawler. At least that is what OpenAI does now in ChatGPT.
That makes sure that not a large amount of private data is leaked in one request. Assuming that if a URL is indexed, it is public data. However, there are still bypasses with using many requests to leak information, like a request per character of pre-indexed URLs.
I have some demos of doing that on my blog, but it makes it more involved for an attacker. And that could also be detected. Still not perfect, but a solid improvement, for a generic agent like ChatGPT.
There is paper OpenAI wrote a few months ago that explains how they do it: https://embracethered.com/blog/posts/2026/data-exfiltration-...
It's not a 100% bullet proof approach either, but pretty good.
Regarding the point on using URLs returned from trusted tool calls. That is similar to using pre-indexed URLs: If a "trusted tool" includes things like read a document, read an email,... an attacker can return a large list of afterwards "safe" urls, like 26 to cover A-Z. And then an attack can render many requests, e.g. character by character. But, again, similar to the pre-indexing, things are getting more a lot more expensive for an attacker that way. However, still not impossible.
For agents that have a specific purpose simple domain allow-listing is also a pretty effective idea in to prevent attacker controlled endpoints.
Comment · 3 months ago
Nice. A BASIC for game development takes me back to AMOS on the Commodore Amiga.
Comment · 8 months ago
Correct. Good to see this get more coverage.
Check out my research about unfurling in common messenger apps and also mitigations here:
https://embracethered.com/blog/posts/2023/ai-injections-thre...
And here "dangers of unfurling and what to do about it"
https://embracethered.com/blog/posts/2024/the-dangers-of-unf...
Comment · 9 months ago
Agreed.
In December I reported a data exfil in OpenAI Agent Builder and it was also closed as Not Applicable, so it's probably still there.
It's also unclear if anyone from OpenAI even ever saw the report. I don't know.
Maybe the incentives are off on some bug bounty platforms or programs, and triagers are evaluated on how fast they respond, and how quickly a ticket is closed rather then what kind of quality tickets they help produce.
It's the only explanation I have for this kind of decisions.
Comment · 9 months ago
Claude (generally, even non Cowork mode) is vulnerable to exfil via their APIs, and Anthropic's response was that you should click the stop button if exfiltration occurs.
This is a good example of the Normalization of Deviance in AI by the way.
See my Claude Pirate research from last October for details:
https://embracethered.com/blog/posts/2025/claude-abusing-net...
Comment · 9 months ago
Relevant prior post, includes a response from Anthropic:
https://embracethered.com/blog/posts/2025/claude-abusing-net...
Comment · 10 months ago
Excited! It's such a great event.
I'm currently on a plane towards Hamburg and will be speaking on Day 2.
"Agentic ProbLLMs - Exploiting AI Computer-Use and Coding Agents"
https://events.ccc.de/congress/2025/hub/event/detail/agentic...
https://embracethered.com
Twitter: @wunderwuzzi23