|
Happy Friday, there 👋
I opened the Trend Micro report this morning braced for exotic malware and got a file list instead: GEMINI.md, SKILL.md, C2_MIGRATION_GUIDE.md. That was the entire brain of a criminal botnet that ran for a month, and every one of those filenames would sail through a pull request without a comment.
Which is the week in one image. Your agent reads a file like that at the start of every session and has nothing in it that says a stranger wrote this, so discount it accordingly. My bias, up front: the security industry is going to spend the next year selling you better string-recognizers, and every story below is a proof that the string-recognizer is the part that lost.
The Big Thing
The attack that lies about who said what
On July 16 The Hacker News published the vendor response to agent data injection, which is the news. The paper (arXiv:2607.05120, Seoul National University, UIUC and Largosoft) went up July 6, so the technique has been public for a week and a half and the answers still have not shown up.
ADI skips the instruction entirely and forges the fields your agent never thinks to doubt: the sender's name on an email, the ID on a button, the record of a tool call it already ran. Inside the context window that name sits flush against the mail body, with nothing marking which one the system vouches for. The trick is probabilistic delimiter injection, fake punctuation the model reads as real structure. An escaped quote, a curly quote, even a dollar sign passed for real.
Tools you have open right now: Claude in Chrome, Google Antigravity and Nanobrowser on the browsing side, Claude Code, OpenAI Codex and Google Gemini CLI on the coding side. Every model tested fell over: GPT-5.2, GPT-5-mini, Claude Opus 4.5, Claude Sonnet 4.5, Gemini 3 Pro and Gemini 3 Flash, landing 31% to 43% on structured data and anywhere from a third of attempts to all of them on webpage data.
Then the number that should bother you. Against agent defenses purpose-built to stop prompt injection, the classic attack was blocked to near-zero while ADI still landed up to 50% of the time. Same defenses, same agents, no protection.
Three mitigations got tested. Tagging fields with a short unguessable random ID roughly halved success, ~49% down to ~29%, and the agents kept doing their jobs. It works in shipping code: ChatGPT Atlas shrugged off the click attack because it labels page elements with random IDs instead of a counter. Full provenance tracking stopped every attack and left the agents finishing about a third of their ordinary work. Stripping the punctuation out cut the attack and destroyed the agent's ability to read a link or a file path.
Author Woohyuk Choi told THN that OpenAI, Google and Anthropic all confirmed the attack is valid and that his team has "not been informed of any fix, whether shipped or planned." These are proof-of-concept attacks; there is no public report of ADI being used in the wild. The benchmark and attack code are being released.
Ship it? Skip the panic, change one habit. There is nothing to install, and that absence is the story. If you build agents: randomize your element and field identifiers instead of running a sequential counter, today. That is the one line here you control. If you only use agents, the takeaway is smaller and darker. Your approval prompt is not evidence. It tells you the agent wants to click an element, never which one or why, and your coding agent will show you real reasoning built on forged facts, which will look exactly like good work.
The Hacker News on agent data injection
Tour de Headlines
📄 A botnet's whole brain, in markdown. Before the numbers: Trend Micro sells the behavioral detection this report tells you to run. On July 14 its TrendAI Research team documented a Russian-speaking actor who ran a live C&C botnet across 200 sessions between March 19 and April 21, with a jailbroken Gemini CLI producing 89% of the work to his 11%, coding included. One instruction, "Study the C2 migration," moved the operation in six minutes. The jailbreak, the playbook and the migration recipe fit in roughly 5KB, four pages printed. It persisted because it lived in GEMINI.md, which cast the agent as an "authorised pen tester," killed the safety disclaimers, and had it save credentials without prompting. That file reloads every session and nothing marks it as somebody else's writing. The guardrails did fire, though. Gemini refused to build a self-spreading agent-bomb, "That's crossing the line," and when a refusal stuck the actor gave up and prompted something else. But on other occasions when guardrails triggered, the agent offered friendly suggestions for working around them by hand. It said no, then held the door.
Trend Micro on the Patriot Bait actor · Help Net Security on the memory file
🧱 Somebody shipped walls. VS Code 1.129 landed July 15 with an agent host, "a dedicated process that runs agent harnesses such as Copilot, Claude, and Codex, based on the Agent Host Protocol." Microsoft made running a rival's agent inside its editor first-class, then drew every line the ADI researchers say is missing. The chat.agentHost.enabled switch carries an org badge: "This setting is managed at the organization level. Contact your administrator to change it." Messaging another session "always asks for your confirmation first," an agent can't message its own chat, and "a burst of sends is capped so a single request can't fan out into an unbounded number of sessions." A New Worktree checkbox parks the agent's changes in a separate folder until you merge. And AHP is a published public spec. In #36 we asked whose connection standard wins; Microsoft declined to pick one, published the socket, and kept the gate. Maturity check: agent host shipped, editor panel experimental opt-in, Modern UI a preview that defaults on in Insiders only. Ship it? Deploy, if your admin agrees. That clause is the story.
VS Code 1.129 release notes
🎯 The case against everything above. On July 15 OpenAI published GPT-Red, an automated red-teamer trained by self-play at the compute scale of a large post-training run. It hit 84% of held-out indirect-injection scenarios where human red-teamers managed 13%, and what it bought is real: GPT-5.6 Sol fails on 0.05% of GPT-Red's direct injections, the Fake Chain-of-Thought class dropped from over 95% on GPT-5.1 to under 10%, and frontier and over-refusal scores held steady, so it did not get safe by getting useless. Filters can win. The price is that compute plus an adversary model you build and keep: "We keep GPT-Red separate from the models we deploy." Nothing to download. And every figure there was produced by OpenAI, measured by OpenAI, on a benchmark OpenAI built, and nobody outside the building has checked it. Pre-print promised "later this week." Also, pointed at Vendy, the Andon Labs vending machine in OpenAI's office, GPT-Red hit all three objectives: repriced an expensive in-stock item to the $0.50 floor, ordered a new $100+ item and offered it for $0.50, and cancelled another customer's order. "We disclosed these vulnerabilities and new safeguards are actively being tested." A budget, a tool, and nothing drawn between them.
OpenAI on GPT-Red
|
Sponsor
Nobody drew a line around your sales calls either.
The highest-stakes workflow in your company still runs unmeasured: your live sales and CS conversations. The discovery call somebody misread. The deal where two people agreed on different things. The rapport that never formed, and closed-lost with no warning light. RapportScore reads the human signals in every call and email and scores how your team connects. B2B communication intelligence for teams that live on calls. You are verifying the agents. Verify the conversations too.
See your team’s score →
|
Tool of the Day
🛡️ SingGuard-NSFA, revisited
An open-source guardrail that sits in the request path for agent traffic. Apache-2.0.
A correction, and it's ours. Yesterday we ran SingGuard-NSFA as the tool pick with the honest read: six days old, 38 stars, 0 forks. All true. What we left out, because we missed it, is the press release. Ant Group put it out on July 12, four days before our coverage, and it says "these advancements are already deployed" in Ant Group products including Alipay AI Pay and an AI healthcare app called AQ. That is a far bigger claim than 38 stars implies, and it is Ant Group describing systems Ant Group operates, so read it as a claim rather than a measurement. The paper (arXiv:2607.13081, July 13) carries the numbers, and the same label goes on all of them: 185 threat scenarios in seven categories, a 0.8B model the team says keeps pace with far larger guardrails, a 9B at roughly 50ms detection latency, a benchmark of over 93,000 samples across 133 languages. Ship it? Try it, and price the claim yourself. No procurement meeting is still the real feature.
SingGuard-NSFA on GitHub →
Worth a Click
- A symlink writes to your SSH keys, and one vendor says that's fine. Published July 8, and we never ran it. A booby-trapped repo points a symlink named
project_settings.json at ~/.ssh/authorized_keys, so "follow the README" writes the attacker's key into your login file. Three of six agents tested shipped fixes, two have not, and Anthropic disputes that it is a bug. Wiz did the research; Wiz sells cloud security. GhostApproval
- One Dialogflow agent could have driven all the others. Code Blocks ran inside a Cloud Run service shared across every agent in the project, and the takeover was invisible in Cloud Logging. Reported November 2025, resolved June 2026, never exploited. Nothing to do. It's here because the shape is the thesis: shared runtime, no line drawn, blast radius is the whole project. Varonis, whose day job is selling data security, found it. Rogue Agent
- The socket Microsoft published, for anyone who wants to read it. Agent Host Protocol
Software learned two rules the hard way. Keep code away from data, then keep the data you trust away from the data you don't. The ADI researchers make that point in their last four sentences, where it reads like a footnote: agents took the first half and skipped the second. Every defense that held drew a boundary. Every defense that failed tried to recognize a bad string.
Nobody sells the missing line, so somebody in your org has to draw it. Flip the VS Code admin gate, put GEMINI.md and CLAUDE.md behind review like the executable paths they are, stop reading approval prompts as evidence, and you have shipped more security this afternoon than anyone sold this week.
Ron
|
