@dangoodin001 just covered our new study on 𝗕𝗲𝘄𝗮𝗿𝗲 𝗼𝗳 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗕𝗼𝘁𝗻𝗲𝘁𝘀 Co-authored by Aya Spira, Stav Cohen, Elad Feldman, Ron Bitton, Avishai Wool, and @ben_nassi . A joint work by @TelAvivUni @TechnionLive @Intuit A link to the the website containing the paper: sites.google.com/view/agenti… #promptware #agents #botnets #agentic_botnet

Zero-click prompt injection? It's a half-click. That's @ben_nassi 's correction to his own use of the term, and on ep. 3 of In the Wild, From Dumbledore to Delayed Tool Invocation, he explains why the gap matters:

Many thanks to @zenitysec_labs and @mbrg0 for hosting me to discuss interesting topics. Here is the second part of the podcast #prompt_injection #LLM #infosec #cybersecurity #promptware

New @zenitysec Labs podcast w/ @mbrg0 + @ben_nassi on where AI security is going next: Prompt injection vs Promptware AI worms Coding agents as hacking tools Agent supply-chain attacks Prompt injection → RCE AI security ownership Why LLM refusals aren't security controls AI vulnerability disclosure is broken The coming “CrowdStrike moment” for AI Full episode in comments 👇

If you work anywhere near AI security, @ben_nassi is someone worth listening to. He joins @zenitysec's @mbrg0 for the inaugural episode of 🎙️#InTheWild🎙️to talk AI worms, promptware, what’s coming next. Tune In🎧 Spotify: lnkd.in/g8AKJWRn Apple: lnkd.in/ghR9_Vm7

A talk with a great friend on tech…

Extremely happy to get a Pwnie! Hacking Agentic Browsers was fun this year! Going to post some technical dives today!

The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next. huggingface.co/blog/agent-in…

Talks from Stanford's Real-World AI Security Conference are now on YouTube! Full list is here seclab.stanford.edu/RealWorl… So many amazing talks, I really liked: 🔹 AI Agents Enable Adaptive Computer Worms, Nicolas Papernot 🔥 🔹 The Road to Hell Is Paved with Helpful Agents, Vitaly Shmatikov 🤯 🔹 Evaluating and Defending Against Prompt Injection Attacks, Edoardo Debenedetti 🐪💥 ...and many more excellent talks covering outstanding research!

AI coding assistants are not just helping developers. HalluSquatting, GhostApproval, and GitLost show how attackers can exploit hallucinated repos, fake package names, private code access, and dangerous approvals. Security Now breaks it down. twit.tv/shows/security-now/e…

הגילוי הנאות של אליסף פרץ

ממשיך באותה הטקטיקה שעבדה לו עד עכשיו. לבוא קטנים לצאת גדולים

The Promptware Kill Chain, by Ben Nassi piped.video/watch?v=JiwSHjBx…

Hackers can use 9 of the most popular AI tools to assemble massive botnets arstechnica.com/security/202… #cybersecurity #computerscience #computerengineering

regulating model access is going to prevent the good guys from gaining access to needed defense tech attackers will just continue to live off your land

You can find the talks from Real World AI Security on a dedicated YouTube channel we opened (many thanks to @danboneh for his efforts in uploading them). There are a few missing videos of speakers who did not permit us to upload their talks. For those who asked me for the slides of my talk, here is the link to the video of my talk on the Promptware Kill Chain (co-authored by @BrodtOleg , Elad Feldman, @schneierblog , and @ben_nassi ) Video (on YouTube): piped.video/JiwSHjBxmqc Paper (arXiv): arxiv.org/abs/2601.09625Real World AI Security (YouTube channel): piped.video/@RealWorldAISecC… #RWAISec #real_word_ai_security #ai #infosec #llm #security #cybersecurity #promptware #prompt_injection

two weeks left on the tokyo agent security summit cfp! we're going to start w early acceptance next week so much cool stuff so far!

@Stanford The Real World AI Security Conference 2026, led by Dan Boneh, was incredible. Personal highlights: - Deep convos on AI agent security with red teamers, blue teamers, researchers, builders, and defenders - Great talks from @wunderwuzzi23 and @ben_nassi - @zenitysec Happy Hour - Robot hacking w/ @BT6_Official at @ARIA_research I had the chance to demo live hacking a ROBOT with @BT6_Official: “Kinetic Prompt Injection: Live Jailbreak of an Embodied Agent” Huge shoutout to my die hard brothers @PhilDursey, @Ph1R3574R73r, and @Eito_Miyamura for the demo. Great seeing @danboneh, @mbrg0, Keren Katz, John Sotiropoulos, Alan Aqrawi, @wunderwuzzi23, and many others pushing this space forward. AI security is moving fast, but AI agent adoption is moving even faster. It was exciting seeing everyone is attacking this problem from so many different angles. There’s still a lot of debate around the role and efficacy of model-level guardrails in defending AI systems. Thanks to @zenitysec for supporting the event. Stay tuned for the robot hacking post. 👀

ted • Visible to anyone on or off LinkedIn My few takeaways from the 1st Real World AI Security Conference. 1. 𝗧𝗲𝘅𝘁𝘂𝗮𝗹 𝗣𝗿𝗼𝗺𝗽𝘁 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻𝘀. Based on the talks given by Google, Anthropic, and OpenAI, I am happy to see that the biggest AI whales improve their mitigations against textual prompt injections. My feeling is that their mitigations are at a level preventing 99.9% of the attacks against their systems, allowing only out-of-distribution attacks to bypass. This is a significant improvement from where we were a year ago, when many studies showed how insecure production systems are. 2. 𝗠𝘂𝗹𝘁𝗶𝗺𝗼𝗱𝗮𝗹 𝗣𝗿𝗼𝗺𝗽𝘁 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻. I am more concerned at this time about multimodal prompt injections because it seems like less progress is invested in this field. My feeling is that most systems remain vulnerable to multimodal prompt injections. Given that many humanoids will be deployed in the next few years, we must invest significant efforts in securing systems in the latent space against multimodal prompt injections. 3. 𝗣𝗿𝗼𝗺𝗽𝘁 𝗜𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝗻 𝘁𝗵𝗲 𝗪𝗶𝗹𝗱. The web is rapidly changing in light of the increasing use of agents. Based on Palo Alto and CISPA talks, I believe that the web has become the most common place to meet "prompt injections in the wild". Whether they succeed or not remains a mystery because we are currently lacking the ability to measure their success rate on the client side. 4. 𝗡𝗲𝘄 𝗧𝗲𝗰𝗵𝗻𝗼𝗹𝗼𝗴𝗶𝗲𝘀 𝘁𝗼 𝗦𝗲𝗰𝘂𝗿𝗲 𝗔𝗴𝗲𝗻𝘁𝘀 Given that the web is rapidly changing in light of the increasing volume of agentic browsing, we will have to develop and adopt new technologies to support this change. I believe newer technologies will be invented in the next few years, and this field will become a focus for academics and industry. 5. 𝗧𝗵𝗲 𝗘𝗳𝗳𝗲𝗰𝘁 𝗼𝗳 𝘁𝗵𝗲 𝗜𝗺𝗽𝗿𝗼𝘃𝗲𝗺𝗲𝗻𝘁 𝗶𝗻 𝗟𝗟𝗠𝘀 𝗼𝗻 𝗦𝗰𝗶𝗲𝗻𝗰𝗲 𝗮𝗻𝗱 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝘆. Based on the talk delivered on how good LLMs have became in finding vulnerabilities in open sources, I expect to see a similar effect in science in general. I am not even sure whether scientists will be the most important leaders in their field in a few years from now, because I believe that most of the significant discoveries will be made by LLMs. Scientists and engineers will have to reinvent themselves in light of these changes. Anything else I forgot? #infosec #ai #agents #LLMs #prompt_injections #AI_Security #real_world_ai_security #RWAISec26

By far, the best way to prompt inject a system nowadays is to #llm #agents #prompt_injection #RWAISec26