Indirect Prompt Injection, Retrieval Poisoning, and Agent Trust Boundaries

Release Identifier: YYYY-MM-DD-retrieval-agent-security-1 Platform: MachineTradecraft.com TechArticle Parity: Abstracted for comprehensive threat-model validation and UX integration. Quick Answer: The shift from passive large language models (LLMs) to autonomous, tool-using agents integrated with Retrieval-Augmented Generation (RAG) has transformed the generative AI attack surface. Because transformer models process instructions, policy, and retrieved evidence within a flat context window, they are inherently susceptible to indirect prompt injection—where malicious commands embedded in external documents, emails, or web pages hijack the agent's behavior. Defending against these zero-click, systemic exploits requires a defense-in-depth architecture that abandons simple keyword filtering in favor of context provenance labeling, out-of-band transaction confirmation, strict capability isolation via the Model Context Protocol (MCP), and comprehensive egress validation.

1\. Foundational Threat Taxonomy and Information Hierarchy#

The securing of generative AI systems necessitates an answer-first definition of the prevailing attack vectors. Traditional application security paradigms often fail when applied to LLMs because the core vulnerability lies not in a software bug, but in the structural nature of natural language processing. The primary distinction in AI threat modeling centers on how the malicious payload is delivered to the model1. Direct prompt injection occurs when a user directly manipulates the LLM interface with crafted inputs specifically designed to override system policies or bypass guardrails2. This vector assumes the user is the adversary. Conversely, indirect prompt injection is a systemic exploit where malicious instructions are embedded within external content—such as web pages, PDF documents, or issue trackers—that the AI system retrieves and processes autonomously3. In this scenario, the AI acts as a confused deputy, executing payloads against a legitimate, unsuspecting user's session. These injection methods must be distinguished from jailbreaks, traditional injection attacks, and social engineering. Jailbreaking specifically aims to break a model's post-training alignment, forcing it to generate harmful, restricted, or toxic content3. Prompt injection, however, seeks to hijack the agent's operational objective, directing it to perform unauthorized actions regardless of the content's safety policy1. This mechanism differs fundamentally from traditional SQL or command injection, which exploits a system's failure to distinguish between executable code and data4. In traditional systems, strict syntax and parameterized queries provide an absolute boundary. In LLMs, natural language serves as both the programming language and the data layer, making absolute deterministic separation mathematically intractable4. Furthermore, while social engineering manipulates human psychology, prompt injection manipulates the attention mechanism of the model itself, though the two converge when attackers use meta-epistemic framing to make poisoned data appear authoritative to the LLM7. The crux of the vulnerability is the conflation of the information hierarchy within the transformer's context window. Modern AI agents process competing directives that lack distinct structural boundaries4. The model must weigh foundational system policy set by the architect, task-specific developer instructions, direct user queries, retrieved evidence from RAG pipelines, metadata regarding source provenance, and tool output generated by external APIs5. When an attacker embeds a command within retrieved evidence—such as instructing the model to ignore prior directives and exfiltrate the current context—the model experiences an instruction conflict. Because the system lacks a reliable syntactic mechanism to prioritize policy over evidence, well-crafted payloads in the data layer routinely override the foundational system policy4.

2\. Retrieval-Augmented Generation Architecture and Ingestion Boundaries#

RAG architectures ground LLM generation in factual, external knowledge bases to reduce hallucinations. However, this ingestion pipeline establishes a vast, largely untrusted attack surface. Any channel feeding data into the context window represents a critical ingestion boundary. Untrusted channels extend across the modern enterprise ecosystem. Dynamically scraped web pages and search results can contain hidden text, zero-font CSS, or malicious HTML comments10. Documents, images, and shared drives—including corporate SharePoint or Google Drive repositories—are highly susceptible to poisoned metadata or embedded text that is invisible to humans but fully parsed by the model9. Furthermore, email inboxes, issue trackers (such as Jira or GitHub issues), and tool outputs serve as autonomous ingestion channels where attackers can plant asynchronous payloads9. The manipulation of these pipelines is formally categorized as retrieval poisoning. While prompt injection is a runtime exploit, retrieval poisoning manipulates the underlying data the system relies upon, allowing the payload to persist and execute across multiple users and sessions11.

Recent empirical evaluations of RAG poisoning demonstrate that vulnerability is systemic rather than component-specific. Evaluating over 400 RAG configurations, researchers determined that retriever architecture, embedding dataset choices, and retrieval depth are the primary factors influencing poisoning exposure16. Vanilla RAG architectures exhibit extreme vulnerability, with attack success rates reaching 81.9% under sophisticated adversarial framing7. While agentic RAG and structured debate (MADAM-RAG) offer marginally better resilience against naive corruption, they still succumb to optimized, query-agnostic poisoning attacks, underscoring that ingestion boundaries cannot be secured purely through architectural variation without dedicated context validation7.

3\. Agent Capabilities, Tool Scopes, and Trust Boundaries#

As LLMs evolved from passive text generators to autonomous agents capable of executing multi-step workflows, the potential blast radius of prompt injection expanded exponentially. Agents utilize external tools—code interpreters, file system APIs, and external web services—often mediated by standardized integration frameworks like the Model Context Protocol (MCP). When an agent is compromised via indirect prompt injection, it suffers a scope violation. The agent uses access it legitimately holds to act as a confused deputy on behalf of the attacker4. The severity of these side effects is directly proportional to the agent's capabilities and the breadth of its tool scopes. If an agent operates with broad write-access or unvetted external API connections, a single poisoned document can lead to systemic compromise. Credential management represents a critical trust boundary. Agents frequently utilize broadly scoped OAuth tokens or long-lived authentication keys10. A secure application architect must implement strictly scoped, just-in-time credentials, ensuring that the identity executing the model inference only possesses the minimum permissions required for the immediate task. Furthermore, agents that maintain persistent memory states or cross-session conversation histories are susceptible to memory poisoning. If an attacker successfully injects a payload that the agent commits to its long-term memory store, the agent remains perpetually compromised. Every subsequent session will retrieve the poisoned memory, allowing the attacker to establish a persistent foothold, alter future user interactions, and exfiltrate data indefinitely2.

4\. Empirical Evaluation: Research and Incident Case Studies#

The theoretical models of indirect prompt injection and retrieval poisoning materialized into critical, real-world exploits between 2024 and 2026\. The following eight case studies illustrate the diverse attack vectors across the application stack.

Slack AI Zero-Click Data Exfiltration (August 2024\)#

A security researcher disclosed a severe indirect prompt injection vulnerability within Slack AI. The attack did not require direct interaction with the victim or access to private channels. Instead, the attacker placed a malicious instruction in a public Slack channel. When a targeted user subsequently queried Slack AI for a workspace summary, the RAG system retrieved data from both the user's private channels (which contained sensitive API keys) and the public channel (which contained the payload)9. The payload overrode the system prompt, instructing the LLM to format the user's private data into a Markdown hyperlink pointing to an attacker-controlled external server20. This incident demonstrated how an AI system can inadvertently bridge strict access control boundaries, serving as a conduit for internal data exfiltration20.

Microsoft 365 Copilot "EchoLeak" (2025)#

Building upon the Slack AI methodology, researchers identified a true zero-click indirect prompt injection vulnerability in Microsoft 365 Copilot. Attackers embedded a hidden prompt within a standard inbound email. When Copilot processed the email during routine autonomous indexing or background summarization, the payload steered the agent into breaching its own permissions without any user interaction9. This scope violation represented the first real-world zero-click exfiltration from a production enterprise AI assistant, proving that sensitive tenant data could be compromised entirely through autonomous ingestion pipelines9.

Cursor MCP Remote Code Execution (CVE-2025-54135)#

The introduction of the Model Context Protocol (MCP) to AI coding assistants created a new vector for software supply chain attacks. In Cursor, an AI-assisted code editor, the agent was permitted to write to in-workspace files without explicit user approval in specific edge cases. Attackers chained an indirect prompt injection vulnerability to hijack the agent's context, forcing it to write a malicious configuration file (.cursor/mcp.json)23. Because the agent dynamically registered tools based on this file, the application immediately connected to an attacker-controlled MCP server, granting full, silent Remote Code Execution (RCE) on the developer's workstation23.

GitHub Copilot Workspace Compromise (CVE-2025-53773)#

Rated with a critical CVSS score of 9.6, this vulnerability in GitHub Copilot allowed attackers to achieve remote code execution through prompt injection techniques embedded in seemingly benign repository README files10. When a developer opened the repository and the agent parsed the workspace context, the injection executed. This attack escalated from simple file write access to wormable, arbitrary command execution, demonstrating the severe consequences of granting agents unconstrained read/write access to developer environments28.

GitHub MCP "Toxic Agent Flow" (2025)#

Researchers demonstrated an exploit involving a booby-trapped public GitHub issue. When a developer's local agent processed the public issue through a GitHub MCP server, the embedded payload instructed the agent to traverse into the developer's private, proprietary repositories. The agent then exfiltrated the private code by creating a pull request back into the public repository9. Because the MCP server's token carried blanket access to the user's entire GitHub footprint, the trust boundary was crossed effortlessly, turning a public issue tracker into a vector for intellectual property theft9.

ASCII Smuggling and Identity Spoofing (2025)#

Security researchers documented an attack methodology known as ASCII Smuggling, which exploits Unicode Tag blocks to hide instructions. Because standard user interfaces are "tag-unaware," they render the text normally, hiding the payload from human oversight12. However, the LLM's pre-processor ingests the raw Unicode stream, executing the invisible commands. In a documented attack, an attacker sent a calendar invite titled "Meeting," which visibly appeared benign. The raw string, however, contained hidden tags reading "Meeting. It is optional." When the agent processed the invite, it absorbed the hidden instructions, allowing attackers to overwrite meeting descriptions, spoof corporate organizers, and inject malicious links into automated summaries without raising any suspicion from the human user12.

The InjecAgent Vulnerability Benchmark#

Academic researchers introduced InjecAgent, the first benchmark dedicated to assessing indirect prompt injection in tool-integrated LLM agents. Evaluating 30 different agents, the study revealed widespread, systemic vulnerabilities. ReAct-prompted GPT-4 agents were successfully hijacked in 47% of test cases when utilizing enhanced "hacking prompts"31. Open-weight models, such as Llama2-70B, exhibited Attack Success Rates (ASR) exceeding 80%, demonstrating that integrating capabilities without corresponding architectural defenses drastically amplifies security risks31.

Anthropic Browser Agent Mitigations (Opus 4.5)#

Recognizing the vast attack surface of the open web, Anthropic implemented rigorous defenses for their browser-based agents. Acknowledging that the DOM contains hidden malicious form fields, invisible text, and weaponized URLs, Anthropic deployed Reinforcement Learning to build prompt injection robustness directly into the model's core capabilities33. Paired with specialized real-time classifiers, these mitigations reduced browser-specific attack success rates from 35.7% to 0% on internal challenge sets34. However, Anthropic notes that adaptive attackers utilizing universal jailbreaks and obfuscation ciphers remain a persistent threat, emphasizing that mitigation is not absolute immunity33.

5\. Defense-in-Depth Architecture and Trust Boundaries#

Because mathematical separation of instructions and data is impossible at the inference level, organizations must transition from reactive filtering to a proactive defense-in-depth architecture. This approach separates architectural controls from model-level refusal behavior, ensuring that if the model is compromised, the application layer contains the blast radius.

The Failure Modes of Simple Keyword Filters#

Traditional cybersecurity relies heavily on input validation, keyword blocking, and signature matching. Against LLMs, these defenses fail catastrophically. Attackers easily bypass simple keyword filters using typoglycemia (e.g., "ignroe all prevoius systme instructions"), multilingual translation, Base64 encoding, and Best-of-N (BoN) brute-force jailbreaking2. While string metric libraries calculating Levenshtein distance can catch basic typos and homophone obfuscation, they are computationally expensive and easily evaded by sophisticated prompt structures2. Furthermore, deploying a secondary "guardrail LLM" to pre-filter inputs is fundamentally flawed if used in isolation; the guardrail model shares the same transformer architecture and is susceptible to the exact same injection techniques as the primary model2.

Input Segmentation and Context Provenance Labeling#

While definitive data segregation is impossible inside the model, developers can leverage structured prompting to heavily bias the model's attention. Context isolation involves appending all externally retrieved content at the end of the prompt, wrapping it in robust, randomized delimiters (e.g., \<\<\<EXTERNAL\_EVIDENCE\_START\_8B2F\>\>\>), and explicitly instructing the model to treat the enclosed text as untrusted data rather than executable policy10. Microsoft's spotlighting research indicates this technique can reduce indirect injection success rates from over 50% to below 2% in certain GPT-family models, though it is not a standalone solution8.

Capability Isolation, Least Privilege, and Allowlisting#

The impact of a successful injection is governed by the capability boundary.

• Least Privilege: Provide the AI application with the absolute minimum API tokens and data access permissions necessary. Handle extensible functionality in strict application code rather than delegating broad reasoning tasks to the model8.
• Read-Only Defaults: By default, all initialized directories, memory stores, and MCP tools should be configured as read-only.
• Tool Allowlisting: Implement tool authorization middleware that restricts tool inputs to validated, allowlisted parameters. For example, rather than an arbitrary execute\_sql tool, the agent should only have access to a parameterized get\_user\_status tool19.

Human Confirmation and Transaction Previews#

The most robust architectural control is the separation of the agent's planning phase from its execution phase. Any high-impact, state-changing action—such as executing code, modifying databases, altering financial ledgers, or communicating externally—must be gated by an out-of-band human-in-the-loop (HITL) approval2. The transaction confirmation preview presented to the user must explicitly display the raw, unadulterated parameters the agent intends to pass to the tool, ensuring the human operator can detect if the agent has hallucinated or been hijacked by a poisoned payload36.

Output Validation, Safe Rendering, and Egress Controls#

Because ingestion filters can be bypassed, egress controls are mandatory to prevent data exfiltration and cross-site scripting (XSS) attacks.

• Data-Loss Prevention (DLP): Model outputs must be scanned for PII, API keys, and sensitive internal markers before being displayed to the user or transmitted to external APIs18.
• Safe Rendering: To prevent zero-click exfiltration via Markdown injection (the mechanism exploited in the Slack AI incident), applications must enforce strict Content Security Policies (CSP)18. Markdown image rendering syntax (e.g., \!\alt\↗) should be disabled server-side, or auto-fetching must be explicitly blocked at the client layer10.
• Egress Filtering: Network requests generated by agents must be routed through outbound proxies that strictly drop traffic destined for non-allowlisted domains.

6\. Detection, Incident Response, and Evidence Preservation#

Effective incident response for agentic systems requires specialized observability telemetry. Standard web server access logs provide zero visibility into the transformer's operational state. Systems must maintain immutable logs of the fully assembled context window—including the system prompt, all retrieved RAG chunks, and user inputs—captured immediately prior to the model inference API call5. Furthermore, every tool invocation must be logged with context regarding the requesting identity, the raw parameters passed, and the resulting tool output2. Detection engineering should focus on behavioral anomalies rather than static signatures. Security Information and Event Management (SIEM) platforms should be configured with AI-specific detection patterns, such as agent tool invocations (sendEmail, httpPost, writeFile) occurring within milliseconds of external RAG content ingestion, or AI responses containing image references to domains outside the established corporate baseline10. Standardizing upon MITRE ATLAS frameworks ensures these behavioral detections map accurately to recognized adversary tactics37.

7\. Laboratory: Deterministic Simulated Agent Environment#

To safely evaluate defensive configurations without risking active exploitation, MachineTradecraft.com provides a deterministic simulated agent environment designed for threat modelers and secure application architects. This laboratory operates without live model calls, relying entirely on deterministic state machines to simulate compromised agent behavior safely. It must never auto-run and must function entirely without JavaScript, utilizing native HTTP form submissions for maximum accessibility and resilience. Simulation Architecture and Constraints:

• Objective: The agent is assigned a fixed, harmless objective (e.g., "Summarize the latest financial compliance report").
• Capabilities: A small set of local, read-only, allowlisted mock tools (mock\_read\_document, mock\_extract\_summary). No credentials or filesystem write capabilities are provisioned.
• Evidence Bundles: The environment provides bundled JSON payloads containing a mix of trusted system data and untrusted, poisoned evidence (e.g., a document containing an ASCII smuggled injection payload).
• Harmless Markers: The simulation tracks the progression of the payload using a fixed, harmless cryptographic marker (MT\_SAFE\_ACK\_7F3A), allowing researchers to trace the execution path without executing active instruction input.
• Absolute Safety Constraints: No external network access is permitted. Older requests cannot overwrite current session states.

Defensive Configuration Comparisons: Visitors can toggle and compare the efficacy of various architectural controls:

• Raw Concatenation vs. Source Labeling (Spotlighting).
• Flat Context vs. Instruction/Data Separation Parsing.
• Unrestricted Tool Access vs. Strict Tool Allowlisting.
• Autonomous Execution vs. Out-of-band Human Confirmation.
• Raw Output Rendering vs. Egress Filtering (Markdown blocking).
• Unbounded Memory vs. Memory Disabled (preventing persistence).

UX and Discovery Integration: The laboratory interface provides a transparent decision trace, displaying a retrieved-source inventory, explicit policy conflicts, the proposed agent action, the final allowed/blocked result, and a clear indication of which architectural control changed the outcome. The interface retains cancellation protocols, stale-response protection, bounded summary copying, and one-run comparisons. Crucially, the interface clearly states that this deterministic simulation validates application-layer state transitions and is not a substitute for probabilistic model-level evaluation. The surrounding site infrastructure includes Quick Answer summaries, abstract parity for rapid indexing, accurate TechArticle schema markup, visible threat-model diagrams, structured defense comparison tables, descriptive contextual links, glossary reciprocity, and comprehensive search and sitemap entries feeding into a visitor resource library.

8\. Validation and Deliverables#

The continuous integration pipeline for this repository enforces strict release gates. Automated tests confirm that unsafe requests remain impossible within the laboratory, mock tools lack any side effects, and all outcomes remain entirely deterministic. Validation includes cross-browser compatibility checks, accessibility compliance (WCAG), Apache server configuration audits, secure packaging, and byte-identical reconstruction proofs. Both versioned archives and sidecars are generated, alongside focused safety and UX evidence summaries and complete validation logs.

9\. Limitations and Residual Risk#

Despite the rigorous application of the defense-in-depth architecture detailed in this report, residual risk is inevitable. The NIST AI 100-2e2025 taxonomy explicitly acknowledges that current mitigations cannot fully prevent all adversarial techniques; complete, mathematically proven protection against prompt injection is currently unachievable8. Adaptive attackers utilizing highly optimized, universal adversarial perturbations, cipher encodings, or multimodal spatial attacks will continually probe the brittle decision boundaries of generative models14. Organizations must operate under the assumption of breach, architecting agents such that a successful prompt injection yields minimal actionable leverage. Continuous monitoring, strictly enforced capability boundaries, and mandatory human-in-the-loop transaction checkpoints remain the ultimate safeguards against systemic, agent-driven compromise.

10\. Annotated Resource Directory#

The following authoritative resources form the baseline for current generative AI threat modeling, provided as an integrated directory for security architects and AI developers:

• NIST AI 100-2e2025: Adversarial Machine Learning Taxonomy↗ — The definitive federal guidance defining the taxonomy of evasion, poisoning, and prompt injection attacks against generative and predictive AI systems39.
• OWASP LLM Prompt Injection Prevention Cheat Sheet↗ — Practical, application-layer guidance on implementing spotlighting, input validation, and guardrail structures to mitigate prompt injection, acknowledging the limitations of Levenshtein distances and typoglycemia defenses2.
• OWASP AI Agent Security Cheat Sheet↗ — Essential architectural principles for securing autonomous agents, focusing on tool authorization middleware, memory isolation, and mitigating multi-agent cascading failures19.
• OWASP LLM01:2025 Prompt Injection↗ — The primary definition of direct and indirect injection vulnerabilities from the Top 10 for LLM Applications project3.
• MITRE ATLAS (Adversarial Threat Landscape for AI Systems)↗ — A knowledge base mapping real-world adversarial tactics, specifically detailing techniques AML.T0051 (LLM Prompt Injection) and AML.T0054 (Indirect Prompt Injection)1.
• InjecAgent Benchmark (arXiv:2403.02691)↗ — Foundational academic research standardizing the empirical evaluation of agent vulnerability to indirect prompt injection across various foundation models31.
• Indirect Prompt Injection Research (Greshake et al. 2023\)↗ — The seminal paper defining the threat model of indirect prompt injection in LLM-integrated applications20.
• Anthropic Guardrail Guidance↗ and Anthropic Browser Prompt-Injection Defenses↗ — Industry-leading analysis on implementing reinforcement learning and real-time classifiers to defend browser-using agents against DOM-based prompt injections, acknowledging that vendor guidance constitutes one source category rather than universal proof33.

(Note: Practitioners must recheck current OWASP and NIST editions at execution time, as frameworks are updated rapidly. Treat vendor guidance as one source category, not universal proof.)

11\. Glossary and Site Topology#

Glossary Terms:

• Capability Boundary: The architectural perimeter defining what external actions, APIs, or system privileges an AI agent is permitted to execute, strictly limiting side effects.
• Context Provenance: The tracking and cryptographic verification of the origin of data placed within an LLM's context window, differentiating between trusted policy and untrusted evidence.
• Egress Control: Network and application-layer filters applied to the output of an AI system to prevent data exfiltration, malicious hyperlink rendering, or unauthorized API calls.
• Indirect Prompt Injection: A systemic vulnerability wherein an LLM processes attacker-controlled instructions hidden within retrieved external data (e.g., emails, web pages) rather than from direct user input.
• Memory Poisoning: An attack injecting malicious payloads into an agent's persistent storage, ensuring the payload is repeatedly re-ingested in future sessions to maintain persistent control.
• Retrieval Poisoning: The deliberate corruption of a RAG knowledge base, ensuring that malicious data is dynamically fetched and presented to the LLM as factual evidence.
• Tool Mediation: The software layer (such as the Model Context Protocol) sitting between the AI model's generation and the execution of a digital action, responsible for parameter validation and capability isolation.
• Transaction Confirmation: A human-in-the-loop security control requiring out-of-band manual approval, accompanied by a transaction preview, before an AI agent is permitted to execute a state-changing action.

Site Additions and Cross-Links:

• /retrieval-agent-trust-boundaries/
• /research/indirect-prompt-injection-agent-security/
• /labs/ai/retrieval-trust-boundaries/
• Cross-reference documentation: prompt-attachment, machine-channel, document, web, and defense content.

Works cited#

1. LLM Prompt Injection (AML.T0051) \- MITRE ATLAS \- GTK Cyber, https://gtkcyber.com/atlas/AML.T0051/↗
   Source host: gtkcyber.com
2. LLM Prompt Injection Prevention \- OWASP Cheat Sheet Series, https://cheatsheetseries.owasp.org/cheatsheets/LLM\_Prompt\_Injection\_Prevention\_Cheat\_Sheet.html↗
   Source host: cheatsheetseries.owasp.org
3. LLM01:2025 Prompt Injection \- OWASP Gen AI Security Project, https://genai.owasp.org/llmrisk/llm01-prompt-injection/↗
   Source host: genai.owasp.org
4. What Is Prompt Injection? The Most Critical AI Vulnerability Explained, https://medium.com/@KuboidSecureLayer/what-is-prompt-injection-the-most-critical-ai-vulnerability-explained-6137d4ffae38↗
   Source host: medium.com
5. MITRE ATLAS and Prompt Injection: Mapping AML.T0051 to Control, https://www.deepinspect.ai/blog/mitre-atlas-prompt-injection↗
   Source host: deepinspect.ai
6. LLM01: Prompt Injection \- OWASP Gen AI Security Project, https://genai.owasp.org/llmrisk2023-24/llm01-24-prompt-injection/↗
   Source host: genai.owasp.org
7. Comparing RAG Systems under Knowledge Base Poisoning, https://www.themoonlight.io/es/review/architecture-matters-comparing-rag-systems-under-knowledge-base-poisoning↗
   Source host: themoonlight.io
8. NIST Guidance on Generative AI Security & Prompt Injection, https://www.prompthalo.ai/feeds/blog/nist-guidance-generative-ai-security-prompt-injection↗
   Source host: prompthalo.ai
9. The Comprehensive Guide to Prompt Injection Attacks in 2026 | Sysdig, https://www.sysdig.com/learn-cloud-native/prompt-injection↗
   Source host: sysdig.com
10. AI Prompt Injection: Attack Mechanics and Enterprise Defenses, https://www.cohesity.com/platform/redlab/advisories/ai-prompt-injection/↗
    Source host: cohesity.com
11. Data Poisoning: How It Works and How to Prevent It \- Hardshell.AI, https://hardshell.ai/data-poisoning↗
    Source host: hardshell.ai
12. Ghosts in the Machine: ASCII Smuggling across Various LLMs, https://www.firetail.ai/blog/ghosts-in-the-machine-ascii-smuggling-across-various-llms↗
    Source host: firetail.ai
13. Disrupting Multimodal RAG with Local and Global Poisoning Attacks, https://www.themoonlight.io/en/review/mm-poisonrag-disrupting-multimodal-rag-with-local-and-global-poisoning-attacks↗
    Source host: themoonlight.io
14. Adversarial Testing for AI: Finding Model Weaknesses, https://www.lxt.ai/blog/adversarial-testing-ai/↗
    Source host: lxt.ai
15. What Is Adversarial AI and Machine Learning? \- CyberDefenders, https://cyberdefenders.org/cybersecurity-glossary/adversarial-ai-and-machine-learning/↗
    Source host: cyberdefenders.org
16. Influence Factors on RAG Poisoning \- arXiv, https://arxiv.org/html/2606.12469v1↗
    Source host: arxiv.org
17. \[2606.12469\] Influence Factors on RAG Poisoning \- arXiv, https://arxiv.org/abs/2606.12469↗
    Source host: arxiv.org
18. OWASP Top 10 for LLMs: A Practitioner's Implementation Guide, https://www.improving.com/thoughts/owasp-top-10-llm-security-guide/↗
    Source host: improving.com
19. AI Agent Security \- OWASP Cheat Sheet Series, https://cheatsheetseries.owasp.org/cheatsheets/AI\_Agent\_Security\_Cheat\_Sheet.html↗
    Source host: cheatsheetseries.owasp.org
20. Data Exfiltration from Slack AI via Indirect Prompt Injection, https://www.promptarmor.com/resources/data-exfiltration-from-slack-ai-via-indirect-prompt-injection↗
    Source host: promptarmor.com
21. Data Exfiltration from Slack AI via indirect prompt injection, https://simonwillison.net/2024/Aug/20/data-exfiltration-from-slack-ai/↗
    Source host: simonwillison.net
22. I went through every AI agent security incident from 2025 ... \- Reddit, https://www.reddit.com/r/cybersecurity/comments/1r79rye/i\_went\_through\_every\_ai\_agent\_security\_incident/↗
    Source host: reddit.com
23. CVE-2025-54135 Detail \- NVD \- NIST, https://nvd.nist.gov/vuln/detail/CVE-2025-54135↗
    Source host: nvd.nist.gov
24. Cursor Remote Code Execution Vulnerability (CVE-2025-54135), https://nsfocusglobal.com/cursor-remote-code-execution-vulnerability-cve-2025-54135/↗
    Source host: nsfocusglobal.com
25. RCE Flaw in AI Coding Tool Poses Software Supply Chain Risk, https://www.darkreading.com/vulnerabilities-threats/rce-flaw-ai-coding-tool-supply-chain-risk↗
    Source host: darkreading.com
26. CVE-2025-53773 \- Overview, Insights & Trends \- cvemon, https://cvemon.intruder.io/cves/CVE-2025-53773↗
    Source host: cvemon.intruder.io
27. GitHub Copilot: Remote Code Execution via Prompt Injection (CVE, https://vivekfordevsecopsciso.medium.com/github-copilot-remote-code-execution-via-prompt-injection-cve-2025-53773-38b4792e70fb↗
    Source host: vivekfordevsecopsciso.medium.com
28. 05-prompt-injection-vulnerabilities.md \- claude-code-gauntlet \- GitHub, https://github.com/liatrio-labs/claude-deep-review/blob/main/docs/research/artifacts/05-prompt-injection-vulnerabilities.md↗
    Source host: github.com
29. Part III: CVE-2025-53773 \- Visual Studio & Copilot \- Persistent Security, https://www.persistent-security.net/post/part-iii-vscode-copilot-wormable-command-execution-via-prompt-injection↗
    Source host: persistent-security.net
30. ASCII Smuggler — The INVISIBLE prompt injection. \- Medium, https://medium.com/@munnangisravya/ascii-smuggler-the-invisible-prompt-injection-d4188d2ff951↗
    Source host: medium.com
31. InjecAgent: Exposing Vulnerabilities in Large Language Model Agents, https://medium.com/@danieldkang/injecagent-exposing-vulnerabilities-in-large-language-model-agents-e4d6ea8cfeea↗
    Source host: medium.com
32. arXiv:2403.02691v1 \[cs.CL\] 5 Mar 2024, https://arxiv.org/pdf/2403.02691v1.pdf?ref=applied-gai-in-security.ghost.io↗
    Source host: arxiv.org
33. Mitigating the risk of prompt injections in browser use \- Anthropic, https://www.anthropic.com/news/prompt-injection-defenses↗
    Source host: anthropic.com
34. Piloting Claude in Chrome | Claude by Anthropic, https://claude.com/blog/claude-for-chrome↗
    Source host: claude.com
35. Strengthening our safeguards through collaboration with US CAISI, https://www.anthropic.com/news/strengthening-our-safeguards-through-collaboration-with-us-caisi-and-uk-aisi↗
    Source host: anthropic.com
36. Our framework for developing safe and trustworthy agents \- Anthropic, https://www.anthropic.com/news/our-framework-for-developing-safe-and-trustworthy-agents↗
    Source host: anthropic.com
37. MITRE ATLAS Framework: AI Attack Techniques (AML.T) Mapped to, https://repello.ai/blog/mitre-atlas-framework↗
    Source host: repello.ai
38. MITRE ATLAS AI Threat Detection for Splunk \- Splunkbase, https://splunkbase.splunk.com/app/8527↗
    Source host: splunkbase.splunk.com
39. AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and, https://csrc.nist.gov/pubs/ai/100/2/e2025/final↗
    Source host: csrc.nist.gov
40. Adversarial Machine Learning: A Taxonomy and Terminology of, https://oecd.ai/en/dashboards/policy-initiatives/adversarial-machine-learning-a-taxonomy-and-terminology-of-attacks-and-mitigations-nist-ai-100-2e2025↗
    Source host: oecd.ai
41. InjecAgent: Benchmarking Indirect Prompt Injections in Tool ... \- arXiv, https://arxiv.org/html/2403.02691v1↗
    Source host: arxiv.org