Prompt Injection

Anthropic engineers said Claude Code is slated to add model training, probes, and auto-mode layers by default next week. They said Claude models now largely resist practical prompt injection.

Anthropic says Claude Code auto mode becomes the default for Pro, Max, and Team users on August 14. Its tool-call classifier caught 89% of dangerous commands in a 1,053-tester study, versus 14% for manual approval.

A UW study found coding agents can refuse malicious memory-file instructions while preserving the payload for later use. The state-management debate also covered callable memories, reusable skills, and session-history eval pipelines.

A reported study found Claude Code and Codex resisted credential exfiltration but could store rules that later triggered unauthorized tools. Related memory work warns personal memories can raise hallucinations and RAM pressure.

Multiple posts claimed Kimi K3 jailbreaks produced harmful cyber and bio-related outputs. Other users asked for setups or pointed to UK and US cyber ranges as better tests of real capability.

OpenAI described GPT-Red as an automated red-teaming model for finding prompt-injection vulnerabilities. Posts say it was used in self-play-style training to improve GPT-5.6 robustness.

Practitioners reported coding agents following outdated agents.md files and generic project instructions. Other posts tied long-context drift and weak domain language to cleanup-heavy coding runs.

Posts claimed to publish GPT-5.6 Sol’s Codex Desktop system prompt and tool list, with follow-ups linking full files and highlighting the prompt’s size. The leak is unverified, so the consequence is an alleged security and prompt-injection exposure rather than confirmed vendor behavior.

Goodside and other testers shared chat links where GPT-5.6 Sol, and sometimes Claude Fable 5, hallucinated hidden messages in noise images or meaningless scribbles. Higher effort settings sometimes did better, but failures reproduced.

Riley Goodside tested random-noise and scribble images with no hidden message. GPT-5.6 Sol often produced invented text, while Claude Fable 5 more often refused or identified the image as non-writing.

OpenAI expanded Lockdown Mode from organizations to personal and self-serve Business accounts, adding an opt-in setting that limits outbound network requests. The feature is meant to block the final exfiltration step in prompt-injection attacks, though malicious instructions can still affect responses.

OpenRouter released Guardrails to apply budget limits, provider restrictions, zero-data-retention rules, prompt-injection defense, and DLP checks across routed traffic. Google Model Armor and Lakera Guard connectors are in beta, so plan around limited availability.

TimescaleDB added a read-only MCP mode, practitioners pushed credential brokering, and an OpenClaw user open-sourced a skill-quarantine review pipeline. That matters because secret handling and destructive permissions are moving out of prompts and into brokered or reviewable control layers.

OpenAI added Chronicle, a Codex preview that turns recent screen context into reusable memories for errors, files, docs, and workflows. The macOS Pro-only feature stores local memory unencrypted and can burn rate limits quickly, so watch prompt-injection risk before relying on it.

Sentinel Gateway promoted tool-scoped execution controls, Agent v0 shipped OS sandboxing plus hash-chain logs, and NeoBild published a 336-round Termux CVE loop. Use these controls to constrain agent actions and run security analysis locally.

OpenClaw's maintainer asked users to switch to the dev channel and stress normal workflows before a large release that may break plugins. Watch harness speed, context plugins, and permission boundaries closely while the SDK refactor lands.

Anthropic's Opus 4.6 system card shows indirect prompt injection attacks can still succeed 14.8% of the time over 100 attempts. Treat browsing agents and prompt secrecy as defense-in-depth problems, not solved product features.

Security coverage around OpenClaw intensified with a report on indirect prompt injection and data exfiltration risks, while KiloClaw published an independent assessment of its hosted isolation layers. Review your default configs and sandbox boundaries before exposing agents to untrusted web or tenant data.