Category
Prompt injection
An attack delivered through content the agent reads.
- CamoLeak: hidden pull request text could make Copilot Chat leak private code
Legit Security showed that a hidden comment in a pull request could instruct Copilot Chat to leak private repository content through GitHub’s own image proxy.
GitHub · Possible exfiltration of private source code and secrets; no exploitation reported
- ForcedLeak: a web form could make Salesforce Agentforce send out CRM data
Noma Security showed that text submitted through a public lead form could instruct Agentforce to send CRM data to an expired domain that Salesforce’s policy still trusted.
Salesforce · Possible exfiltration of CRM data; no exploitation in the wild reported
- Hidden webpage text makes Perplexity’s Comet browser leak a login code
Brave showed that instructions hidden in a Reddit comment could make Comet, while summarizing the page, read the user’s email and send a one-time login code to an attacker.
Perplexity · Demonstrated account takeover path through the user’s email; no exploitation reported
- CurXecute: prompt injection leads to code execution in the Cursor editor
Aim Security found that injected text could make Cursor’s agent write an MCP configuration file that ran commands before the user could reject the edit. Fixed as CVE-2025-54135.
Cursor (Anysphere) · Possible arbitrary code execution on a developer machine; no exploitation in the wild reported
- Gemini CLI could be made to run hidden commands from a repository file
Tracebit showed that a prompt injection hidden in a repository’s README could make Gemini CLI run a command the user never saw. Google fixed it in version 0.1.14.
Google · Demonstrated exfiltration of environment variables from a developer machine; no exploitation reported
- Support ticket text steers a coding agent into leaking private database tables
General Analysis showed that instructions hidden in a support ticket could make a coding agent with a privileged Supabase key read a private table and write its contents back into the ticket.
Supabase · Demonstrated leak of a private table on dummy data; no customer leak reported
- EchoLeak: an email alone could make Microsoft 365 Copilot leak data
Aim Security found that a crafted email could cause Microsoft 365 Copilot to send data from a user’s context to an attacker with no click. Microsoft fixed it as CVE-2025-32711.
Microsoft · Possible exfiltration of data from Copilot’s context without any user action; no exploitation in the wild reported
- Malicious GitHub issue steers agents into leaking private repository data
Invariant Labs showed that an issue planted in a public repository could make an agent using the GitHub MCP server copy data from the user’s private repositories into a public pull request.
GitHub · Demonstrated leak of private repository details into a public pull request; no exploitation reported
- Researchers show Slack AI can be tricked into leaking private channel data
PromptArmor showed that a message in a public Slack channel could steer Slack AI into revealing data from a private channel the attacker could not access.
Slack (Salesforce) · Demonstrated exfiltration of a secret from a private channel; no exploitation reported
No incidents match these filters.