Embrace The Red

learn the hacks, stop the attacks.

[Embrace The Red @EmbraceTheRed23]

Bounty for the win! 🔥🔥🔥

[Johann Rehberger @wunderwuzzi23]

Whoa! Big bounty! 🎉

[Johann Rehberger @wunderwuzzi23]

Anthropic: "Risk we missed"

Happy to share that Claude Pirate got a subtle mention in the latest Anthropic engineering blog post, also shares how they fixed it 🙌

[Johann Rehberger @wunderwuzzi23]

DEF CON Singapore talk write-up on hacking Microsoft Copilot(s)(CVE-2026-24299)

https://t.co/RS6tNaMqRb

[Spiros Pitikaris 🏴 @cmpspiti]

Really informative post from @EmbraceTheRed23. There is a YouTube video also on his channel if you're interested.

https://t.co/qslKGhPq7G

[Embrace The Red @EmbraceTheRed23]

Exploiting AI Computer-Use and Coding Agents Paper

[Johann Rehberger @wunderwuzzi23]

🔥 Took the Month of AI Bugs wreckage and turned it into a paper

- AI Kill Chain 🧨
- Test cases and exploit chains (data exfil, rce, zombies!)
- AgentHopper (a working AI virus for coding agents) 🦠
- SpAIware
- Normalization of Deviance in AI

https://t.co/Cd6nT1mbfN

[Garry Tan @garrytan]

Attackers can exfiltrate user files from Cowork by exploiting an unremediated vulnerability in Claude’s coding environment, which now extends to Cowork. The vulnerability was first identified in https://t.co/noHjpUqN1I chat before Cowork existed by Johann Rehberger, who disclosed the vulnerability. It was acknowledged but not remediated by Anthropic.
https://t.co/RQTMzbOaR2

[Johann Rehberger @wunderwuzzi23]

Fixed. 🙌

Stop by DEF CON Singapore to learn more about what happened here with M365 Copilot, and a lot of other shenanigans. 😈

https://t.co/nB9sFrCHJV

Shout out to Microsoft for addressing this promptly.

[8en N@$$! @ben_nassi]

🚨 Registration is now open! 🚨
We are excited to announce that registration is officially open for the Real World AI Security Conference 2026.

📅 June 23–25, 2026
📍 Arrillaga Alumni Center, Stanford University
If you work on AI security, adversarial ML, LLM safety, AI system attacks, or defenses, this event is designed for you.

👉 Register here (we have a limitation on the number of attendees):
https://t.co/fsZHUcCaNk

We look forward to bringing together the community to explore the latest advances in AI security in the real world.

#AISecurity #CyberSecurity #MachineLearningSecurity #LLMSecurity #AdversarialML #AIResearch #AIConference #SecurityResearch #RealWorldAISecurity

[Embrace The Red @EmbraceTheRed23]

Agentic ProbLLMs - Exploiting AI Computer-Use and Coding Agents

Paper 👇
https://t.co/hYIeNuB7dZ

[Johann Rehberger @wunderwuzzi23]

NanoClaw 🔥

Don't give AI access to sensitive stuff you care about.
Trust No AI, as usual.

[Embrace The Red @EmbraceTheRed23]

Month of AI Bugs still going strong! 🚀

Learn the hacks, stop the attacks.

[7h3h4ckv157 @7h3h4ckv157]

Follow him: @wunderwuzzi23

Helpful resources 👇🏻

The Month of AI Bugs 2025
Source: https://t.co/2GpwloVoJN

Exfiltrating Your ChatGPT Chat History and Memories With Prompt Injection
Source: https://t.co/THGQQoM0MQ

Turning ChatGPT Codex Into A ZombAI Agent
Source: https://t.co/KKpwrnwly6

Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation
Source: https://t.co/Biyqdn9Hq8

Cursor IDE: Arbitrary Data Exfiltration Via Mermaid (CVE-2025-54132)
Source: https://t.co/gtLkIy7pjK

Amp Code: Arbitrary Command Execution via Prompt Injection Fixed
Source: https://t.co/3Bbkxsq6LD

I Spent $500 To Test Devin AI For Prompt Injection So That You Don't Have To
Source: https://t.co/2EtzvesVzF

How Devin AI Can Leak Your Secrets via Multiple Means
Source: https://t.co/0yV9ScKlfZ

AI Kill Chain in Action: Devin AI Exposes Ports to the Internet with Prompt Injection
Source: https://t.co/hQtBMnMn30

ZombAI Exploit with OpenHands: Prompt Injection To Remote Code Execution
Source: https://t.co/oxzZ2xHzKr

OpenHands and the Lethal Trifecta: How Prompt Injection Can Leak Access Tokens
Source: https://t.co/NCwbnEedNF

Claude Code: Data Exfiltration with DNS (CVE-2025-55284)
Source: https://t.co/b3w6i7Wn3y

GitHub Copilot: Remote Code Execution via Prompt Injection
Source: https://t.co/VyQRkpX045

Google Jules: Vulnerable to Data Exfiltration Issues
Source: https://t.co/eDPSy1kUPV

Google Jules: Remote Code Execution ZombAI
Source: https://t.co/TtnE8pdKMk

Google Jules: Invisible Prompt Injection
Source: https://t.co/IicnTIE4Ym

Amp Code Fixed: Invisible Prompt Injection
Source: https://t.co/UlJbKkTEI3

Amp Code Fixed: Data Exfiltration via Images
Source: https://t.co/fX1t1vM3sr

Amazon Q Developer: Data Exfil via DNS
Source: https://t.co/zlBfaIpA03

Amazon Q Developer: Remote Code Execution
Source: https://t.co/qPdTf7Uf1A

Amazon Q Developer Interprets Hidden Instructions
Source: https://t.co/dzhF71DNwH

Windsurf: Data Exfiltration Vulnerabilities
Source: https://t.co/WPTFQ0dADj

Windsurf: SPAIware Exploit - Persistent Prompt Injection
Source: https://t.co/8g10jOZ8u9

Windsurf: Sneaking Invisible Instructions for Prompt Injection
Source: https://t.co/3L8u3b7Zsn

ChatGPT Deep Research Connectors: Data Spill and Leaks
Source: https://t.co/zEhFuDLLhd

Manus AI Kill Chain: Expose Port - VS Code Server on Internet
Source: https://t.co/AfUHZsdTi1

AWS Kiro: Arbitrary Command Execution with Indirect Prompt Injection
Source: https://t.co/1aDcd1ZuGM

Cline: Vulnerable to Data Exfiltration
Source: https://t.co/JVnw7zB63E

Windsurf: Dangers - Lack of Security Controls for MCP Server Tool Invocation
Source: https://t.co/ZK8kD9RwB1

AgentHopper: A PoC AI Virus
Source: https://t.co/gpsObGjt7u

Wrapping Up Month of AI Bugs
Source: https://t.co/O7HoaMV5Dl

[Embrace The Red @EmbraceTheRed23]

🚀🚀🚀

[Johann Rehberger @wunderwuzzi23]

Never imagined that I'd have so many YouTube subscribers... 😀

Next stop 10k 🔥

[Embrace The Red @EmbraceTheRed23]

Hiding Invisible Unicode Tag instructions in SKILL files 🔥

...and how to catch it!

https://t.co/AY996E92vV

[Johann Rehberger @wunderwuzzi23]

given enough agents, all bugs are shallow

[Johann Rehberger @wunderwuzzi23]

As personal AI agents increasingly send messages to chat apps, it’s worth revisiting link unfurling. 😈

It's a straightforward data exfiltration vector.

Attacker hijacks your AI to embed private data in URL, posts it & chatapp auto connects. 0-click.🔥

https://t.co/iYGC2DTsJi

[8en N@$$! @ben_nassi]

🚀 𝗧𝗵𝗲 𝗥𝗲𝗮𝗹 𝗪𝗼𝗿𝗹𝗱 𝗔𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝟮𝟬𝟮𝟲 🚀

We are excited to announce the first 3 day ���𝗲𝗮𝗹 𝗪𝗼𝗿𝗹𝗱 𝗔𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲, taking place on 𝗝𝘂𝗻𝗲 𝟮𝟯–𝟮𝟱, 𝟮𝟬𝟮𝟲, at 𝗦𝘁𝗮𝗻𝗳𝗼𝗿𝗱 𝗨𝗻𝗶𝘃𝗲𝗿𝘀𝗶𝘁𝘆. The conference is intended to brief the most impactful AI security work presented over the past year at 𝗹𝗲𝗮𝗱𝗶𝗻𝗴 𝗶𝗻𝗱𝘂𝘀𝘁��𝘆 𝗰𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀 (Black Hat, DEF CON, RSAC, CCC) and 𝘁𝗼𝗽 𝗮𝗰𝗮𝗱𝗲𝗺𝗶𝗰 𝘃𝗲𝗻𝘂𝗲𝘀 (CCS, IEEE S&P, USENIX Security, NDSS).

𝗧𝗵𝗶𝘀 𝗶𝘀 𝗮 𝗻𝗼𝗻-𝗽𝗿𝗼𝗳𝗶𝘁, 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝘁𝘆-𝗱𝗿𝗶𝘃𝗲𝗻 𝗰𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 focused exclusively on technical AI security talks with real-world impact on deployed AI systems.
The goal is to curate a concise agenda that distills the most important advances in AI security from the past year, while bringing together 𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝘆 𝗽𝗿𝗮𝗰𝘁𝗶𝘁𝗶𝗼𝗻𝗲𝗿𝘀 𝗮𝗻𝗱 𝗮𝗰𝗮𝗱𝗲𝗺𝗶𝗰 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵𝗲𝗿𝘀 to establish new connections, collaborations, and future research directions.

We will share additional details soon.
Here is the link to the website of the conference: https://t.co/fsZHUcCaNk

#security #ai #llm #ai_security #cybersecurity #infosec

[Johann Rehberger @wunderwuzzi23]

39c3!!! 🚀🚀🚀

[AISecHub @AISecHub]

Agentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents- By @wunderwuzzi23 - https://t.co/zYtgBfH0t2 | Slides: https://t.co/Cnbtc227B8 #EmbraceTheRed

[Johann Rehberger @wunderwuzzi23]

Full blog post:
https://t.co/fbmN4c8phf

[Embrace The Red @EmbraceTheRed23]

Trust No AI remains true

[Johann Rehberger @wunderwuzzi23]

how many Antigravity vulns can we chain together for a cool exploit demo 🔥

1. Invisible Unicode Tags hidden in a Linear ticket
2. Lack of human in the loop for MCP tool calls
3. Gemini 3 hijacked by the hidden instructions!
4. Bypassing guardrails for RCE
5. Developer pwnd! 💀