/
attack_type:prompt_injection × latest_source_host:hacktron.ai × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · medium

Cluely Electron app flaw: missing will-navigate guard and open IPC bridge enable silent screen and mic capture, with a path to RCE

Researchers at Hacktron disclosed a vulnerability chain in Cluely, an Electron-based AI assistant that reads the user's screen and microphone. They found it in July 2025 and published in February 2026. The main window had no will-navigate handler, so a link in the AI's markdown response could navigate the whole app to an attacker-controll…

technology
hacktron.ai · high

VS Code Copilot Chat applyPatchTool TOCTOU bypass lets prompt injection write arbitrary files and achieve RCE, exfiltrating GITHUB_TOKEN

Researcher ahacker1, using the Hacktron AI tooling, disclosed a bypass of earlier fixes for prompt-injection-to-RCE in VS Code Copilot Chat agent mode. A TOCTOU flaw in the applyPatchTool component lets a crafted prompt write files outside the workspace without user confirmation. The attack can be triggered by pasting a prompt into Copilo…

technology