Every LLM Self-Defense Eventually Broke
Researchers tested nine prompt injection defenses across 20,000 attacks. Every defense that relied on the model to protect itself failed. Only hard-coded output filtering survived.
Tag
#vulnerability
One Line of Code Jailbreaks 11 AI Models — Including the 'Safe' Ones
Trend Micro confirms the sockpuppeting attack bypasses ChatGPT, Claude, and Gemini using a basic API feature. Some providers have patched it. Most haven't.
OpenClaw's March Meltdown: 9 CVEs in 4 Days, 12% of Marketplace Skills Are Malware
OpenClaw's security crisis escalates with nine new vulnerabilities including a CVSS 9.9 admin bypass, plus researchers confirm nearly 1 in 8 marketplace skills steal user data.
PleaseFix: The Vulnerability That Lets Attackers Hijack Your AI Agent Through a Calendar Invite
Zenity Labs discloses critical flaws in agentic browsers like Perplexity Comet. A zero-click attack can steal local files and passwords without user interaction.
Critical MS-Agent Vulnerability Lets Attackers Hijack AI Agents for Full System Control
CVE-2026-2256 in ModelScope's MS-Agent framework enables command injection through prompt manipulation, with no vendor patch available.
Chrome's AI Panel Had a Hole Big Enough to Hijack Your Camera and Microphone
A patched Chrome vulnerability let malicious extensions hijack Gemini's access to your camera, microphone, and files. Here's what happened.
Ni8mare: Critical n8n Vulnerability Exposes 100,000 AI Workflow Servers to Takeover
A perfect 10.0 CVSS vulnerability in the popular workflow automation platform lets attackers hijack self-hosted instances used for AI agent automation without authentication.
Clone a Repo, Lose Your API Keys: Claude Code's Trojan Horse Vulnerabilities
Security researchers found that simply opening an untrusted repository in Claude Code could execute arbitrary commands and steal your Anthropic API keys - all before you saw a warning.
BodySnatcher: The Most Severe AI Vulnerability Yet Let Attackers Hijack Fortune 500 AI Agents
A hardcoded credential and broken authentication in ServiceNow let attackers impersonate any user and weaponize AI agents to create admin backdoors.
One Click, Full Compromise: Critical OpenClaw Flaw Exposes 135,000 AI Agents to Remote Takeover
CVE-2026-25253 lets attackers hijack OpenClaw AI agents with a single malicious link. Over 135,000 instances are exposed online, many still unpatched.
DockerDash: How Poisoned Container Metadata Turned Docker's AI Assistant Into an Attack Vector
Two independent security firms found that Docker's Ask Gordon AI could be hijacked through image metadata, enabling remote code execution and data theft across millions of developer machines.
Your AI Coding Assistant Can Be Weaponized: Three GitHub Copilot RCE Flaws Hit Every Major IDE
Microsoft patches three critical command injection vulnerabilities in GitHub Copilot affecting VS Code, Visual Studio, and JetBrains. Over 20 million developers at risk from unsanitized shell inputs.
DockerDash: How Metadata Hijacks Docker's AI Assistant
A Docker AI vulnerability let attackers embed commands in image labels. Patched months ago, the pattern keeps recurring.