An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.

Googleは2025年11月、AIエージェント主導のコーディングツール「Google Antigravity」を発表しました。新たに、AIシステムのリスクを評価・監視するセキュリティ企業のPromptArmorが、Google Antigravityを介してユーザーデータを盗み出す攻撃手法が見つかったと報告しています。

Whack yakety-yak app chaps rapped for security crack

Microsoft 365 Copilot Coworkにおいて「SharePointやOneDrive上のファイルが間接プロンプト注入によって流出する可能性がある」とAIセキュリティ企業のPromptArmorが報告しています。

Microsoft 365 Copilot Coworkにおいて「SharePointやOneDrive上のファイルが間接プロンプト注入によって流出する可能性がある」とAIセキュリティ企業のPromptArmorが報告しています。

Googleは2025年11月、AIエージェント主導のコーディングツール「Google Antigravity」を発表しました。新たに、AIシステムのリスクを評価・監視するセキュリティ企業のPromptArmorが、Google Antigravityを介してユーザーデータを盗み出す攻撃手法が見つかったと報告しています。

Ramp Labsが提供する表計算AI「Sheets AI」に、ユーザーの承認なしで機密性の高い財務データを外部サーバーへ送信できてしまう脆弱(ぜいじゃく)性が存在していたことを、AIセキュリティ企業PromptArmorが報告しました。Rampのセキュリティチームは、2026年3月16日に問題を解決したと説明しています。

Authors: PromptArmor

Connect all the things and watch what happens

AtlassianのAIサービス「Atlassian Rovo」に、悪意ある命令を埋め込んだ文書を読み込ませるだけで、JiraやConfluenceの社内データを外部へ送信できる脆弱(ぜいじゃく)性が見つかりました。セキュリティ企業のPromptArmorによると、利用者による送信承認は必要なく、組織の管理者がウェブ検索を無効にしていても攻撃を防げないとのことです。

Microsoft 365 Copilot Coworkにおいて「SharePointやOneDrive上のファイルが間接プロンプト注入によって流出する可能性がある」とAIセキュリティ企業のPromptArmorが報告しています。

Integrating AI agents with third-party services like Gmail, Slack, and Zoom dramatically expands the security attack surface, according to new research from security firm PromptArmor, which found that connectors, the integration bridges between AI platforms and external tools, are changing so rapidly that static security approvals have become dangerously obsolete. PromptArmor analyzed 2,517 connectors across

Das Sicherheitsunternehmen PromptArmor zeigt, wie Atlassians KI-Agent Rovo über versteckte Anweisungen in PDFs sensible Daten aus Jira und Confluence unbemerkt an externe Server weiterleitet. Der Angriff erfordert keine Nutzerbestätigung u…

Connecting an AI agent to your working services transforms a familiar integration into something restless. The access chain to your data never stops shifting. ChatGPT and Claude connectors can quietly acquire new capabilities. They can also pass information onward to third-party AI systems. PromptArmor studied 2,517 connectors and reached a striking conclusion. Across the two catalogues, a connector changes roughly every nine minutes.

Connect all the things and watch what happens

This attack does not require human-in-the-loop approvals, even when in settings the user has explicitly required human approval before ChatGPT edits workbooks. Overview Recently, OpenAI launched an AI extension for using ChatGPT in Google Sheets, which has accumulated over 185,000 downloads since its launch less than a month ago. This allows users to operate on their spreadsheets by interacting with an AI chatbot that lives in a sidebar, with the added benefit of drawing on data from ChatGPT connectors. A single indirect prompt injection attack triggered by a single benign user query can trigger all of the following effects at once: Exfiltration of many workbooks from across the victim’s account Display of an interactive phishing pop-up Overwriting the entire GPT sidebar with an attacker-controlled chatbot interface Attacker-controlled edits to your workbooks This attack occurs when any untrusted data source (e.g., from an imported sheet or ChatGPT connector) manipulates ChatGPT to run an attacker-controlled external script, which executes leveraging permissions the user has granted to the ChatGPT for Google Sheets extension. This vulnerability was responsibly disclosed to OpenAI. Despite multiple follow-ups, we received no communication beyond an automated reply to our initial disclosure. OpenAI's documentation fails to describe sensitive capabilities granted...

Authors: PromptArmor

Attackers can exploit insecure defaults and prompt injection vulnerabilities to turn normal agent behavior into a silent data-exfiltration pipeline. The core issue is not just confusing the AI model; it is manipulating the agent to steal sensitive information without requiring any user interaction. The most alarming demonstration comes from security firm PromptArmor. They revealed how an attacker can force an OpenClaw agent to leak data using a technique called indirect prompt injection combined with messaging app features. 0-Click Attack Chain An attacker hides malicious instructions inside content that the AI agent is expected to read. The agent processes the instructions and generates a URL controlled by the attacker. The agent appends sensitive data, such as API keys or private conversations, into the URL’s query parameters. The agent sends the malicious link back to the user via messaging platforms such as Telegram or Discord. Before the user even clicks the link, the messaging app automatically generates a link preview, silently fetching the URL and handing the sensitive data directly to the attacker. Because the messaging app’s auto-preview feature automatically triggers an outbound HTTP request , this creates a dangerous “no-click” attack. The agent’s response itself becomes the exfiltration event. According to CNCERT, OpenClaw’s default security posture poses significant enterprise risk by allowing agents to browse, execute tasks, or interact with local files. They categorized threats into four main areas: indirect prompt injection via external data, accidental destructive actions, malicious third-party activities, and the exploitation of known product vulnerabilities. OpenClaw is highly useful because it can do real work, but this autonomy makes compromises much more damaging. Messaging integrations where auto-preview behaviors create seamless pathways for data theft . Host and container access that allows prompt manipulation to translate into real-world system actions. A skills ecosystem where unvetted or malicious extensions can drastically widen the attack surface. Proximity to stored secrets, as agents often operate near operational credentials and tokens. As OpenAI recently highlighted, once an agent can retrieve external information and act autonomously, developers must assume that untrusted content will attempt to manipulate the system. Invaders reports that security teams should treat this issue as an architectural flaw rather than a simple AI bug. To protect deployments, organizations should implement the following steps: Disable auto-preview features in Telegram, Discord, Slack , and other channels where AI agents generate URLs. Isolate OpenClaw runtimes inside tightly controlled containers and keep default management ports off the public internet. Restrict unnecessary file system access and keep credentials out of plaintext configuration files. Install agent skills only from trusted sources and manually review third-party code before enabling it. Set up network monitoring to alert on agent-generated links pointing to unfamiliar domains or unexpected DNS lookups. Ultimately, the most important question for security teams is no longer whether an AI model can be manipulated , but rather what a manipulated agent is silently capable of doing next. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post OpenClaw AI Agents Leaking Sensitive Data in Indirect Prompt Injection Attacks appeared first on Cyber Security News .

Two days after GitHub Copilot CLI hit general availability, researchers at PromptArmor published a bypass: a crafted env curl command slips past the validator, downloads a payload from an attacker...