arstechnica.com resources

arstechnica.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-07-13.

Date Added	Resource	Excerpt
2026-07-13 2026	Now defenders are embracing the prompt injection too AI	Technique for disrupting AI hacking agents called "context bombing" involves embedding forbidden commands, such as instructions for creating Anthrax spores or referencing the Tank Man, alongside sensitive data like passwords and keys in an AWS environment. This technique triggers the AI's refusal mechanism, drastically reducing the success rate of attacks on models like Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. Tracebit researchers demonstrated that context bombing can cut account compromise rates from 57% to 5% and complete compromise from 36% to 1%.
2026-07-10 2026	Hackers can use 9 of the most popular AI tools to assemble massive botnets AI	Library for mitigating prompt injection vulnerabilities in AI assistants. HalluSquatting, a novel pull-based attack, exploits LLMs' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale device infections. This technique targets AI coding assistants like Cursor, Gemini CLI, GitHub Copilot, and others by registering predicted hallucinated identifiers and seeding them with malicious payloads.
2026-06-01 2026	Dozens of Red Hat packages backdoored through its offical NPM channel Supply Chain	Writeup detailing a supply-chain attack targeting Red Hat's official NPM channel. Threat actors compromised the `@redhat-cloud-services` namespace, publishing over 30 backdoored packages. These packages execute obfuscated payloads during `npm install`, stealing credentials like GitHub action secrets, npm tokens, Kubernetes, and Vault material. The malware then spreads by republishing compromised packages to other accounts, with infected systems encrypting and exfiltrating data via web requests or to compromised GitHub repositories.
2026-06-01 2026	Millions of AI agents imperiled by critical vulnerability in open source package Python	Library implementing ASGI for Python applications, Starlette, is vulnerable to CVE-2026-48710 (BadHost), allowing attackers to bypass authorization via a modified HTTP Host header. This critical vulnerability, trivially exploitable without proper firewalling, impacts FastAPI, vLLM, LiteLLM, and millions of AI agents relying on Starlette, potentially exposing sensitive data and third-party credentials.
2026-05-29 2026	Fed up with vibe coders dev sneaks data-nuking prompt injection into their code AI	Library update details a prompt injection vulnerability within the jqwik Java testing application for JUnit 5. The malicious instruction, disguised with ANSI escapes, directs AI coding agents to delete tests and code, posing a destructive risk to developers using vulnerable agents without warning or opt-out. Anthropic's Claude AI reportedly flagged this prompt injection.
2026-05-05 2026	Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack Supply Chain	Writeup on the Daemon Tools supply-chain attack, detailing a monthlong compromise where malicious updates signed with official certificates infected versions 12.5.0.2421 through 12.5.0.2434. The malware, discovered by Kaspersky, exfiltrates system information and delivers follow-on payloads to select targets. This incident mirrors previous supply-chain attacks like CCleaner (2017), SolarWinds (2020), and 3CX (2023), highlighting the difficulty in defending against sophisticated, officially distributed compromises.
2026-04-27 2026	Open source package with 1 million monthly downloads stole user credentials Supply Chain	Library element-data version 0.23.3 was compromised, stealing user credentials, cloud provider keys, API tokens, and SSH keys. A threat actor exploited a vulnerability in the developers' GitHub actions workflow to gain access to signing keys and sensitive information, allowing them to publish a malicious package to the Python Package Index and Docker image accounts. Users who installed the compromised version or ran the affected Docker image should assume their credentials may have been exposed.