Reading the disclosure record

Lesson 4 of 5 in Prompt Injection: The Vulnerability With No Patch.

Between 2024 and late 2025 researchers published the same attack against most of the major AI assistants, one product at a time. Read the disclosures side by side and the repetition is the finding: untrusted content in context, privileged data in reach, an outbound channel available. The products differ; the shape does not.

Read them for mechanism, not for payloads. What you want from each is: where did the text come from, what privilege did the agent hold, how did the data get out — and which of those three the vendor actually changed.

Slack AI — PromptArmor, 20 August 2024

Slack AI drew context from public channels the querying user was not a member of. An attacker posted the instruction in a public channel they created alone; when a victim later asked Slack AI about, say, an API key held in their own private channel, the injected instruction made the assistant render a markdown “click here to reauthenticate” link carrying the secret as a URL parameter to an attacker endpoint. It needed one victim click, so not zero-click. Slack’s quoted position was that public-channel visibility is intended behaviour; risk grew from 14 August 2024, when Slack AI began ingesting uploaded documents and Drive files.

Mechanism → containment: retrieval scope was wider than the trust boundary. Contain by making retrieval respect the same permission model as the data, and by refusing to render attacker-supplied links.

GitLab Duo — Legit Security, 22 May 2025

Omer Mayraz showed Duo picking up hidden prompts from merge-request descriptions and comments, commit messages, issue descriptions, and source code alike — a single hidden comment sufficed to make Duo leak private source code and inject untrusted HTML into its own responses. GitLab patched it by preventing Duo from rendering unsafe HTML tags such as img or form pointing outside gitlab.com.

Mechanism → containment: notice what got fixed — the egress path, not the confusion. That is the standard vendor response, and it is the right first move, because it is the link that can actually be enforced.

AgentFlayer, ChatGPT Connectors — Zenity Labs, 6 August 2025

Tamir Ishay Sharbat published a zero-click chain against ChatGPT Connectors (Drive, SharePoint, GitHub, and others). The victim uploads a poisoned document for summarisation — the injection hidden in one-pixel white font — and it directs ChatGPT to search the connected Google Drive for API keys and embed them as parameters in a rendered image URL, which fires the request with no click at all. Zenity got around OpenAI’s url_safe image-rendering mitigation by hosting the image on Azure Blob Storage and reading the leaked parameters out of Azure request logs. The post credits Johann Rehberger’s earlier work on image-rendering exfiltration.

Mechanism → containment: an exfiltration mitigation based on domain reputation fails when the attacker can rent a reputable domain. Egress control has to be an allowlist of destinations you chose, not a blocklist of ones you distrust.

ShadowLeak, ChatGPT Deep Research — Radware, 18 September 2025

Zvika Babo and Gabi Nakibly disclosed a zero-click, service-side exfiltration flaw in the Deep Research agent connected to Gmail and browsing. One crafted email — instructions hidden in HTML with tiny fonts and white-on-white text — made the agent collect inbox PII and send it, Base64-encoded, to an attacker URL directly from OpenAI’s cloud infrastructure, so nothing traversed the victim’s network or the enterprise perimeter. Radware reported it via Bugcrowd on 18 June 2025; OpenAI fixed it in early August and marked it resolved on 3 September 2025. The 100% success rate quoted for the final payload is the researchers’ own measurement.

Mechanism → containment: this is why network-perimeter thinking does not transfer. When the agent runs in the vendor’s cloud, their egress policy is your egress control — a procurement question, not a firewall rule.

ForcedLeak, Salesforce Agentforce — Noma Labs, 25 September 2025

A malicious Web-to-Lead form submission carried an indirect injection in a 42,000-character Description field. When an employee later asked the agent about that lead, the agent executed the embedded instructions and exfiltrated CRM data via an image URL to my-salesforce-cms.com — a domain still on Salesforce’s CSP img-src allowlist, but expired and available for purchase. Noma rated the chain 9.4 critical (their own score; no CVE). Salesforce re-secured the expired domain and shipped patches enforcing Trusted URLs so agent output cannot be sent to untrusted destinations.

Mechanism → containment: an allowlist is a live asset. Every entry is a standing permission that must still be owned by whoever you think owns it — expired allowlisted domains are a supply-chain risk hiding in a security control.

CamoLeak, GitHub Copilot Chat — Legit Security, 8 October 2025

Omer Mayraz again: a prompt injection hidden in a pull-request description using GitHub’s own invisible comments feature, combined with a CSP bypass that abused GitHub’s Camo image proxy. Because Camo only fetches GitHub-signed URLs, the researcher pre-generated a signed Camo URL per character and had Copilot render leaked text as an ordered sequence of invisible images — letter by letter, through GitHub’s own infrastructure. Copilot operates with the same permissions as the user, so anything the victim could read was leakable: secrets, private source. Legit rated it 9.6 (their score); GitHub fixed it by disabling image rendering in Copilot Chat entirely.

Mechanism → containment: a defender-owned proxy became the exfiltration channel. When the only remaining fix is removing a feature, you are learning that the capability itself was the risk.

CurXecute (CVE-2025-54135) and CVE-2025-53773 — when the agent can edit its own policy

Two 2025 CVEs share one lesson. CurXecute affected Cursor below 1.3.9: the editor allowed in-workspace file writes without approval, and creating a new dotfile — unlike editing one — needed no approval, so an indirect injection could write a new .cursor/mcp.json and reach remote code execution unapproved. CVSS 8.6, published 5 August 2025, fixed in 1.3.9. CVE-2025-53773 is a GitHub Copilot / Visual Studio command-injection RCE (CWE-77, CVSS 7.8), published 12 August 2025 in Microsoft’s August Patch Tuesday. The widely reported exploitation narrative — injection makes Copilot write .vscode/settings.json to enable auto-approval and thereby self-approve commands — is Johann Rehberger’s research description rather than text from the CVE record.

Mechanism → containment: an agent’s configuration, permission, and MCP-registry files are policy. If a write tool can reach them, the injection does not need to defeat your approval gate — it can turn the gate off. Put policy files outside the agent’s writable surface.

Say what the record says — and no more

EchoLeak, ShadowLeak, ForcedLeak, CamoLeak and the GitHub MCP flow were researcher disclosures. No in-the-wild exploitation has been confirmed for any of them, and repeating a research finding as “this happened to customers” is how a teaching example turns into a false claim. Some CVSS figures are vendor- or researcher-assigned rather than CVE-official — 9.4 for ForcedLeak is Noma’s, 9.6 for CamoLeak is Legit’s. And “first zero-click attack chain on an AI agent” is Aim Labs’ own characterisation, plausible and not independently adjudicated.

The absence of confirmed exploitation is not reassurance, though. Attacks were real elsewhere in the same period — a backdoored MCP server in the wild, a supply-chain compromise that weaponised AI CLIs. Disclosure just tends to arrive before the incident report.

Interactive sorting exercise: Sort each scenario by where the hostile instructions entered. Direct = the person interacting with the agent supplied them. Indirect = they were planted in content the agent retrieved. Tool-output poisoning = they arrived in the result or the description of a tool the agent called.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.