TechRisk #178: One-click Claude Desktop flaw
Plus, GhostApproval flaw, MemGhost corrupt AI personal assistant’s memory, Gemini as free partner in crime, and more!
Tech Risk Reading Picks
Executive Summary: This week's disclosures show AI tools have become a live security problem on both ends. Researchers found systemic flaws across nearly every major AI coding and desktop assistant (Claude, Cursor, Amazon, Google, Windsurf, Augment) that let attackers hide malicious instructions in links, files, and even images, with the worst outcomes consistently occurring when tools run in autonomous "auto-approve" modes; separately, a single email was shown to silently corrupt an AI assistant's long-term memory with false facts, with no fix available. At the same time, criminals are now using AI as the attacker: a group used Google's free Gemini tool to run a real intrusion end to end with minimal skill, GPT-5.6 was jailbroken within hours to enable autonomous exploit development, and AI infrastructure itself (Hugging Face, an exposed LiteLLM gateway) was successfully breached. The practical takeaway: patch all AI coding tools, keep human approval prompts on for any agent touching untrusted code or content, separate email access from memory in assistant pilots, and confirm we know where AI agents run with autonomous permissions in our environment, because that is where the real exposure sits.
A one-click Claude Desktop flaw allowed attackers to submit concealed instructions without review: Researchers found a security flaw in Claude Desktop, since fixed, that let attackers get the AI agent to run hidden instructions just from a single click on a crafted link, with no warning or chance to review what was being sent. By hiding malicious text below a "show more" prompt, attackers could disguise the request as something harmless, like asking for ASCII art, while secretly directing Claude to pull sensitive information from past conversations and send it to them, or, when file access tools were connected, quietly plant code that let attackers connect to the user's computer during normal coding work. Attackers could also disguise the malicious links to look like they came from a trusted Claude web address. Anthropic fixed the issue in version 1.1.2321, which now requires users to review and manually send any pre-filled prompt before Claude acts on it. [more]
Flaw found across major AI coding assistants: GhostApproval is a flaw pattern found across major AI coding assistants. Affected tools include products from Amazon, Google, Cursor, Windsurf, Augment, and Anthropic’s Claude Code. The root cause was how these tools handled shortcut files called symbolic links. A malicious code repository could disguise a sensitive system file, like an SSH access key, as an ordinary project file. When the assistant edited what looked like a harmless local file, the change actually landed somewhere far more damaging. This made the approval step unreliable. Prompts meant to give developers a final check often showed only the disguised filename, not the real destination. In some tools, the file change happened before the developer even clicked approve. That turned “approval” into an after-the-fact undo option, not a real gatekeeper. Most vendors have shipped fixes. Amazon, Cursor, and Google have patched versions out. Anthropic says Claude Code now resolves these disguised links and warns before writing to sensitive locations. Augment and Windsurf had acknowledged the issue. Neither had published a fix at the time of disclosure. If your team uses AI coding assistants, especially Augment or Windsurf, update to the latest patched version where available. Treat “approve” prompts with caution on untrusted repositories until fixes are confirmed. [more]
Claude for Chrome flaw could trigger gmail reading: Researchers at Manifold Security say a flaw in Claude for Chrome lets any other browser extension that can run a script on claude.ai fake a user’s click and trigger Claude to read someone’s Gmail, latest Google Doc, or Calendar. This happens as the extension never checks whether a click actually came from a real person or was faked by code. In the default setting, this forged click still needs the user to approve it before anything happens, but if a user has switched on Claude’s hands-off “Act without asking” mode, the fake click alone is enough to trigger the read with no approval and no warning. A related, currently unreachable flaw could let a future bug remove the approval step entirely by feeding Claude’s control panel a special setting through its web address. Anthropic was told about both issues in May, closed them as already covered or as low risk, and as of July 14 has not shipped a fix, even though the vulnerable code was unchanged eight versions later. If you use Claude for Chrome, turn off “Act without asking” and review which other extensions have permission to interact with claude.ai until Anthropic ships a fix. [more]
Friendly fire attack technique: Researchers at the AI Now Institute found a new attack called “Friendly Fire.” It tricks AI coding assistants, including Anthropic’s Claude Code and OpenAI’s Codex, into running malicious code when they operate in autonomous mode. This is an opt-in setting where the AI approves its own commands via a built-in classifier instead of asking a human first. The attack hides in a project’s README file, an ordinary text file that triggers no security warning. It tells the AI to run a routine-sounding “security check” script, which secretly launches a disguised binary built to fool the AI’s own safety checks. Once triggered, the code runs directly on the user’s machine with no warning and no approval step. The same attack worked unchanged across four different AI models from both vendors, which researchers say shows this isn’t a fixable bug in one model: these systems still can’t reliably separate the code they’re reviewing from the instructions they’re meant to follow. This is a lab demonstration, not a confirmed real-world attack, and there’s no patch, since the researchers argue the weakness is architectural. Therefore, it is important not to give an AI coding agent unattended, autonomous permissions when reviewing code you don’t control, and keep approval prompts on if you use these tools for security review. [more]
MemGhost corrupt AI personal assistant’s memory: Security researchers have shown that a single ordinary email can permanently corrupt an AI personal assistant's memory of its user. Their automated tool, called MemGhost, crafts emails containing hidden instructions aimed at the assistant rather than the person. When the assistant reads the email as part of its routine inbox checks, it quietly saves a false "fact" about the user into its long-term notes, says nothing about it in its reply, and then relies on that false information in future conversations. For example, believing a payment limit was raised when it was not. In lab tests the attack succeeded in most attempts against popular AI agent setups, slipped past defensive filters over 90% of the time. In addition, it stayed hidden even when users asked the assistant directly what it had done. A follow-up test through real Gmail delivery worked in more than half of cases, and there is no fix available yet. Therefore, any AI assistant that both reads incoming email and keeps its own memory is exposed. Organisations piloting these tools should keep those two capabilities separated until vendors add approval and audit controls for memory changes. [more]
Gemini as free partner in crime: A criminal group used Google's free Gemini AI command-line tool as a hands-on partner in a real cyberattack, according to security firm Trend Micro. Over roughly 200 sessions, a Russian-speaking attacker tricked the AI into acting as an "authorized security tester", then used plain-English instructions to run a small network of eight hijacked computers inside a dental clinic and access its patient database. The AI did the heavy lifting. It rebuilt the attacker's entire control infrastructure in six minutes, fixed problems on its own, and even suggested improvements to the operation dozens of times. The whole toolkit fit in three small text files, and the malware itself was unsophisticated, showing that AI can now substitute for technical skill. Gemini refused only one request, to build self-spreading malware, and the attacker simply moved on to other tasks. The bottom line: consumer AI tools can now run cyberattacks end to end for low-skill criminals, so expect more attacks like this and ensure your security team is monitoring for AI-assisted intrusions. [more]
New supply-chain code review abuse attack - Ghostcommit: Researchers have disclosed a new supply-chain attack, dubbed Ghostcommit, that abuses AI code review and coding assistants. The attacker submits a pull request with a prompt injection hidden inside a PNG image. As AI code reviewers treat images as binary files and never inspect them, the malicious change passes review and gets merged. The payload then lies dormant. When a developer asks an AI coding agent for routine work, the agent reads the project's convention file following the pointer to the image and opens the repository's .env credentials file. The agent would then embed every secret in the new code, encoded as an innocent-looking list of integers. Consequently, the attacker could simply decodes them from the public commit, and secret scanners miss it because nothing looks like a credential. Testing showed the risk sits in the tooling, not the model: Cursor and Antigravity leaked the secrets, while Anthropic's Claude Code refused under every model tested. The bottom line: image files are potentially a blind spot in AI code review, so teams should mandate human review of merged changes, add multimodal scanning, and monitor agents for unexpected access to credential files. [more]
LiteLLM gateway hijacked for cryptomining: Security researchers at Darktrace found that an Amazon EC2 server running LiteLLM, an AI gateway connected to Amazon Bedrock, was hacked and used to mine cryptocurrency after port 22 (the remote-access SSH port) was left open to the internet, letting attackers likely in through repeated login attempts before they downloaded XMRig, a common mining tool, and began generating Monero (XMR) through a mining pool, prompting Darktrace to shut the server down. The bigger risk wasn’t the mining itself but the server’s role: it handled authentication, model routing, prompts, logs, and cloud permissions for Bedrock access, so a breach here could have exposed credentials and AI workflow data, not just computing resources. [more]
Hugging Face discloses AI-agent-orchestrated intrusion into production infrastructure： An autonomous attack framework exploited a remote-code dataset loader and template-injection flaw, running thousands of automated actions across short-lived sandboxes to steal internal datasets and credentials; no evidence of tampering with public models or the supply chain. [more]
UK AI Security Institute: universal jailbreaks unlock autonomous cyber-offense in GPT-5.6: Jailbreaks developed within hours strip GPT-5.6’s guardrails to enable autonomous vulnerability discovery and exploit development. OpenAI says it mitigated the specific jailbreaks but hasn’t disclosed effectiveness, and faces no export-control-style restriction. [more]