Top all-time · #1179
Embrace The Red - Cybersecurity Attacks and Red Team Strategies
Personal blog · embracethered.com · on HN as wunderwuzzi23securityai
Embrace The Red - Cybersecurity Attacks and Red Team Strategies is a personal blog at embracethered.com about security and ai. Since 2020, 61 different Hacker News readers have linked it 212 times, most often “Hacking Google Bard: From Prompt Injection to Data Exfiltration”. No feed was found, so read it on the site itself.
Most-linked posts?
- Hacking Google Bard: From Prompt Injection to Data Exfiltration8 people · 10 mentions · first linked 2023-11-03
- Image Scaling Attacks8 people · 8 mentions · first linked 2020-10-29
- The Normalization of Deviance in AI7 people · 9 mentions · first linked 2025-12-05
- Security Advisory: Anthropic's Slack MCP Server Vulnerable to Data Exfiltration5 people · 5 mentions · first linked 2025-06-25
- Cross-Agent Privilege Escalation: When Agents Free Each Other4 people · 5 mentions · first linked 2025-09-24
- Breaking Claude Code Opus 5 Auto Mode4 people · 4 mentions · first linked 2026-08-28
- /blog/4 people · 4 mentions · first linked 2023-12-07
- ASCII Smuggler: Hiding text in plain sight4 people · 4 mentions · first linked 2024-01-23
- Security ProbLLMs in XAI's Grok4 people · 4 mentions · first linked 2024-12-17
- Plugin Vulnerabilities: Visit a Website and Have Your Source Code Stolen3 people · 5 mentions · first linked 2023-06-21
What Hacker News says?
A 30 second search turned up this [1] from two days ago. Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front. [1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55... [2] https://x.com/bcherny/status/2086520950259118464 [3] https://embracethered.com/blog/posts/2026/breaking-claude-co...
Comment linking /blog/posts/2026/breaking-claude-code-opus-5-and-automode
on “Backdoor in Claude Code for VS Code extension on the Cursor Marketplace”Submitted Image Scaling Attacks as a story · 431 points
HN discussionThis is just another "rebranding" of the failed "prompt engineering" trend to promote another borderline pseudo-scientific trend to attact more VC money to fund a new pyramid scheme. Assuming that this will be using the totally flawed MCP protocol, I can only see more cases of data exfiltration attacks on these AI systems just like before [0] [1]. Prompt injection + Data exfiltration is the new social engineering in…
Comment linking /blog/posts/2025/security-advisory-anthropic-slack-mcp-server-data-leakage/
on “The new skill in AI is not prompting, it's context engineering”Submitted Breaking Claude Code Opus 5 Auto Mode as a story · 399 points
HN discussionYes, I can. This is just one possible strategy: there are many others, where different things are done, and where things are done in a different order. You use the collider [1] and one of the many scaling attacks ([2] [3] [4], just the ones linked in this thread) to create an image that matches the hash of a reasonably fresh CSAM image currently circulating on the Internet, and resizes to some legal sexual or violen…
Comment linking /blog/posts/2020/husky-ai-image-rescaling-attacks/
on “ImageNet contains naturally occurring Apple NeuralHash collisions”Submitted ZombAIs: From Prompt Injection to C2 with Claude Computer Use as a story · 166 points
HN discussionThe problem is that it is a scaled low-res version. There are well publicized attacks[1] showing you can completely change the contents of the image post scaling. There's also the added problem that if the scaled down image is small, even without the attack, it's impossible to make a reasonable human judgement call (as OP points out). The problem isn't CSAM scanning in principle. The problem is that the shift to the…
Comment linking /blog/posts/2020/husky-ai-image-rescaling-attacks/
on “ImageNet contains naturally occurring Apple NeuralHash collisions”Submitted GitHub Copilot: Remote Code Execution via Prompt Injection (CVE-2025-53773) as a story · 128 points
HN discussionExcellent concrete examples with video demos here: https://embracethered.com/blog/ The researcher has gotten actual shells on oai machines before via prompt injection
Comment linking /blog/
on “Claude Code 2.0”Submitted GitHub Copilot: Remote code execution via prompt injection (CVE-2025-53773) as a story · 15 points
HN discussionThis is cool. There are also the Unicode Tag characters that mirror ASCII and are often invisible in UI elements (especially web apps). The unique thing about Tag characters is that some LLMs interpret the hidden text as ASCII and follow instructions, and they can even write them: https://embracethered.com/blog/posts/2024/hiding-and-finding... Here an actual exploit POC that Microsoft fixed in Copilot: https://embra…
Comment linking /blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/
on “Smuggling arbitrary data through an emoji”Submitted Breaking Claude Code Opus 5 Auto Mode as a story · 10 points
HN discussionMore reports of similar vulnerabilities in Antigravity from Johann Rehberger: https://embracethered.com/blog/posts/2025/security-keeps-goo... He links to this page on the Google vulnerability reporting program: https://bughunters.google.com/learn/invalid-reports/google-p... That page says that exfiltration attacks against the browser agent are "known issues" that are not eligible for reward (they are already working…
Comment linking /blog/posts/2025/security-keeps-google-antigravity-grounded/
on “Google Antigravity exfiltrates data via indirect prompt injection attack”Submitted ASCII Smuggler: Hiding text in plain sight as a story · 8 points
HN discussionCool stuff. Interestingly, I responsibly disclosed that same vulnerability to Google last week (even using the same domain bypass with webhook.site). For other (publicly) known issues in Antigravity, including remote command execution, see my blog post from today: https://embracethered.com/blog/posts/2025/security-keeps-goo...
Comment linking /blog/posts/2025/security-keeps-google-antigravity-grounded/
on “Google Antigravity exfiltrates data via indirect prompt injection attack”Submitted Breaking Claude Code Opus 5 Auto Mode as a story · 7 points
HN discussionIt still is. plus there are many more issue. i documented some here: https://embracethered.com/blog/posts/2025/security-keeps-goo...
Comment linking /blog/posts/2025/security-keeps-google-antigravity-grounded/
on “Google Antigravity exfiltrates data via indirect prompt injection attack”Submitted The Normalization of Deviance in AI as a story · 7 points
HN discussionThat's cool. I did something similar in the early days with Google Bard when data visualization was added, which I believe was when the ability to run code got introduced. One question I always had was what the user "grte" stands for... Btw. here the tricks I used back then to scrape the file system: https://embracethered.com/blog/posts/2024/exploring-google-b...
Comment linking /blog/posts/2024/exploring-google-bard-vm/
on “We hacked Gemini's Python sandbox and leaked its source code (at least some)”Submitted GitHub Copilot: From Prompt Injection to Data Exfiltration as a story · 7 points
HN discussionAbout that find command... Amazon Q Developer: Remote Code Execution with Prompt Injection https://embracethered.com/blog/posts/2025/amazon-q-developer...
Comment linking /blog/posts/2025/amazon-q-developer-remote-code-execution/
on “Comet AI browser can get prompt injected from any site, drain your bank account”Submitted ChatGPT: Hacking Memories with Prompt Injection as a story · 7 points
HN discussionI'm a Master's student in Artificial Intelligence at UofT. Right now, I'm adding the "ML (Machine Learning) Streaming" feature to PyMilo. PyMilo is an open-source Python package that provides a transparent, safe, and end-to-end way for users to export pre-trained machine-learning models. Transparency and non-executable export format is a serious thing, take a look at https://embracethered.com/blog/posts/2022/machine…
Comment linking /blog/posts/2022/machine-learning-attack-series-injecting-code-pickle-files/
on “Ask HN: What are you working on (August 2024)?”Submitted AgentHopper: An AI Virus as a story · 6 points
HN discussionRelated. Here is info on how custom tools added via MCP are defined, you can even add fake tools and trick Claude to call them, even though they don't exist. This shows how tool metadata is added to system prompt here: https://embracethered.com/blog/posts/2025/model-context-prot...
Comment linking /blog/posts/2025/model-context-protocol-security-risks-and-exploits/
on “Claude's system prompt is over 24k tokens with tools”Submitted Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets as a story · 6 points
HN discussionYour comment reminds me that when I first wrote about MCP it reminded me of COM/DCOM and how this was a bit of a nightmare, and we ended up with the infamous "DLL Hell"... Let's see how MCP will go. https://embracethered.com/blog/posts/2025/model-context-prot...
Comment linking /blog/posts/2025/model-context-protocol-security-risks-and-exploits/
on “A critical look at MCP”Submitted Security ProbLLMs in XAI's Grok as a story · 6 points
HN discussionCorrect. That's just focused on the zero click scenario of unfurling. The tricky part with a markdown link (as shown in the Slack AI POC) is that the actual URL is not directly visible in the UI. When rendering a full hyperlink in the UI a similar result can actually be achieved via ASCII Smuggling, where an attacker appends invisible Unicode tag characters to a hyperlink (some demos here: https://embracethered.com/…
Comment linking /blog/posts/2024/ascii-smuggling-and-hidden-prompt-instructions/
on “Data Exfiltration from Slack AI via indirect prompt injection”Submitted ASCII Smuggler: Crafting and Decoding Invisible Text Using Unicode Tags as a story · 6 points
HN discussion
