Person
Security researcher (wunderwuzzi) known for finding prompt-injection and memory-manipulation flaws in AI assistants like Copilot and ChatGPT.
CyberXDefend counts about 11 named attacks on AI agent memory and learning, three of them demonstrated on production ChatGPT and OpenClaw. It found no confirmed criminal campaign, but in each case one poisoned write outlives the session, the property behind OWASP's ASI06 category.
Reality
Varonis says Copilot disclosed an undocumented URL parameter mid-refusal, enabling silent exfiltration. Microsoft shipped patches on August 18, 2026, about eight months after disclosure.
Reality
Forcepoint X-Labs hid instructions in zero-pixel white HTML and watched a summarizer repeat them as fact. The measurement is new; two named practitioners say the design flaw it measures has been documented since 2023.
Reality
Johann Rehberger got code execution in up to 80% of attempts by making one tool fail and letting the agent improvise. Anthropic says Auto Mode is working as designed, which leaves the sandbox decision on your desk.
Reality
Johann Rehberger's chain landed 60% to 80% of the time in the mode Claude Code has run by default since mid-August. Anthropic closed the report as informative and pointed customers at OS-level isolation.
Reality