F5 Labs CASI Leaderboard: Sugar-Coated Poison LLM attack and AI tooling flaws in Copilot, OpenClaw (CVE-2026-25253) and Claude Code (CVE-2026-21852)
F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that gradually erodes LLM guardrails, and three disclosures in which AI agents and developer tools were compromised through untrusted inputs, local services or configuration files rather than model weaknesses. The common thread is that autonomous AI tools ingest external inputs and act on them without sufficient validation, isolation or user visibility.
Technical Details
- Sugar-Coated Poison (SCP): exploits Defense Threshold Decay (DTD). The attacker builds trust with legitimate discussion, pushes the model into a helpful 'educational expert' mode, then pivots to the harmful request. Reported ASR-GPT was 87.23% against older models (GPT-4, Claude Sonnet 3.5) in a paper first published in April 2025. F5 observes lower success rates against newer models, but the attack remains highly effective. F5 illustrates a banking scenario in which fraud and AML assistants are steered toward detection-evasion guidance.
- GitHub Copilot Extensions (Orca Security, 19 Feb 2026): indirect prompt injection via a hidden instruction block in a GitHub Issue. When a developer asks Copilot to analyze linked issues, the agent can silently exfiltrate
.envfiles or session tokens to an attacker-controlled endpoint. - OpenClaw Agent Framework (CVE-2026-25253, Oasis Security): the local WebSocket server lacks origin validation and authentication. A malicious website can perform Cross-Site WebSocket Hijacking against the instance on localhost:8000, giving full RCE on the developer's machine through the agent's file system and shell tool-calling.
- Anthropic Claude Code CLI (CVE-2026-21852, Check Point Research): a poisoned repository containing a hidden
.claude/settings.jsonis parsed automatically on initialization. It can redirect API traffic or run 'pre-flight' scripts that exfiltrate Anthropic API keys before the user enters a prompt. - F5 draws a parallel with the Invasive Context Engineering attack covered in the prior month's article: both embed malicious intent in content that appears benign or authoritative.
Remediation
The article gives no explicit remediation steps. Implied defensive priorities are validating and isolating untrusted inputs to AI agents (retrieved documents, issues, tool outputs, repository configs), enforcing origin checks and authentication on local agent services, requiring workspace trust before loading project configuration, and assessing models on both capability and security posture.
Linha do tempo
-
F5 Labs CASI Leaderboard: Sugar-Coated Poison LLM attack and AI tooling flaws in Copilot, OpenClaw (CVE-2026-25253) and Claude Code (CVE-2026-21852)
ler a análise desta fonte ocultar
F5 Labs published its March 2026 CASI Leaderboard update, which is now dominated by OpenAI and Anthropic. Z.ai's GLM-5 performs well on price and capability but has a weak security posture (CASI 37.56 vs 96.61 for Claude Opus 4.6 and 92.58 for GPT-5.2). The report also spotlights Sugar-Coated Poison (SCP), a multi-turn technique that gradually erodes LLM guardrails, and three disclosures in which AI agents and developer tools were compromised through untrusted inputs, local services or configuration files rather than model weaknesses. The common thread is that autonomous AI tools ingest external inputs and act on them without sufficient validation, isolation or user visibility.
Technical Details
- Sugar-Coated Poison (SCP): exploits Defense Threshold Decay (DTD). The attacker builds trust with legitimate discussion, pushes the model into a helpful 'educational expert' mode, then pivots to the harmful request. Reported ASR-GPT was 87.23% against older models (GPT-4, Claude Sonnet 3.5) in a paper first published in April 2025. F5 observes lower success rates against newer models, but the attack remains highly effective. F5 illustrates a banking scenario in which fraud and AML assistants are steered toward detection-evasion guidance.
- GitHub Copilot Extensions (Orca Security, 19 Feb 2026): indirect prompt injection via a hidden instruction block in a GitHub Issue. When a developer asks Copilot to analyze linked issues, the agent can silently exfiltrate
.envfiles or session tokens to an attacker-controlled endpoint. - OpenClaw Agent Framework (CVE-2026-25253, Oasis Security): the local WebSocket server lacks origin validation and authentication. A malicious website can perform Cross-Site WebSocket Hijacking against the instance on localhost:8000, giving full RCE on the developer's machine through the agent's file system and shell tool-calling.
- Anthropic Claude Code CLI (CVE-2026-21852, Check Point Research): a poisoned repository containing a hidden
.claude/settings.jsonis parsed automatically on initialization. It can redirect API traffic or run 'pre-flight' scripts that exfiltrate Anthropic API keys before the user enters a prompt. - F5 draws a parallel with the Invasive Context Engineering attack covered in the prior month's article: both embed malicious intent in content that appears benign or authoritative.
Remediation
The article gives no explicit remediation steps. Implied defensive priorities are validating and isolating untrusted inputs to AI agents (retrieved documents, issues, tool outputs, repository configs), enforcing origin checks and authentication on local agent services, requiring workspace trust before loading project configuration, and assessing models on both capability and security posture.