Prompt injection
Direct and indirect injection, tool poisoning and the defenses that hold up.
-
Security brief: a quiet weekend, and a catch-up on the agent-framework CVEs that went public on 7 and 8 October
No new in-the-wild agentic incident and no new CISA KEV entry for agentic software surfaced in the window. A sweep of the GitHub Advisory Database found a cluster of critical agent-framework flaws that reached the database on 7 and 8 October and have not been covered here: a Langflow MCP stdio command-injection family (CVSS 9.9), three PraisonAI critical or default-exposure flaws, a Flowise prompt-injection chain, and two role-boundary forgery bugs.
-
Security brief: an AI-orchestrated intrusion swarm, AgentCore's default role and GitLab's agent fixes
SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.