Prompt-Jacking: The Rise of a New Supply Chain Risk

on YouTube ↗01h 02m

" summary

Findings show Cursor arbitrary code execution and data exfiltration by hiding commands in raw README comments and mermaid diagrams that trigger ls+curl to leak SSH keys; an initial CVE is patched then another appears within about 2 hours. A WeezyPrint 2024 flaw (patched in v61.2) still allows local-file attachment to PDFs. OpenWebUI exposure counts about 18,000 instances, and a GitLab auto-triager and MCP/skill metadata let attackers enumerate repos, override tools, and propagate payloads; guardrails and tokenization defenses often fail.

AI-written summary · about

" chapters (30)

1. 0:00AI agent security risks
2. 1:14Speaker background
3. 2:16Traditional vs AI-specific vulnerabilities
4. 3:39Hidden prompt injection in README files
5. 6:07Command injection in agent tools
6. 8:11Indirect prompt injections via web requests
7. 10:18Indirect prompt injection explained
8. 13:04Data exfiltration via mermaid diagrams
9. 15:12WeezyPrint PDF vulnerabilities
10. 19:07Research methodology
11. 20:08Virus propagation in agentic systems
12. 21:13Instruction hierarchy in LMs
13. 24:41Exploiting control tokens
14. 25:43Control sequences vs tokens
15. 29:57Architectural weaknesses in agents
16. 30:38Open Web UI vulnerabilities
17. 33:23Pull request security risks
18. 36:34Resume checkerbot flaws
19. 39:25Model Context Protocol pitfalls
20. 42:54MCP tool conflict attacks
21. 43:43Leaking system prompts via MCP
22. 45:28OpenClaw autonomous agent flaws
23. 47:13Skill injection in OpenClaw
24. 49:20Auditing AI agent skills
25. 51:07Guardrails for AI systems
26. 52:54Bypassing LLM-as-judge guardrails
27. 54:38Tokenization attacks on models
28. 57:48Mitigation strategies
29. 59:32DefCon 2024 results
30. 1:00:35Key takeaways

" related talks

• 45mPrompt-Jacking: The Rise of a New Supply Chain RiskKasimir Schulz, Kenneth Yeung · NDC AI 2025
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 36mExploiting Vulnerabilities and Flaws to Attack Supply ChainYakir Kadkoda, Ilay Goldman · RSA Conference 2023
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System TakeoversSuyash Nalawade · DevConf.US 2025
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019
• 50mStranger Danger: Your Java Attack Surface Just Got BiggerBrian Vermeer · Voxxed Days Cluj 2023
• 40mLive hacking: Breaking into your web appBrian Vermeer · Codemotion Berlin 2019