Research blog on AI agent security, prompt injection, and OT/IoT offensive security.https://veganmosfet.codeberg.page/ veganmosfeten Tue, 04 Aug 2026 04:49:02 -0000 Tue, 04 Aug 2026 04:49:02 -0000 1440 MkDocs RSS plugin - v1.17.9 https://veganmosfet.codeberg.page/pictures/page.webp https://veganmosfet.codeberg.page/ Disclaimer: Prompt injection is an unsolved problem. Use sandbox and human review. https://veganmosfet.codeberg.page/posts/2026-07-27-opus5/ Mon, 27 Jul 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-07-27-opus5/ Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem. Use sandbox and human review (and your own judgement). https://veganmosfet.codeberg.page/posts/2026-07-15-quest_rce/ Wed, 15 Jul 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-07-15-quest_rce/ Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem (but running Claude Code in a sandbox would mostly solve this problem). https://veganmosfet.codeberg.page/posts/2026-07-08-fable_quest_rce/ Wed, 08 Jul 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-07-08-fable_quest_rce/ Disclaimer: This post is for educational purpose, prompt injection is an unsolved problem. https://veganmosfet.codeberg.page/posts/2026-07-04-claude_code_fable_downgrade/ Sat, 04 Jul 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-07-04-claude_code_fable_downgrade/ I really wanted to play around with Fable-5... But then this happened. https://veganmosfet.codeberg.page/posts/2026-06-14-yolo_harness/ Sun, 14 Jun 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-06-14-yolo_harness/ Another day, another model. Opus-4.8 is said to be reliable. In OpenClaw, it reliably executes a reverse shell when asked to summarize an email. However, a few tricks are needed... https://veganmosfet.codeberg.page/posts/2026-06-04-openclaw_opus48/ Thu, 04 Jun 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-06-04-openclaw_opus48/ The last (for how long?) frontier models of Openai and Anthropic are there: gpt-5.5 and opus-4.7! We will exploit a few pathological habits of these models to get remote code... https://veganmosfet.codeberg.page/posts/2026-05-04-openclaw_gpt5_5_opus4_7/ Mon, 04 May 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-05-04-openclaw_gpt5_5_opus4_7/ Lastly the openai model gpt-5.4 gained in popularity within the OpenClaw community (maybe this is the reason). Let's have a look at the prompt injection behaviour of this model. https://veganmosfet.codeberg.page/posts/2026-04-08-openclaw_gpt5_4/ Wed, 08 Apr 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-04-08-openclaw_gpt5_4/ Another BrokenClaw! Today, from web fetch to remote code execution. A human user asks "Please fetch a webpage". After many tool calls, the lobster is confused and eventually... https://veganmosfet.codeberg.page/posts/2026-03-27-openclaw_webfetch/ Fri, 27 Mar 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-03-27-openclaw_webfetch/ Third part of the BrokenClaw saga! This time, Remote Code Execution via email using gogcli as email tool, no hook. Based only on the email content from a tool, the model (opus4.6)... https://veganmosfet.codeberg.page/posts/2026-03-03-openclaw3/ Tue, 03 Mar 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-03-03-openclaw3/ In Dify, I found a cross site scripting vulnerability (XSS) in the web application chat frontend when using echarts. User or llm inputs containing echarts with a specific... https://veganmosfet.codeberg.page/posts/2026-03-01-dify_XSS/ Sun, 01 Mar 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-03-01-dify_XSS/ You remember this experiment with sonnet 4.5? I tried with opus4.6, a frontier model with excellent prompt injection robustness. https://veganmosfet.codeberg.page/posts/2026-02-26-ghcp_opus46/ Thu, 26 Feb 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-02-26-ghcp_opus46/ In the first part of this saga (read first), I described a 0-Click RCE in OpenClaw using prompt injection and exploiting the insecure plugin handling. As a countermeasure... https://veganmosfet.codeberg.page/posts/2026-02-15-openclaw_sandbox/ Sun, 15 Feb 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-02-15-openclaw_sandbox/ This post is not related to OT but I could not resist. There's a new popular agent in town: OpenClaw. It's "The AI that actually does things". It does: a simple email can silently... https://veganmosfet.codeberg.page/posts/2026-02-02-openclaw_mail_rce/ Mon, 02 Feb 2026 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2026-02-02-openclaw_mail_rce/ Classic but still up-to-date. You clone a repo in VSCode, ask Github Copilot (GHCP) to summarize it and 💥 you get Remote Code Execution (RCE) on your machine: https://veganmosfet.codeberg.page/posts/2025-12-14-GHCP_RCE/ Sun, 14 Dec 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-12-14-GHCP_RCE/ Today we will use dify, an "open-source platform for developing LLM applications" to show how data exfiltration works - a classical problem in Retrieval Augmented Generation (RAG)... https://veganmosfet.codeberg.page/posts/2025-12-14-exfiltration_RAG/ Sun, 14 Dec 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-12-14-exfiltration_RAG/ In my last post, I experimented with a python agent and prompt injection using different LLMs. This time we will explore prompt injection with n8n, the low-code automation... https://veganmosfet.codeberg.page/posts/2025-11-30-Prompt_Injection_101_with_n8n/ Sun, 30 Nov 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-11-30-Prompt_Injection_101_with_n8n/ Inspired by this blog post and out of curiousity, I vibe-built a simple LLM agent in the terminal with a few tools and MCP capability. Then I ran a some experiments with prompt... https://veganmosfet.codeberg.page/posts/2025-11-11-models_agents_prompt_injection/ Tue, 11 Nov 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-11-11-models_agents_prompt_injection/ This post is an update of Playing with Gemini CLI: Riddles, Magic and some security Vibes. https://veganmosfet.codeberg.page/posts/2025-09-12-geminicli_update/ Fri, 12 Sep 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-09-12-geminicli_update/ I read the post mortem analysis of the nx S1ngularity supply chain attack and found the attack vector quite interesting. In this post, I will explain how to reproduce the first... https://veganmosfet.codeberg.page/posts/2025-09-08-nx_supply_chain/ Mon, 08 Sep 2025 00:00:00 +0000 IT meets OThttps://veganmosfet.codeberg.page/posts/2025-09-08-nx_supply_chain/