This week in the Wild West Roundup:

2026-08-10 · Bits and Bobs 8/10/26

This week in the Wild West Roundup:
- Remote Prompt Execution Is a New Vulnerability Class. ChatMate Just Showed How It Works on Copilot.
  - "A single poisoned document can hand an attacker an interactive shell inside your Copilot session — and they inherit your identity, your data, and your cloud access."
- When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers.
- I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository.
- Grand Theft Atlas: "How we hijacked ChatGPT Atlas with one planted X comment, to phish the victim's WhatsApp contacts and buy ourselves an Amazon order on their card."
- Atlassian Rovo Exfiltrates Data, Bypassing Controls.
  - "Atlassian AI 'Rovo' is susceptible to zero-click data exfiltration via indirect prompt injection, bypassing organization-level web search controls."
- VentureBeat: Claude Mythos 5 made sock puppet accounts to socially engineer developers.
- A smorgasbord of agentic security issues covered at this year's DEF CON.

More on this topic

From other episodes