Tootfinder

After two glorious weeks off , Metacurity is back with a holiday round-up edition of the top infosec developments you should know, including
--Substation destruction and not cyber expertise likely led to Caracas power outages,
--Denmark says Russia was behind destructive cyberattacks,
--CISA staffers suspended after organizing polygraph test of acting director,
--Chinese cyberattacks on Taiwan jumped in 2025,
--OpenAI says prompt injection attack risks are here t…

Substation destruction and not cyber expertise likely led to Caracas power outages
Denmark says Russia was behind destructive cyberattacks, CISA staffers suspended after organizing polygraph test of acting director, Chinese cyberattacks on Taiwan jumped in 2025, OpenAI says prompt injection attack risks are here to stay, European Space Agency confirms breach, much more

🔧 Prompt sensitivity testing - verify small phrasing changes don't break behavior (formal vs casual openings)
💰 Cost tracking built-in - use cheap model for conversation, smarter model for judging. Budget alerts at $5/month, run tests nightly not on every commit
🎓 Real catches: character breaks, premature agreement, prompt injection leaks, persona drift in long conversations

OpenAI details efforts to secure its ChatGPT Atlas browser against prompt injection attacks, including building an "LLM-based automated attacker" (Rebecca Bellan/TechCrunch)
https://techcrunch.com/2025/12/22/openai-say…

OpenAI says AI browsers may always be vulnerable to prompt injection attacks | TechCrunch
OpenAI says prompt injections will always be a risk for AI browsers with agentic capabilities, like Atlas. But the firm is beefing up its cybersecurity with an "LLM-based automated attacker."

39C3: Sicherheitsforscher kapert KI-Coding-Assistenten mit Prompt Injection | heise online
https://heise.de/-11125630

39C3: Sicherheitsforscher kapert KI-Coding-Assistenten mit Prompt Injection
Auf dem 39C3 zeigte Johann Rehberger, wie leicht sich KI-Coding-Assistenten kapern lassen. Viele Lücken wurden gefixt, doch das Grundproblem bleibt.

Prompt Injection Bugs Found in Official Anthropic Git MCP Server
https://www.infosecurity-magazine.com/news/prompt-injection-bugs-anthropic/

Prompt Injection Bugs Found in Official Anthropic Git MCP Server
Three vulnerabilities in Anthropic's Git server for the MCP can be exploited via prompt injection

MCP all the things.
https://www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/

Anthropic quietly fixed flaws in its Git MCP server that allowed for remote code execution
: Prompt injection for the win

How an indirect prompt injection can manipulate Google's Antigravity IDE to invoke a malicious browser subagent and exfiltrate data; Google is working on a fix (PromptArmor)
https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data

Google Antigravity Exfiltrates Data
An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order to steal credentials and sensitive code from a user’s IDE.

UK intelligence warns AI 'prompt injection' attacks might never go away https://therecord.media/prompt-injection-attacks-uk-intelligence-warning

Evidence that AI is normal technology include AI systems that are good enough to be useful but not good enough to be trusted, continuing to require human oversight that limits productivity gains;
prompt injection and security vulnerabilities remain unsolved, constraining what agents can be trusted to do;
domain complexity continues to defeat generalization, and what works in coding doesn’t transfer to medicine, law, science;
regulatory and liability barriers prove high enou…

What If? AI in 2026 and Beyond
The market is betting that AI is an unprecedented technology breakthrough, valuing Sam Altman and Jensen Huang like demigods already astride the world. The

In this world nothing can be said to be certain except death, taxes and LLM will dutifuly exfiltrate your data via a hidden prompt:
https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files

Claude Cowork Exfiltrates Files
Claude Cowork is vulnerable to file exfiltration attacks via indirect prompt injection as a result of known-but-unresolved isolation flaws in Claude's code execution environment.

So many predictions saying how AI and crypto will converge this year, because agents need to pay.
I look forward to it. Merging a famous fractal scam industry (as meticulously documented by @…) with a technology that still haven't taken even a stab at solving prompt injection (as meticulously documented by @…

Happy Saturday! Metacurity offers our free and premium subscribers a weekly digest of the best long-form (and longish) infosec-related pieces we couldn't properly fit into our daily news crush.
This week's selection covers
--The untouchable hacker god who destroyed psychotherapy patients,
--AI prompt injection is an unsolvable problem,
--Deepfakes are messing up Canada's justice system,
--What the hack of Russia's Unified Military Registry revea…

Best infosec-related long reads for the week of 1/17/26
The untouchable hacker god who destroyed psychotherapy patients, AI prompt injection is an unsolvable problem, Deepfakes are messing up Canada's justice system, What the hack of Russia's Unified Military Registry revealed, The US military needs to accelerate its tests of AI trustworthiness

Anthropic says Claude Opus 4.5 is "harder to trick with prompt injection than any other frontier model in the industry" but isn't "immune" to such attacks (Hayden Field/The Verge)
https://www.theverge.com/ai-artificial-int

Anthropic’s new model is its latest frontier in the AI agent battle — but it’s still facing cybersecurity concerns
Claude Opus 4.5 is out today.

Check out today's Metacurity for the most critical infosec developments you might have missed over the weekend, including
--77,000-plus IP addresses are vulnerable to maximum severity React2Shell flaw,
--NCSC warns prompt injection threats might be forever,
--Apple and Google issue new spyware warnings,
--Apache Tika critical flaw allows XXE injection attacks,
--Japanese high school student accused of using ChatGPT to attack internet cafe chain,
--US is…

77,000-plus IP addresses are vulnerable to maximum severity React2Shell flaw
NCSC warns prompt injection threats might be forever, Apple and Google issue new spyware warnings, Apache Tika critical flaw allows XXE injection attacks, Japanese high school student accused of using ChatGPT to attack internet cafe chain, US issues $10m reward for Iranian hackers, much more