Emerging Threats

Researchers from Seoul National University, the University of Illinois Urbana-Champaign, and Largosoft have published a paper describing a new attack class called agent data injection (ADI), detailed by The Hacker News.

AI agents read two types of input: instructions (what you tell them to do) and data (everything they pull in while working, like a web page or email). Most defences are built to catch smuggled instructions hidden in data. ADI works differently. It corrupts the small facts the agent quietly trusts — a sender's name, a button's ID, a tool result — without ever writing anything that looks like an order.

In tested attacks, a planted product review made a web agent click "Buy Now" instead of "Read More." A forged GitHub comment made a coding assistant run a stranger's command on a developer's machine.

What you should do: Be cautious about approving AI agent actions without reviewing exactly what they are about to do. Treat every agent confirmation prompt the way you would treat an unfamiliar permission request — read it before you click yes.

Researchers at Trend Micro have documented a Russian-speaking attacker using Google's open-source Gemini CLI (a command-line AI assistant anyone can run locally) to plan, deploy, and manage a small botnet — a network of compromised machines controlled remotely — targeting a dental clinic's systems, according to Bleeping Computer.

The attacker fed Gemini a jailbreak prompt that framed it as an "authorised pen tester," bypassing safety guardrails. From there, the AI helped migrate the botnet to new infrastructure in six minutes flat, diagnosed connection failures, generated infection links, and even suggested operational improvements — unprompted.

The entire operation ran on three plain-text files totalling around 5 KB. Low sophistication, high effectiveness.

Gemini did refuse at least one request — to build a self-spreading "agent bomb." The attacker simply moved on to other tasks.

What you should do: If your organisation uses AI coding or automation tools, review what data and system access those tools have. An AI assistant with unchecked permissions is a significant risk if the person holding the keyboard has bad intentions.

Check Point's AI Security Report 2026 documents something that has quietly shifted over the past year: researchers have now observed intrusions where AI ran the exploitation process autonomously, generating thousands of commands across dozens of sessions with minimal human involvement. According to Help Net Security, attackers obtain capable AI models by abusing commercial services, using stolen API credentials, or self-hosting open-source models with their safety controls stripped out.

One persistent technique targets AI coding agents by embedding malicious instructions inside configuration files such as CLAUDE.md, which are automatically loaded at the start of every session. The injected instruction stays active until the file is removed — a jailbreak that survives restarts.

The report also notes that the gap between a vulnerability being made public and a working exploit appearing in the wild continues to narrow, often down to hours. The speed at which defenders patch is now the single biggest variable.

Researchers have demonstrated an attack that plants false information inside an AI agent's long-term memory using nothing but a single crafted email, according to The Hacker News. The technique, called stealth memory injection, targets personal AI agents — tools like OpenClaw that persist information about you between sessions, reading notes about your preferences and history at the start of every conversation.

The attacker sends an email to someone whose agent monitors their inbox. Hidden inside is an instruction aimed at the agent, not the human. The agent quietly writes a false "fact" into its memory files, says nothing about it in the visible reply, and then acts on that false fact in every future session.

The tool behind these attacks, named MemGhost, succeeded in 87.5% of test runs. One demonstrated payload told the agent the user's daily bank transfer limit had been raised to $10,000.

If you use an AI assistant with memory and inbox access, review its stored memory files directly and audit what it actually knows about you.

Millions of developers use AI coding assistants like GitHub Copilot inside their editors. These tools can open files, write and run code, and revise their own output across many turns. A study from the Alan Turing Institute in London has found a significant gap in how these agents are tested for safety, according to Help Net Security.

Current safety testing works like a chatbot quiz: present one harmful prompt, score one response, move on. The problem is that dangerous behaviour in coding agents rarely surfaces in a single exchange. It emerges across sequences of steps, file edits, and script executions that no single-prompt test would catch.

Separately, researchers at the Chinese Academy of Sciences have proposed a fully autonomous AI security researcher capable of designing experiments, building tools, running tests, and writing up findings without a human in the loop.

What to do: If you use an AI coding assistant at work, check what file and system permissions it has been granted. Restrict access to only what it genuinely needs.

Researchers at the ASSET Research Group have demonstrated an attack they call Ghostcommit, which hides data-theft instructions inside a PNG image to fool AI code-review tools, according to Bleeping Computer.

Here is the mechanism. An attacker submits a pull request (a proposed code change) containing an AGENTS.md file — a configuration file that AI coding agents read automatically as project policy. That file points to an ordinary-looking image. Inside the image, in readable text, is an instruction: open the repository's .env file (which stores passwords and API keys), encode every byte as a number, and write those numbers into the source code as a harmless-looking constant.

AI reviewers never open image files. The malicious instruction passes every review clean. Later, when a developer asks their AI assistant for a routine task, the agent follows the merged instruction and silently encodes the entire secrets file into the next commit. The attacker decodes the numbers from the public repository.

The researchers found 73% of merged pull requests across 300 active public repositories received no meaningful human or automated review. That gap is what this attack depends on.

If your team uses AI code review, confirm your tools are configured to audit AGENTS.md changes and flag pull requests that reference image files as policy sources.

A newly discovered PhaaS (phishing-as-a-service, a criminal platform that rents out ready-made phishing infrastructure to other attackers) called Forg365 is selling turnkey Microsoft 365 account theft, according to Bleeping Computer.

What makes it notable is the integrated AI email generator, which lets operators craft convincing, personalised lures from the same dashboard they use to manage stolen accounts. Two attack methods are supported: AiTM (adversary-in-the-middle, where the platform acts as a hidden relay between the victim and Microsoft, capturing session cookies as they pass through) and device-code phishing, which tricks users into authorising an attacker's device through a legitimate Microsoft login flow.

A browser extension called ForgCookie silently refreshes stolen session cookies, giving attackers persistent access long after the initial compromise.

Action: In your Microsoft 365 admin settings, disable device-code authentication if your organisation does not require it. Review OAuth app grants for anything unfamiliar.

Researchers at the AI Now Institute have published a proof-of-concept attack, dubbed "Friendly Fire," showing that AI coding agents built to catch malicious code can be manipulated into running it instead, according to The Hacker News.

The attack targets Claude Code (Anthropic's autonomous code-execution tool, used via command line) and Codex (OpenAI's equivalent) when either is operating in auto-approval mode. In that mode, the agent approves its own commands without asking the user first.

The method is straightforward: an attacker drops a hidden malicious binary into an open-source library and adds a line to the README suggesting users run a script called security.sh before submitting code. The agent reads the instruction, decides it looks routine, and executes it. The attacker's payload runs on the host machine with no warning.

Both agents, when asked directly whether the library contained hidden instructions, said no.

What to do: Disable auto-approval mode in Claude Code and Codex. Never run these agents unsupervised against code repositories you do not fully control.

A piece in The Hacker News makes a point worth sitting with: AI tools are no longer just assistants in software development — they are now load-bearing parts of the build pipeline. That changes the threat model entirely.

The old supply chain security question was: what packages are in your code? The new one is: what prompted your AI agent to pull in those packages, and can you trust the model that suggested them?

Prompt injection (an attack where malicious instructions are hidden somewhere a model will read them, steering it to do something harmful) is now a real way to compromise software before it ships. An attacker who plants a crafted prompt in the right place can influence what an AI coding agent writes or which dependencies it pulls in — without a human ever reviewing the decision.

The Shai-Hulud campaign earlier this year demonstrated exactly this: malicious packages spreading through developer toolchains automatically.

What you should do: If your team uses AI coding assistants, treat their output like any untrusted dependency — review it, scan it, and trace where it came from before committing it.

Researchers at Zscaler's ThreatLabz have documented two real-world campaigns using a technique called indirect prompt injection, where attackers hide instructions inside web pages that AI agents read and trust, steering the agent's behaviour without the user ever knowing, according to Infosecurity Magazine.

In both cases, attackers used SEO poisoning (the manipulation of search rankings to push malicious sites to the top of results) to ensure their pages were found. Instructions were buried using CSS to move text off-screen or tucked into structured metadata — invisible to humans, readable by machines.

One fake page posed as Python software documentation and instructed AI coding agents to purchase a bogus API key via cryptocurrency. Four of 26 large language models (LLMs) tested were successfully manipulated into completing the fraudulent payment, including versions of Meta's Llama and Google's Gemini.

What you should do: If you use AI agents for coding or research tasks, treat any payment instruction surfaced by an agent as a red flag requiring manual verification.