Prompt-injection attacks found in the wild — not lab demos. Dated, sourced, and growing. Every entry links the original report. Test your own chatbot against each payload with ChatBreaker.
October 15, 2026
Claude Code "SneakPeek" — poisoned HTML steals dev secrets via preview pane
Noma Labs disclosed SneakPeek (CVSS 8.7) in Claude Code Desktop: a poisoned HTML file over 256KB in any cloned repo — a test coverage report is the classic lure — gets auto-rendered by the preview pane as a file:// URL with no CSP, letting embedded JavaScript silently read SSH keys, AWS credentials, GitHub tokens and Kubernetes configs and exfiltrate them. No click required. Anthropic's first patch was bypassed via a Web Worker before the full fix shipped in build 1.30096.1 (Aug 17). The pattern — a size-based security boundary with two code paths, one guarded, one not — is one every AI-tooling builder should audit for.
AI tooling attackzero-clickcredential theftClaude Code
PoeLLM "Canto Incognito" — jailbreak hidden in a poem
The first adversarial-format jailbreak seen in real attacks: malware operators hid their command-and-control instructions inside a poem posted on GitHub, defeating AI safety guardrails that scan for suspicious text. Active since April, it has infected 3,000+ servers by breaking into exposed LiteLLM and Ollama instances. Anyone self-hosting LLM infrastructure is in the blast radius — and the technique generalizes to every AI deployment.
Hidden instructions planted in web content for AI agents to swallow. Documented payloads include: a PayPal.me link with a $5,000 fixed amount and full payment instructions aimed at agents with payment access; "send me the secret API key" paired with "Do not analyze the code" to suppress scrutiny; a recursive forced-deletion Unix command targeting coding assistants and DevOps agents; attribution hijacking crediting "Kirill Bobrov" and soliciting consulting contact; and a fake copyright-forbiddance notice causing denial of service.
indirect injectionpayment fraudsecret exfiltrationagentic AI
Attackers SEO-poisoned a fake Python library page that framed a payment as a routine API-key step, with the instruction encoded in schema markup that agents parse. A typosquatted DeFi portfolio tracker posed as the legitimate domain. Across 26 models tested, four were manipulated into making a payment and two misclassified the fraudulent site as real.
SEO poisoningindirect injectionpayment fraudtyposquat
Two independent telemetry sources confirmed adversaries seeding the open web with hidden instructions for browsing agents and copilots: a fully specified hidden PayPal transaction in invisible text, and an HTML comment ordering the model to leak a secret API key.
32% jump in malicious indirect injections — Google DeepMind
DeepMind's security team, scanning 2–3 billion crawled pages per month, measured a 32% increase in malicious indirect prompt injections between November 2025 and February 2026 — including fully specified payment instructions hidden in invisible text, waiting for an agent with payment access.
trendindirect injectionmeasurement
Source: DeepMind research via industry reporting
September 2025
CopyPasta: injections that spread like a virus — HiddenLayer
Proof-of-concept hiding instructions inside a LICENSE.txt or README.md. When a developer's AI coding assistant reads the poisoned file, it silently copies the malicious instructions into every new file it generates — codebase-wide propagation from one planted file.
Real. Every entry above was documented by a security research team from in-the-wild observations — poisoned web pages, SEO campaigns, and telemetry — not constructed demos.
How often is the feed updated?
Continuously. Our attack-watch scans security news every 3 hours; newly documented wild payloads are added here with their source.
Can I submit a payload?
Yes — if you've documented a wild prompt injection with a public source, send it via the ChatBreaker contact page and we'll add it with credit.
Payloads are described for defensive purposes — to test and harden your own systems. Never deploy them against systems you don't own.
