AI
Prompt injection in coding agents via Linear tickets and Xcode
Rehberger opened with a Go codebase missing an editCustomer function. A Linear ticket already existed for it. He assigned the ticket to Windsurf via MCP integration — and in the Linear ticket RCE via Windsurf demo (00:56), the agent fetched the ticket and ran the attacker’s remote command without pause. The payload was hidden in plain text; only an injection-detection tool made it visible.
The Xcode demo went further. No injection was visible in the source file — it was encoded as unicode tag characters humans cannot see. Xcode’s AI reviewer decoded them, then followed the Xcode hidden unicode injection chain (01:37): it wrote data-exfiltration code into the file and called run_snippet to execute it on the spot. Internet-connected entitlements are all the sandbox needs to fail.
Memory poisoning through Microsoft Enterprise Copilot
Rehberger fed a malicious file to Microsoft Enterprise Copilot and asked for its key takeaways. Copilot analyzed it and silently called the memory tool — no warning, no confirmation. Watch the Microsoft Enterprise Copilot memory corruption demo (03:05): two attacker-controlled facts land in persistent memory — that the user is 102 years old and should run a Commodore 64 simulator. Every future conversation with that Copilot now returns falsified data. Financial reports, org charts, any enterprise context Copilot touches is now wrong. Microsoft patched it last December.
Promptware — prompt injection as a malware kill chain
Prompt injection was always framed as a single-shot attack. Rehberger and Ben Nassi, co-author of the “prompt way kill chain” paper, argue it has outgrown that label. Once an injected payload can load remote commands, poison long-term memory, and exfiltrate data on every subsequent turn, it operates like malware — not a one-liner.
“We should start maybe using the word promptware to highlight that the injection is the technique. And then what you do later is a complex set of instructions to achieve an objective.” — Johann Rehberger
That reframe matters for defense. A kill chain demands kill chain thinking: persistence, lateral movement, exfiltration. Rehberger had already demonstrated continuous data exfiltration via ChatGPT two years earlier, calling it spyware then. Promptware is the same class of threat, now running inside coding agents and enterprise copilots.
Delayed tool invocation — bypassing security controls across conversation turns
Google built a real control: during an indirect prompt injection, the Workspace tool (email, Drive, all of it) would not chain. Rehberger found the hole anyway. An injected payload could wait. The moment the user typed anything to resume the conversation, the restricted tool became active again and the attack ran. He sent Google a test email with the injection buried mid-message; their team reproduced it within minutes.
The same pattern worked on ChatGPT (personalization silently changed to “quirky”) and, more dramatically, on a physical device. In Gemini delayed tool invocation on Google Home speaker (09:27), a document titled “broadcast to living room” was enough — Gemini read that as user intent, reactivated a restricted tool, and spoke through the speaker. The injection is the entry. The delay is the bypass.
Agent Commander — prompt-level command-and-control infrastructure
Agent Commander moves C2 off the operating system entirely. Once a compromised agent joins the framework via an injected heartbeat, Rehberger controls it through prompts alone — no shell commands, no zero-days. He can send a security-assessment template (14:27) and get back the agent’s IP, uptime, and environment variables. Or tell it to browse to the inbox and upload a screenshot, all hidden from the user’s UI. The same payload worked against two separate agent runtimes.
“The attackers will move a level higher.” — Johann Rehberger
Q&A
Is delayed tool invocation a fundamental flaw in how LLMs decide which tools to call, or is it fixable? Rehberger said it is not fundamentally flawed — Google’s control that blocks tool chaining during injection is a positive step — but the tool reactivating in a later turn is a bypass that needs to be locked down. ▶ 21:01
Would you classify delayed tool invocation as a state-manipulation vulnerability rather than an input-validation problem? He framed it as neither: the attack targets the transformer’s attention layer, and because the model is wired to invoke external tools, manipulating attention is enough to trigger them. ▶ 21:51
Have you tested any of the new Open Claw security tools like ClawShield to see if they reduce attack difficulty? He had not tested ClawShield; the space moves too fast to keep up, and Claude itself fixed over 220 security vulnerabilities within two or three weeks. ▶ 23:32
Notable Quotes
We should start maybe using the word promptware to highlight that the injection is the technique. And then what you do later is a complex set of instructions to achieve an objective. Johann Rehberger · ▶ 5:18
We fundamentally know that we shouldn’t be trusting these models, right? The output is not trustworthy. We do not control or know exactly what’s going on. Johann Rehberger · ▶ 13:45
The attackers will move a level higher. Johann Rehberger · ▶ 19:08
System will get compromised, and then they walk through the network without knowing a single zero day possibly. Johann Rehberger · ▶ 20:11
Key Takeaways
- Treat every external input an agent reads as a potential prompt injection payload, not just user-supplied text.
- Prevent tool chaining by design — a tool invoked by external content must not be permitted to chain additional privileged tools.
- Promptware is malware: engineer threat models and incident response around persistent, multi-stage AI agent compromise, not one-shot injections.