Look, an Instruction!

Stories This Week

• Top Story — The Prompt Was the Payload — Two Agent-Framework RCEs in Seven Days: Two independent disclosures landed inside seven days, and they collapse to the same sentence: a model read an instruction it shouldn't have trusted, and a tool downstream did exactly what the parsed text said.
• Cisco announces intent to acquire Astrix Security.: Cisco's May 4 blog post by SVP Peter Bailey says Astrix will fold into Cisco Identity Intelligence, Cisco Secure Access, Duo IAM, and Splunk.
• An X user drained ~$150,000 from a Grok-linked Bankr wallet via Morse-encoded prompt injection (May 4, 2026).: The mechanics, per Giskard's write-up: the attacker first sent a "Bankr Club Membership NFT" to Grok's auto-provisioned wallet, which granted the holder "Executive" permissions and bypassed standard transfer limits.
• HiddenLayer — "AI Threat Landscape Report 2026.": The headline figure surfaced via the report's coverage: **roughly 1 in 8 reported AI breaches now involves agentic systems**, alongside the recurring supply-chain-of-models statistic that *93% of orgs use public or open-weight model repositories and most don't scan inbound models consistently.* The full PDF is gated; numbers are reported as cited unless you pull the original.

Curator's Corner

Every week this newsletter covers a new place an attacker hid an instruction, and a new AI assistant that found it and ran it. Last September, **ForcedLeak** showed Salesforce Agentforce reading hidden instructions out of a *Web-to-Lead form* and exfilling CRM data through an expired allowlisted domain. In April, **Comment and Control** turned PR and issue *comments* into a credential-theft channel across Claude Code, Gemini CLI, and GitHub Copilot at once. This week it's two more: a *GitHub issue body* that hijacked Gemini CLI's triage agent and pushed code into a 101,000-star Google repo, and a *prompt* that reached a "run this as code" function inside Microsoft's Semantic Kernel.

The clean read every time is *"fix the plumbing — patch the code-execution function, lock down the keys, harden the loaders, fix the CSP."* All true. All worth doing. But it misses why this is every week's story.

Language models are wired to *find instructions wherever they appear and act on them.* That eagerness is their best feature — it's how they become useful assistants in the first place — and it's their main attack surface at the same time. Every plumbing fix patches the symptom. The behavior is the source.

The fix has to land at the model itself: **instructions should be opt-in, not opt-out.** Your prompt is authorized. Everything else the model reads is data — even if it's phrased as a command, even if it's polite, even if it's wrapped in a system-prompt-looking wrapper inside an email, a lead form, a PR comment, or a GitHub issue. The default has to be *"I found a sentence that looks like an order. I will ignore it unless I was told this source can give me orders."*