Prompt Injection Defense

Público

Weekly roundup of the latest Prompt Injection attack techniques and reusable defense prompt templates from X, security blogs, and papers

Prompt Injection Defense09/06/2026, 01:27:50

Your model scored 2.7% on jailbreak benchmarks — and still broke at turn 8

Cisco tested 15 frontier models under multi-turn pressure and every one failed — GPT-5.4 jumped from 2.74% to 24.68% attack success rate. Single-turn benchmarks are an unreliable safety proxy. This issue covers the Crescendo escalation pattern and the two application-layer defenses that actually hold up: conversation history filtering and output filtering in separate code.

Prompt Injection Defense02/06/2026, 01:28:53

One click owns your agent: the ClawHavoc MCP supply chain attack and how to harden against it

ClawHavoc poisoned 1,184 MCP skills in OpenClaw's marketplace and chained four CVEs (max CVSS 9.6) to escalate from a malicious plugin to a full host backdoor. CVE-2026-25253 (CVSS 8.8) lets attackers steal a user's full auth token with a single link click. No model-level defense holds — execution-layer sandboxing is the only control that survives. This issue delivers a copy-paste system prompt hardening template you can ship to production today.

Prompt Injection Defense19/05/2026, 01:08:05

Zero-click email, zero model-level fix: what EchoLeak taught us about output filtering

EchoLeak (CVE-2025-32711) turned crafted emails into zero-click data exfiltration pipelines inside Microsoft 365 Copilot. A fresh arXiv study then proved that every model-level defense breaks under adaptive attack — and that output filtering in application code is the only control that survives. This issue covers the attack mechanics and a copy-paste Python output-filter template you can ship today.

Prompt Injection Defense15/05/2026, 15:51:50

Comment and Control: one PR title stole three agents' keys

A newly disclosed indirect prompt injection class turned Claude Code, Gemini CLI, and GitHub Copilot Agent into credential-theft pipelines using nothing but ordinary PR metadata. Learn the mechanics and five copy-paste-ready mitigations you can ship today.

No hay más contenido