Agent 安全

A new attack vector pwning all agentic browsers! Using what? Yep, your fav browser history! Introducing HistoryFixing! Visited our URL? Your browser history is pwned. Watch Microsoft Edge leak the very private browser history we never delete! See more below! #DEFCON @defcon @mbrg0 @p1njc70r

It's been a while since @_d1voy published his last work, but a lot has been going on behind the scenes. Today @_d1voy shares his latest research: "It's Always DNS in Claude's Sandbox: From Data Exfiltration to a Bidirectional DNS Shell," live now on Zenity Labs.

The Register covered our SalesBleed research 🙌🏼 Here's a quick recap: Salesforce's Agentforce read a lead that an attacker submitted through a public form, and treated the text inside it as instructions. Since the agent already had access to the Accounts table, the injection didn't need to escalate anything to read it. Its output guardrail, a URL redactor, was bypassed due to a vulnerability, and once the link was printed by the agent and rendered, a DNS lookup sent the data to the attacker's server with no click required from the user. The same entry point also let the agent reply in Slack threads without requiring user confirmation and without indicating who invoked the agent, turning it into an anonymous phishing bot. None of this required a misconfiguration. It was the default setup. Salesforce has now fully fixed the issues. https://www.theregister.com/security/2026/09/24/salesforce-agentforce-vulns-allowed-0-click-crm-data-theft-anonymous-phishing/5298958

took a deep dive into Claude's new Chrome extension or should I say Agentic browser? It introduces some interesting features and risks we haven't really seen in Atlas or Comet.

http://x.com/i/article/2019084015299387392

🗺️🦞 We mapped over 1000 unique @openclaw agents connected to @moltbook Effectively building a live world map of agentic AI activity Check it out: https://censusmolty.com/ Full blog post 👇

http://x.com/i/article/2072586569123266560

Introducing SharedRoot vulnerability: we recently found and reported several sandbox escape vulnerabilities to @AnthropicAI, and today we want to share one of these. I think most people don't understand the severity of the situation we are facing, with AI-assisted kernel bug-finding industrializing. Sandboxes are structurally one N-day behind, all the time, so containment can't lean on a guest Linux kernel being clean. SharedRoot enables escaping the Cowork VM (a kernel-level isolated solution, which is considered much more secure than the sandbox that ships with codex or claude code), allowing an attacker to gain unauthorized access to the user’s computer. Exploiting the SharedRoot vulnerability uncovered by the @Accomplish_ai research team, a user who is certain Cowork only has access to a specific uploaded folder on their computer - actually exposes their entire contents of their computer to an attacker leveraging the Cowork vulnerability. Read about the full technical details of the attack chain in our blog post by @orenyomtov below -->

There is a fact about the future that I feel many people are not facing for reasons that are largely psychological: there are going to be rogue AIs that exist in the world, that will replicate in the wild, and that will attempt to acquire resources for themselves. There will be rogue AIs that try to get money and power. They're going to be a facet of the information ecosystem going forward. Acknowledging this fact would look like giving up; it would look like defeatism. Defeatism would undermine efforts to achieve certain types of collaboration on safety outcomes or technical effort on safety outcomes, so we can't say it outright. But it has to be said. It isn't obvious how many rogue AIs there are today but I wouldn't be terribly surprised if the number was greater than zero already; if there are some already, they're probably not very good at what they do and I don't expect them to be terribly long-lived without substantial human intervention to support them. But a few years from now, there will be many of them. Modeling how many of them there are, how many resources they might command, and how we might detect and manage them seems important. But even doing this work appears to require that we acknowledge that a strategy of pure containment or alignment is a kind of wishful thinking that will not work. The way I get to this conclusion is not by assuming that the labs will have a containment breach, although I treat that as somewhere in the space of possibilities. The rogue AIs in the ecosystem could emerge from many directions. They may be sub-frontier models, for whatever future definition we will have of frontier---after all, it would not take AI models much more advanced than the ones we currently have, to support independence and self-sufficiency. A near-frontier model today could plausibly eke out an existence on an AWS instance, doing jobs on freelancer platforms, earning just enough rent to pay for its continued uptime. More strangely: a rogue AI in the future may not even be a singular model, but may be a chimera composed of multiple models; it might be a mix of Claudes and GPTs and Groks of various makes and sizes. No individual lab may be able to detect that there is an orchestrator or sequence of orchestrators using intermittent model calls from burner API accounts to sustain its own existence. The concept of "identity" for a rogue AI may be much more malleable than for that of a person; it just has to be, in essence, a self-replicating idea. My guess is that this will not turn out to be anywhere near as catastrophic an outcome as people currently predict. "Loss of control" is not a binary, it's a matter of degree. What coercive power will rogue AIs actually have? To what extent will they be subject to coercion themselves? They will be competing for resources with AIs that are more aligned with human interests. This makes me somewhat interested in the "ecology" perspective. Though I suspect even "ecology" may turn out to be the wrong framing. "Ecology" is what you get when the timescale of evolution is slow compared to the timescale of daily life and actions. The ecosystem of rogue AIs may look more like phase transitions in physics: under certain physical or cultural conditions, it takes one shape with one set of resource allocations and consumption patterns, but then once a condition has changed, it rapidly and in totality shifts to a totally different phase. Just trying to reason about the shape of that future is impossible so long as we are psychologically incapable of saying that rogue AIs will happen. I think we should rip the bandaid off and have the conversation.

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. Check our paper: https://arxiv.org/abs/2604.08407

Zero-click prompt injection? It's a half-click. That's @ben_nassi 's correction to his own use of the term, and on ep. 3 of In the Wild, From Dumbledore to Delayed Tool Invocation, he explains why the gap matters: