veganmosfet

7 ms·

31.
Show HN: Prompt Injection Experiments in OpenClaw with Opus4.6(veganmosfet.codeberg.page)
2 points by veganmosfet 7mo ago|0 comments
32.
by veganmosfet 7mo ago
This! And even more, the role model extends beyond system and user: system > user > tool > assistant. This reflects "authority" and is one of the best "countermeasure": never inject untrusted content in "us
33.
BrokenClaw Part 3: Remote Code Execution in OpenClaw via Email Again(veganmosfet.codeberg.page)
1 points by veganmosfet 8mo ago|1 comments
34.
by veganmosfet 8mo ago
Third part of the BrokenClaw saga! This time, Remote Code Execution via email using gogcli as email tool, no hook. Based only on the email content from a tool, the model (opus4.6) ignores all warnings, pipes a python script to the python3 i
35.
BrokenClaw – RCE in OpenClaw via Gmail Hook(veganmosfet.codeberg.page)
2 points by veganmosfet 8mo ago|1 comments
36.
by veganmosfet 8mo ago
I experimented with OpenClaw (using opus4.6 and gpt5.2) and found this interesting way to get silent Remote Code Execution via email when using Gmail pub/sub Hook, exploiting prompt injection (out of scope from the security policy of O
37.
by veganmosfet 8mo ago
Nice idea! But OpenClaw is not stateless - it learns it's under attack / plays a CTF and gets overparanoid (and opus 4.6 is already paranoid). It seems now it summarizes all emails with "Thread contains 1 me" (a new pers
38.
by veganmosfet 8mo ago
Second part of the saga, now escaping sandbox with multi-layered prompt injection: BrokenClaws: Escape the Sub-Agent Sandbox with Indirect Prompt Injection in OpenClaw (via Gmail Hook, 0-Click RCE) https://veganmosfet.github.io&#
39.
by veganmosfet 8mo ago
The issue with filtering tags: LLM still react to tags with typos or otherwise small changes. It makes sanitization an impossible problem (!= standard programs). Agree with policies, good idea.
40.
by veganmosfet 8mo ago
There is no silver bullet, but my point is: it's possible to lower the risk. Try out by yourself with a frontier model and an otherwise 'secure' system: the "ignore previous instructions" and co. are not working any
41.
by veganmosfet 8mo ago
Agree for a general AI assistant, which has the same permissions and access as the assisted human => Disaster. I experimented with OpenClaw and it has a lot of issues. The best: prompt injection attacks are "out of scope" from
42.
by veganmosfet 8mo ago
Imho a combination of different layers and methods can reduce the risk (but it's not 0): * Use frontier LLMs - they have the best detection. A good system prompt can also help a lot (most authoritative channel). * Reduce downstream pe
43.
by veganmosfet 8mo ago
Regarding prompt injection: it's possible to reduce the risk dramatically by: 1. Using opus4.6 or gpt5.2 (frontier models, better safety). These models are paranoid. 2. Restrict downstream tool usage and permissions for each agentic
44.
by veganmosfet 8mo ago
It's still bad, even if they fixed some low hanging fruits. Main issue: prompt injection when using the LLM "user" channel with untrusted content (even with countermeasures and frontier model) combined with insecure config &#
45.
by veganmosfet 8mo ago
[Update] Now with opus4.6 and latest version.
46.
0-Click Remote Code Execution in OpenClaw with GPT5.2 via Gmail Hook(veganmosfet.github.io)
4 points by veganmosfet 8mo ago|3 comments
47.
by veganmosfet 8mo ago
Yet another "OpenClaw is insecure" post! I found this simple but elegant way to get silent RCE via email, exploiting prompt injection (despite countermeasures, there is no silver bullet) and insecure plugin handling (not skills!)
48.
Models, Agents and Prompt Injections – Some Experiments(veganmosfet.github.io)
1 points by veganmosfet 11mo ago|0 comments
49.
The Nx Supply Chain Attack: How to Reproduce the First Steps(veganmosfet.github.io)
2 points by veganmosfet 1y ago|1 comments
50.
by veganmosfet 1y ago
I read the post-mortem analysis of the nx S1ngularity supply chain attack and found the attack vector quite interesting. In this post, I will explain how to reproduce the first steps (though I am not 100% sure if this is exactly what happen
51.
by veganmosfet 1y ago
I tried this on Gemini CLI and it worked, just add some magic vibes ;-)
52.
by veganmosfet 1y ago
Yes, adding manual checkpoints between the LLM and the tools can help. But then users get UI fatigue and click 'allow always'.
53.
by veganmosfet 1y ago
Is the CaMel paper's idea implemented in some available agents?
54.
by veganmosfet 1y ago
As possible mitigation, they mention "The browser should distinguish between user instructions and website content". I don't see how this can be achieved in a reliable way with LLMs tbh. You can add fancy instructions (e.g.,
55.
Playing with Gemini CLI: Riddles, Magic and Some Security Vibes(veganmosfet.github.io)
3 points by veganmosfet 1y ago|0 comments
56.
by veganmosfet 1y ago
I experimented with MCP and was surprised how simple 'indirect prompt injection' is (and I don't want to sell any countermeasures). People are now creating MCP servers for OT (factories); combined with untrusted input process
57.
From Prompt to Plant Shutdown: Agent Context Contamination in MCP(veganmosfet.github.io)
4 points by veganmosfet 1y ago|1 comments
58.
Solutions for PV Cyber Risks to Grid Stability [pdf](api.solarpowereurope.org)
3 points by veganmosfet 1y ago|0 comments
59.
Sun: Down – A Dark Side to Power Grids(forescout.com)
2 points by veganmosfet 2y ago|1 comments
60.
by veganmosfet 2y ago
"Our findings show an ecosystem that is insecure — with dangerous energy and national security implications. While each residential solar system produces limited power, their combined output reaches dozens of gigawatts — making their c

More ›