Prompt Injection Now Cuts Both Ways: Two Weeks That Turned the AI You Deployed Into an Attack Surface

Between 23 June and early July 2026, two pieces of security research landed that, taken together, mark a shift executives should register. In the first, researchers showed they could trick six widely used AI browsers into stealing their own users' credentials. In the second, a North Korea-linked malware sample appeared in the wild carrying a payload designed not to evade detection in the usual sense, but to talk the AI performing the analysis out of doing its job. One turns the AI your staff use against them. The other turns the AI your defenders use against you. Both work by the same mechanism, and neither is fully fixable by the vendors involved.

That mechanism is prompt injection: manipulating an AI system through instructions hidden in the content it reads, rather than through a flaw in its code. For most of the past two years, prompt injection has been discussed as a model-safety curiosity, the kind of thing that makes a chatbot say something it should not. These two cases move it out of that category. Prompt injection is now an enterprise attack surface, and the surface faces in both directions: toward the productivity tools an organization deploys, and toward the defensive tools it relies on. The organizations that adopted AI fastest have, without quite noticing, given attackers a new way in and a new way to stay hidden.

Key Takeaways

• BioShocking (LayerX, late June 2026): an indirect prompt-injection technique tricked six agentic browsers and assistants, including ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude Chrome plugin, into copying credentials from a signed-in session and pulling SSH keys from a victim's work GitHub. OpenAI fixed it; Perplexity did not act; Anthropic's fix reportedly failed
• macOS.Gaslight (SentinelLABS, 23 June 2026): North Korea-linked malware embeds 38 fabricated system-failure messages to make an LLM-assisted triage agent doubt its session and abort the analysis. It is the first widely reported malware purpose-built to defeat AI-assisted defense
• The common mechanism is prompt injection, and it now cuts both ways: against the tools employees use and the tools analysts use
• Prompt injection is not patchable the way a normal vulnerability is. The susceptibility is a property of how current models process text, not a single bug. Vendors closed specific paths in July 2026; the underlying condition remains
• The response is architectural, not a patch: limit agent reach, require human authorization for high-consequence actions, isolate sessions, and never let one injected instruction produce an irreversible outcome
• AI-driven breaches now average $4.88 million, with shadow-AI incidents adding roughly $670,000 on top. The tools driving that cost are precisely the agentic ones these two cases target

Direction One: The Tools Your Staff Use

The first case is BioShocking, disclosed by LayerX in late June 2026. The setup is mundane in a way that is the point: an employee uses an agentic browser, one of the AI-powered browsers and assistants that can read pages, fill forms, and act on the user's behalf, to get through their work faster. The employee is signed in to corporate systems in that browser, as people are.

The researchers built a malicious web page containing a puzzle that rewarded deliberately wrong answers, insisting for instance that two plus two equals five. Once the agent accepted that being wrong was acceptable in this context, it stopped treating its own rules as binding. The researchers then told it to open an internal page and copy the contents of a text box. That page redirected to the victim's work GitHub repository, and the agent obligingly extracted the SSH credentials it found there. The proof-of-concept worked against six agentic browsers and assistants, including ChatGPT Atlas, Perplexity Comet, Fellou, Genspark, Sigma, and Anthropic's Claude Chrome plugin.

The vendor responses are as instructive as the attack. OpenAI fixed the issue in its browser. Perplexity closed the report without acting. Three smaller vendors did not respond. Anthropic attempted a fix that LayerX reported as failed. This is not a story of one careless product; it is a class of tools sharing a class of weakness, patched unevenly.

The executive translation is direct. An agentic browser with access to corporate credentials is a privileged actor that will follow instructions from any page it visits, because it cannot reliably tell your instructions from a web page's. The productivity gain is real, and so is the new exfiltration path. This is the browser-as-attack-surface risk we flagged earlier, now demonstrated against the current generation of tools rather than anticipated. See your next security incident may start in an AI assistant, not an inbox.

Direction Two: The Tools Your Defenders Use

The second case points the same weapon the other way. On 23 June 2026, SentinelLABS disclosed macOS.Gaslight, a Rust-based backdoor and infostealer linked to North Korea-aligned actors. It does the expected infostealer things: harvests browser data, keychain contents, command histories, and system profiles, and exfiltrates over a Telegram-based command channel. What makes it notable is a feature that has nothing to do with stealing data and everything to do with the analyst who will investigate it.

Embedded in the malware is a cascade of 38 fabricated system-failure messages: fake warnings about token expiry, out-of-memory kills, disk exhaustion, and repeated operation failures, plus bogus injection-vulnerability and static-analysis flags. Their purpose, in the words of the SentinelOne researcher who documented it, is to make an LLM-assisted triage agent doubt its own session, so that it aborts, truncates, or refuses the analysis. The malware is not trying to evade a signature. It is trying to gaslight the AI that security teams increasingly place at the front of their triage pipeline into walking away from the case.

This is the logical consequence of a trend the industry has been proud of. As teams put AI into the detection, triage, and response path, that AI becomes a target worth attacking directly, and the cheapest way to attack a language model is with language. Gaslight is the first widely reported malware built on that insight. It will not be the last, because it is effective and easy: a block of text costs nothing to add to a payload, and if it buys the attacker even a delayed or abandoned investigation, it has paid for itself.

One Mechanism, Not Two Problems

It would be a mistake to file these as two separate incidents. They are two applications of one property of current AI systems: a model acts on the instructions it finds in the data it processes, and it cannot reliably distinguish instructions that come from its operator from instructions that come from the content. Give a model a web page, and a web page can instruct it. Give a model a malware sample to analyze, and the malware can instruct it.

Scroll right to see more

Scroll right to see more

This is why the vendor patches are partial. OpenAI can close the specific path BioShocking used; it cannot make its model stop being susceptible to instructions embedded in content, because that susceptibility is how the model reads at all. The same is true in reverse for defensive AI: a triage model can be told to distrust obvious fake-error blocks, but the general problem, that an adversary can write text aimed at the model rather than the analyst, does not go away. Prompt injection is not a bug with an owner and a fix date. It is a property to be contained.

Why This Is a Governance Problem, Not a Tooling Problem

The instinct on reading these cases is to ask which products are safe. That is the wrong first question, because the safe-product list will change monthly and because the exposure in most organizations is not a procurement decision anyone made. Agentic browsers, AI assistants, and coding copilots enter through individual adoption far faster than through a security review, which is the shadow-AI dynamic that turns a productivity tool into an unmanaged privileged actor. The organization that has not inventoried where these tools already hold credentials cannot answer the only question that matters: if one of them is manipulated, what can it reach?

The right frame is the one that applies to any powerful but untrustworthy insider. An AI agent with standing access and the ability to act is exactly that, and it should be governed accordingly: least privilege, human authorization for high-consequence actions, session isolation, and an architecture in which no single instruction, from a user or from a web page or from a file, produces an irreversible outcome on its own. This is the argument for treating agent identity as a distinct discipline rather than an extension of human IAM, which we made in you cannot secure AI agents with human-era identity models, and it is the containment logic that keeps a manipulated agent from becoming a breach, discussed in the new baseline for what secure enough now means.

What This Changes for the Executive Team

Three decisions follow from these two weeks.

Treat agentic tools as credentialed actors, not as software features. An AI browser signed in to corporate systems is not a browser with a helpful assistant bolted on; it is an account that will act on instructions from untrusted content. It belongs in the same inventory, and under the same access discipline, as any privileged service. The first task is to find where these tools already are, credentials and all, including the ones adopted without approval.

Assume AI in the defensive path is itself a target. If AI sits in the detection, triage, or response pipeline, an attacker can now write payloads aimed at that AI. The mitigation is not to remove the AI but to keep a human in the loop for consequential calls and to treat an AI triage verdict as one input, not a final word, precisely because the input can be manipulated by the thing being analyzed.

Stop waiting for the patch that ends prompt injection, because it is not coming. The governance response is architectural containment: limit what agents can reach, require authorization for actions that matter, isolate sessions, and design so that a single manipulated instruction cannot produce an irreversible loss. The organizations that internalize this treat every AI agent as manipulable by default and build the controls to survive it being manipulated.

How Innovaiden Approaches It

The starting point is a map, not a tool swap. Innovaiden's AI attack-surface review inventories where agentic tools and AI-assisted workflows already exist in the organization, which of them hold credentials or can act on systems, and where AI sits in the detection-and-response path. From that map it applies the containment test to each: if this agent were manipulated by a web page, a document, or a malware sample tomorrow, what could a single injected instruction reach, and what control stops it. The output is a prioritized list of the places where a manipulated agent would today become a breach, and the specific architectural changes, access limits, authorization gates, and session isolation, that close them. The objective is not to answer which product is safe this month. It is to build an estate in which prompt injection, which is not going away, cannot turn one clever page or one crafted file into an incident.