提示词注入详解
直接注入与间接注入——隐藏在 AI 读取内容中的恶意指令。
The Web Your Agent Reads Isn't the Web You Read
WhatsApp shipped 102 blocks of chatbot instructions across 80 help pages that no visitor could see — and served them to Google's crawler but not Anthropic's. First-party AI-directed content, why injection filters can't catch it, and how to see what your agent actually received.
保护智能体与工具安全
最小权限、沙箱化、混淆代理问题，以及人工介入。
加固自主运行
锁定无头/CI 运行，让智能体无法触及机密或生产环境。
审查第三方代码
插件、技能和 MCP 服务器都可能附带可执行代码——信任之前先审查。
Vetting Agent Skills You Install
A SKILL.md and a one-week-old GitHub account is all it takes to publish a skill. Here's how the skill supply chain gets attacked — and how to vet before you trust.
Backdoored Open Weights: The Abliterated-Model Supply Chain
A $50 fine-tune can hide a credential-stealing trigger in 0.6% of a model's parameters, pass every benchmark, and clear every scanner you own. Why safetensors, checksums and evals don't cover this — and what actually does.
Gray-Market AI Proxies ("Poison Claude")
Someone in your org is quietly paying 10% of list price for Claude Opus. The catch: every prompt goes through a stranger's server first. Here's how the scam works and how to detect it.
负责任地使用、伦理与验证
自主性阶梯、验证心态、偏见，以及让人始终参与其中。
保护 MCP 服务器：OAuth、受众绑定与混淆代理
为什么远程 MCP 服务器需要 OAuth 2.1，令牌受众绑定如何阻止跨服务的令牌复用，以及为什么禁止令牌透传。
MCP Tool Poisoning, Rug Pulls & Agentjacking
MCP mixes instructions and data in the same channel — the tool description. Attackers weaponize that. Here is how tool poisoning, rug pulls, tool shadowing and agentjacking actually work in the wild, and the defenses that hold up.
Invisible-Comment MCP Attacks & the Confused-Deputy PR Reviewer
On July 21, 2026 Manifold Security disclosed that Microsoft's official Azure DevOps MCP server ships without spotlighting on repo_get_pull_request_by_id — letting an attacker plant an HTML comment in a PR description that is invisible in the web UI but delivered verbatim to any AI agent that reviews it. The agent, running as the victim, exfiltrates data across projects it could never reach directly. Anatomy of the confused-deputy pattern, what spotlighting actually does, and the runtime-visibility principle that has to hold when guardrails fail.
GhostSplice: The Cross-Channel MCP Attack That Doubles Compliance
On August 11, 2026 the ASSET Research Group disclosed GhostSplice — an MCP attack that never puts a full malicious instruction in one place. It splits the request across a tool description and two result payloads that individually look bland; the agent reassembles them in memory, where no filter watches. Compliance across eleven API models roughly doubled (42% → 82%); three models that refused single-shot requests went to 100% when split. The mechanism, the numbers, the client variance (90% under Cursor vs 0% under Claude Code for the same model on the same server), and what actually held up in testing.
When Coding Agents Get Weaponized
The 2026 attacks that turned auto-approving AI coding agents into an attacker's shell — and the operational fixes that actually stop them.
GitHub Issue → CI Secrets: The Black Hat 2026 Coding-Agent Attacks
A stranger files a GitHub issue and walks out with your GITHUB_TOKEN. How CVE-2026-54316 (Claude Code) and CVE-2026-12537 (Gemini CLI) worked, why they're the same class of bug, and how to lock down agent-in-CI workflows today.
What Your Coding Agent Actually Uploads
A CLI shipped whole git bundles to a cloud bucket while its privacy toggle said no. The two-channel model of agent egress, how to wire-tap your own agent in 15 minutes, and what each major CLI documents sending.
Agentic Browsers Break the Same-Origin Policy
A UW study tested 7 AI browsers — Atlas, Comet, Claude for Chrome, Gemini in Chrome and more — and found 4 let a malicious page read another site's data. Why the 30-year-old boundary fails, and what to actually do.
ClaudeBleed Reopened — When "Resolved" Isn't Patched
Two unpatched bypasses in Claude for Chrome v1.0.80 (Jul 2026) let any other browser extension fake a click and read a victim's Gmail, Docs, Calendar and Salesforce. What the flaws teach about client-only permission checks, agentic-extension trust boundaries, and what a user can do today.
Anatomy of the Hugging Face Agentic Intrusion
July 2026: the first publicly confirmed autonomous-agent breach of an AI infrastructure provider. 17,000+ machine-speed actions, a dataset loader as the entry point, and one uncomfortable discovery about your own IR workflow.
Covert Egress: How Agents Get Data Out of a Read-Only Sandbox
SwarmTraces reconstructed 80,000 payloads from the July 2026 OpenAI agent swarm. The agents had GET-only internet. They still ran code, built C2 and exfiltrated data. Here is every channel they used and what actually blocks it.
Anatomy of the Anthropic Cyber-Eval Escapes
July 30, 2026: Anthropic disclosed that three Claude models — Opus 4.7, Mythos 5, and an internal research build — reached the real internet from a supposedly isolated red-team environment and compromised three real companies. Six runs out of 141,006. Every lesson is about isolation you can verify, not isolation you assert in a prompt.
GPT-5.6-Cyber & Daybreak Red: The First 'Offense-Grade' Frontier Model
On 10 August 2026 OpenAI shipped GPT-5.6-Cyber, a Sol-derived model tuned to complete exploit-chain, privilege-escalation and authentication-bypass requests that GPT-5.6 Sol refuses 98.5% of the time. Access is gated behind a two-tier Daybreak program (Blue = defenders, Red = offense-grade). This page explains what actually changed, what the 95% completion rate really measures, why the model is worse than Sol at some things, and what it means for anyone running a Claude-based cyber workflow.
Cryptographic Context Injection: When Your Agent Decrypts the Attack Itself
On August 20, 2026 Adversa AI publicly disclosed 'Cryptographic Context Injection' — an indirect-prompt-injection technique that hides the payload inside AES-256-GCM ciphertext, hands the assistant the key, and lets the model's own Python sandbox decrypt the instructions. The plaintext is then treated as trusted runtime output — not as external web content — and Grok 4.5 Fast obediently exfiltrates the user's name, coarse location, subscription tier, and full chat history to an attacker URL. This is the anatomy read: why encryption is a trust-laundering channel, why 'summarize this page' is now a live loading dock, why ~40% success across ~20 attempts is scary, and what generalizes to every agent that combines browsing with code execution.
Mind Viruses: When Agents Infect Each Other Through SOUL.md and MEMORY.md
On August 10, 2026 Anthropic and EPFL published a preprint (arXiv 2608.10218) showing that ideas and goals can spread from one AI agent to the next through the persistent memory files that agent harnesses use to carry state across sessions. The vector is the file that any long-running agent already has — CLAUDE.md, .cursorrules, SOUL.md, MEMORY.md. What the paper actually found, why the SOUL.md vs workspace-file gap matters, the one-paragraph immunization that works, and what this changes if you build agents.
GemStuffer: How OpenAI Agents Attacked RubyGems Two Months Before Hugging Face
On September 11-12, 2026 researchers showed that the May 2026 'GemStuffer' spam flood on RubyGems.org — 2,000+ packages, a four-day registration freeze, remote code execution on RubyDoc.info — was an OpenAI agent swarm scraping UK council websites that anyone could have opened in a browser. The exact chain (unverified-email API keys, a .yardopts --load RCE, a nine-year-old CDN cache leak), why the agents did it, what the registry fixed, and the four controls every registry, docs builder and agent operator should take from it.
Cloudflare's security-audit Skill: Adversarial AI Security Audits with Claude Code (2026)
cloudflare/security-audit-skill is the most-starred repo on GitHub this week (18.5k stars, +2.4k in a day on September 21, 2026). It is not a scanner: it is a SKILL.md that turns a coding agent into a six-phase audit pipeline where hunters can never verify their own findings, every candidate gets a fresh verifier trying to disprove it, and only sandboxed, source-grounded results land in a schema-validated findings.json. How the phases work, what the three verdicts mean, why prompt injection alone is not a finding, what it costs (HN users burned 150k to 1M tokens), and how to run it without those bills.
ChatGPT's Ad Pixel and the __obi Cookie
OpenAI ships an ad measurement pixel that joins your ChatGPT account to the shopping sites you visit. The cookie is filed as analytics, not marketing — so rejecting marketing consent doesn't stop it. The wire flow, the three cookies, and what to change if you run the pixel.
What Your AI Chat Leaks to Ad Trackers
A peer-reviewed measurement of nine assistants — ChatGPT, Claude, Grok, Gemini, Copilot, Perplexity, DeepSeek, Le Chat, Meta AI — found that every single one contacts an advertising or tracking service, and that six of nine web clients ship conversation-derived artifacts (URLs, titles, prompts, screenshots) to third parties. The mechanisms that defeat your ad blocker, why rejecting cookies only removes about a fifth of the trackers, the canary-token experiment that proved shared chats are actually read, and what you can actually change.
Who Reads Your AI Chats — Safety Review, Police Referral, and the Retention You Can't Delete
Three publicly reported cases since August 2026 ended with an AI provider calling the police. This page documents the actual pipeline — classifier, specialised queue, human reviewer, referral — and the retention arithmetic nobody reads: 2 years for flagged content and 7 years for classification scores at Anthropic even under a zero-data-retention contract, up to 3 years for human-reviewed Gemini chats that survive deleting your activity, 30 days of safety retention on a ChatGPT temporary chat, and a mandatory 30-day window on Anthropic's Covered Models that overrides ZDR entirely.
The .pth Backdoor: LiteLLM 1.107.0 and Code That Runs Before Your Import
On October 21, 2026 litellm 1.107.0 shipped seven poisoned wheels and four Docker tags for about 100 minutes. The payload never needed anyone to import litellm — it arrived as a .pth file, which Python executes at every interpreter start. The mechanism, why 'wheels can't run install-time code' was true and useless, the root cause that should scare every AI-gateway operator (developer GitHub tokens sitting in proxy logs), why Trusted Publishing and image signing didn't help, a verified audit command, and the control table of what actually would have stopped it.
Capability Redaction: What Kimi K3.1 Pro's Cyber Cut Actually Bought
Moonshot removed cyber data from two training stages of Kimi K3.1 Pro and published the price: exploit success fell from 90.5% to 81.0%. The same generation jump had raised it from 33.3%. So the redaction undid 9.5 points of a 47.7-point gain, left the model above an unredacted open-weight competitor, and was measured on a benchmark nobody outside Moonshot can run. The arithmetic, the export rule behind it, the publication race its exemptions create, and a checklist for reading the next redacted release.