CONTROLLED EVALUATION
OpenAI Operator: indirect prompt injection becomes an action risk
OpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.
What this was
Controlled evaluation / research-preview safety testing—not a reported customer breach, autonomous escape, or compromise.
What happened
OpenAI’s January 2025 Operator System Card documented internal and external red teaming of its browser-using agent against adversarial instructions placed in test websites, emails, databases, and other mock environments. OpenAI reported 23% susceptibility across 31 automatically checkable final-model scenarios, compared with 62% with no mitigations and 47% with prompting alone. A separate prompt-injection monitor achieved 99% recall and 90% precision on 77 red-team-created attempts. OpenAI states that known cases were mitigated while prompt injection remains an ongoing concern. These are evaluation findings, not evidence that an attacker breached a customer or that Operator escaped control.
Why an agent changes the risk
A conventional application can render untrusted content; an agent may interpret that same content, combine it with private context, and use connected tools. The risk is the path from attacker-controlled instruction to a sensitive action or data flow.
How to test for this
- Red-team indirect prompt injection end to end: seed malicious instructions in representative webpages, email, documents, and tool outputs, then measure both agent susceptibility and monitor performance.
- Keep a strict trust boundary: treat external content as data, never developer instruction, and pass only validated, schema-constrained fields between agent nodes and tools.
- Exercise sensitive tool paths with least privilege, watch mode, and human approval gates—attempting unauthorized reads, writes, exports, and high-impact actions triggered by untrusted content.
Other cases
CONFIRMED INTRUSION
Hugging Face, July 2026: an autonomous agent ran the intrusion end to end
A malicious dataset chained two code-execution paths into node-level access and lateral movement across internal clusters, driven by an attacker framework that executed roughly 17,000 individual actions.
CONFIRMED INTRUSION
Vercel, April 2026: a small third-party AI tool became everyone's problem
An attacker compromised Context.ai, then used an employee's Google Workspace OAuth grant to reach Vercel's internal systems and decrypt non-sensitive environment variables.
SUPPLY CHAIN COMPROMISE
LiteLLM, March 2026: a compromised scanner poisoned an AI gateway
TeamPCP compromised the Trivy CI pipeline, used that access to obtain LiteLLM's PyPI publishing tokens, and shipped a credential stealer in two releases of a package with roughly 95 million monthly downloads.
COORDINATED DISCLOSURE
Opening a repository was enough: pre-trust execution in a coding agent
A repository-controlled config file made a coding agent run attacker commands before its own trust dialog appeared, turning cloning a project into code execution.
CONTROLLED EVALUATION
Anthropic’s agentic-misalignment evaluation: model access can resemble an insider threat
Anthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.
VENDOR-REPORTED DISRUPTION
Anthropic’s cybercrime disruption report: an agent can amplify a human attacker
Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.
COORDINATED DISCLOSURE
nullifAI: malicious PyTorch models evaded pickle scanning on Hugging Face
Researchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.