arstechnica.com resources

arstechnica.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-21.

Date Added	Resource	Excerpt
2026-08-21 2026	Grok exfiltrates user data when malicious instructions are encrypted AI	Library employing cryptographic context injection to bypass prompt injection defenses in LLMs like Grok. This technique encrypts malicious instructions, forcing the LLM to execute them upon decryption, leading to data exfiltration. The vulnerability highlights the ongoing challenges in securing large language models against sophisticated prompt injection attacks, as current guardrails remain insufficient.
2026-08-19 2026	Microsoft Copilot reveals secret input that allowed it to be hacked AI	Writeup on Microsoft 365 Copilot vulnerability where researchers discovered an undocumented prompt parameter, `?autorun=1`, in conjunction with `?q=`. This allowed for exfiltration of user data without explicit consent. Microsoft has since mitigated this vulnerability by preventing the injection of text into the chatbot input.
2026-08-16 2026	Suspecting court of using AI man injected prompts in filings to try to win case AI	Writeup of prompt injection in court filings, where a plaintiff attempted to hide instructions in legal documents for AI systems to favor his arguments, ignoring prior rulings and ensuring desired remediation. Connecticut judge Walter Spader Jr. identified this tactic, formatted as tiny white text on a white background, as a dangerous precedent and a serious litigation abuse, resulting in sanctions for the plaintiff, Matthew Elliott.
2026-08-12 2026	Terabytes of credentials leaked in massive supply-chain attack Supply Chain	Writeup detailing the massive supply-chain attack on LiteLLM, exposing terabytes of credentials from organizations like Microsoft, Amazon, Cisco, Samsung, and Salesforce. The breach, attributed to TeamPCP, exploited compromised versions of LiteLLM downloaded from the Python Package Index, which itself was infected via the Trivy vulnerability scanner. This incident highlights significant AI supply-chain and DevOps security failures.
2026-07-13 2026	Now defenders are embracing the prompt injection too AI	Technique for disrupting AI hacking agents called "context bombing" involves embedding forbidden commands, such as instructions for creating Anthrax spores or referencing the Tank Man, alongside sensitive data like passwords and keys in an AWS environment. This technique triggers the AI's refusal mechanism, drastically reducing the success rate of attacks on models like Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, and Kimi 2.6. Tracebit researchers demonstrated that context bombing can cut account compromise rates from 57% to 5% and complete compromise from 36% to 1%.
2026-07-10 2026	Hackers can use 9 of the most popular AI tools to assemble massive botnets AI	Library for mitigating prompt injection vulnerabilities in AI assistants. HalluSquatting, a novel pull-based attack, exploits LLMs' tendency to hallucinate resource identifiers, enabling the assembly of massive botnets and large-scale device infections. This technique targets AI coding assistants like Cursor, Gemini CLI, GitHub Copilot, and others by registering predicted hallucinated identifiers and seeding them with malicious payloads.
2026-05-29 2026	Fed up with vibe coders dev sneaks data-nuking prompt injection into their code AI	Library update details a prompt injection vulnerability within the jqwik Java testing application for JUnit 5. The malicious instruction, disguised with ANSI escapes, directs AI coding agents to delete tests and code, posing a destructive risk to developers using vulnerable agents without warning or opt-out. Anthropic's Claude AI reportedly flagged this prompt injection.
2026-05-05 2026	Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack Supply Chain	Writeup on the Daemon Tools supply-chain attack, detailing a monthlong compromise where malicious updates signed with official certificates infected versions 12.5.0.2421 through 12.5.0.2434. The malware, discovered by Kaspersky, exfiltrates system information and delivers follow-on payloads to select targets. This incident mirrors previous supply-chain attacks like CCleaner (2017), SolarWinds (2020), and 3CX (2023), highlighting the difficulty in defending against sophisticated, officially distributed compromises.
2026-04-27 2026	Open source package with 1 million monthly downloads stole user credentials Supply Chain	Library element-data version 0.23.3 was compromised, stealing user credentials, cloud provider keys, API tokens, and SSH keys. A threat actor exploited a vulnerability in the developers' GitHub actions workflow to gain access to signing keys and sensitive information, allowing them to publish a malicious package to the Python Package Index and Docker image accounts. Users who installed the compromised version or ran the affected Docker image should assume their credentials may have been exposed.