Tests of six email variants found fabricated dates and totals in every test summary. Explicit instructions consistently removed true facts, but hidden text was not required. The results were limited to one email client and viewport.
The article explains OWASP’s LLM06:2026 Unbounded Consumption risk, how agents can drive runaway inference costs, and why enforced budgets, circuit breakers, and monitoring are needed.
In a controlled lab, hidden HTML instructions altered an unguarded email summarizer’s output in all 10 injected runs, changing invoice and date details without signaling tampering. The test used one message, one model and no guardrails.
Forcepoint researchers dissected an India-focused ValleyRAT campaign using fake tax notices and a signed Overwolf executable to sideload a DLL; the malware runs in memory, persists via a logon task, and injects into svchost.exe.
PromptSpy is a conceptual simulation of multi-agent email workflows, showing how contextual information may influence downstream AI assistants differently from human readers. It highlights orchestration risks and suggests validating and isolating inter-agent context.
Forcepoint explains how indirect prompt injection can seed malicious instructions into AI agents’ long-term memory, then proposes risk scoring, provenance checks and retrieval-time validation to flag or quarantine untrusted memories.
Forcepoint X-Labs identified three World Cup 2026 scams: a Stake.com-impersonating wallet drainer, a SeatGeek typosquatted ticket site, and FIFA lottery emails seeking personal data and potentially enabling advance-fee fraud.
Forcepoint traces how TeamPCP used a compromised Trivy build tool to publish malicious LiteLLM versions that stole AI, cloud and developer credentials, exfiltrated data, and installed a persistent backdoor.
Forcepoint X-Labs analyzed a DHL-themed phishing campaign that uses a locally generated fake OTP to build trust, then steals passwords and victim telemetry through a spoofed login page and exfiltrates the data via EmailJS.
Forcepoint X-Labs describes 10 reported indirect prompt-injection payloads on live websites, detailing concealment and spoofing techniques aimed at data theft, fraud, destructive actions, and AI denial of service.
A local Python and Flask simulation demonstrates how prompt injection could expose an admin token, enable MCP server and model compromise, and lead to code execution through an unsafe CI/CD deploy endpoint.
Forcepoint researchers detail an email-driven scareware campaign targeting business users in Japan and Germany, using self-spoofed emails and fake Japanese Defender alerts. They analyze its encrypted payload, browser-locking behavior, and protective measures.
