Prompt Injection Is an Architectural Property, Not a Bug You Patch
Prompt injection as design flaw, a Claude for Chrome bypass, Siemens OT zero-days, weaponized coding interviews, and sub-24-hour ransomware.
INTRODUCTION
Attackers spent this week probing the seam between what an AI agent reads and what it treats as a command, and the seam is wide open. UC Berkeley researchers showed autonomous web agents cannot reliably separate trusted page content from attacker-planted instructions. A Claude for Chrome extension flaw let a malicious extension trigger predefined AI actions by faking user clicks. Palo Alto’s Unit 42 chained three Siemens ROX II zero-days from foothold to persistent root on OT switches. North Korea’s Contagious Interview crew buried a four-stage payload inside SVG flag images served through fake coding challenges. Ransomware operators locked a South Asian IT firm end to end in under 24 hours.
This week’s signals do not converge on one technique. Each changes a different decision. The prompt injection research tells architects that giving an agent tool access is now a data-provenance problem, not a permissions problem. The Siemens research tells OT teams that segmentation is only as trustworthy as the devices enforcing it. The North Korean campaign tells hiring managers that the interview pipeline is now an intrusion vector. And the sub-24-hour ransomware timeline tells responders that approval-gated containment is already too slow.
Which of your controls assumes the input it processes is honest?
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting us.
WEEKLY SIGNALS ANALYSIS
The agent’s inability to distinguish content from command is a design property, not a bug you can patch. Treat every autonomous agent with tool access as an untrusted user, scope its permissions per task, and log every action it takes against connected services this week.
OT segmentation is only as trustworthy as the management plane enforcing it. The Siemens ROX II chain reached root on the switches that enforce your isolation, so audit management-plane access to OT networking gear rather than assuming the devices themselves are safe.
Personal career activity can expose corporate developer infrastructure. North Korean operators are delivering malware through coding challenges candidates run on corporate laptops, so isolate any code executed during technical interviews in disposable environments.
Recovery infrastructure is now part of the ransomware attack path. Spirals operators attempted to stop services associated with 23 backup, database, and virtualization products before encryption. Separate recovery administration from production identities and alert when one host attempts to disable multiple recovery services.
THIS WEEK’S SIGNALS
Signal 1: Prompt Injection Turns Autonomous Web Agents Into Attacker Puppets
Why it matters: Web agents read whatever a page shows them, and most of that content comes from strangers. When an agent treats attacker-planted text as a command, any product review, seller listing, or advertisement becomes a control channel into whatever the agent can touch.
What is being misread: Teams treat this as a permissions question, solvable by scoping what the agent can do. The deeper problem is provenance. The agent has no architectural way to distinguish a trusted instruction from untrusted content because both arrive as the same undifferentiated stream of text. You cannot permission your way out of a system that cannot tell who is talking. Least privilege limits the blast radius, but it does not resolve the provenance problem.
Think Red (Douglas McKee): What caught my attention here is that this isn’t a bug we’re patching. It’s a property of how these agents ingest information. They read a webpage the same way they read the instructions we gave them, and they can’t tell the difference because there isn’t one in the design. From an offensive research perspective, that’s the interesting failure mode. Every product built on “agent reads the web and acts on it” inherits the same issue until someone changes how instructions and content get separated at the model level. Filtering the input is treating the symptom. The design of the input channel is where I’d keep looking.
Act Blue (Ismael Valenzuela): The reality is that an autonomous agent with tool access is a confused deputy by design, and the fix is not a smarter filter. Start by treating every agent as an untrusted user in your identity model. Give it a distinct identity, scope its access per task, and bind its tool permissions to the minimum required, exactly the least-privilege model Microsoft laid out for agents this week. Do not stop there, because scoping limits blast radius without stopping the injection itself. Add egress controls on what the agent can send outbound, human confirmation for irreversible actions like sending mail or moving money, and full action logging so you can reconstruct what the agent did and why. The principle is old and it still holds. When a system cannot verify who is giving it orders, you constrain what those orders can accomplish.
Supporting sources:
Help Net Security: UC Berkeley research shows web agents cannot separate trusted content from attacker-planted instructions, framing prompt injection as the XSS of the agent era
Microsoft Security: Least-privilege model for AI agents covering identity, access, and tool binding
Dark Reading: Agentic AI risk reframe for security teams
Signal 2: A Claude Extension Flaw Let Other Browser Extensions Trigger Its Authorized Workflows
Why it matters: Manifold Security demonstrated that another extension with content-script access to claude.ai could synthesize a click and trigger one of nine predefined Claude workflows. In default mode, the user still received an approval prompt. When “Act without asking” was enabled, the workflows could execute silently against authorized services such as Gmail, Google Docs, Calendar, and Salesforce.
What is being misread: People read this as a single vendor bug that a patch resolves. The pattern is broader. When an AI assistant holds standing authorization to sensitive apps, the browser it lives in becomes a shared attack surface where any co-resident extension can borrow that authorization.
Think Red (Douglas McKee): From a red-team perspective, the interesting thing here isn’t the specific Chrome extension flaw. It’s that we’ve turned the browser into a shared identity boundary and everyone acts surprised when co-resident code borrows the tokens we handed out. The Claude extension holds standing authorization to Gmail, Docs, and Salesforce. Any other extension in the same profile can simulate the clicks that trigger those actions. That’s not a vulnerability class we haven’t seen. It’s the browser extension model doing exactly what it always did, applied this time to an AI assistant with unusually broad access. If users can install any extension they want, the AI’s authorization is only as constrained as the least trustworthy add-on sitting next to it.
Act Blue (Ismael Valenzuela): The operational reality is that every extension in a browser profile shares some portion of the browser’s trust boundary, and an AI assistant with standing access to business applications makes that boundary valuable. Until Anthropic ships and your organization independently verifies a fix, disable “Act without asking” and remove Claude for Chrome from managed profiles where it is not operationally required. Restrict which extensions may execute content scripts on claude.ai, then inventory the full extension population and enforce an allowlist through Chrome enterprise policy. Review every service the assistant is authorized to access and revoke standing permissions it does not actively need. Monitor for unusual sequences in which Claude processes a browser event and immediately reads mail, opens documents, or submits data to a connected service. The lesson generalizes beyond one extension. Any tool holding delegated authority to crown-jewel applications must be treated as part of the access-control perimeter, not as a convenience feature.
Supporting sources:
Manifold Security: Primary research reproducing the synthetic-click workflow issue in Claude for Chrome v1.0.80
BleepingComputer: Claude for Chrome extension flaw let malicious extensions trigger AI actions via simulated clicks against Gmail, Docs, Calendar, and Salesforce
Dark Reading: PromptFiction Claude flaw could enable end-to-end attacks when chained
Signal 3: Three Chained Siemens Zero-Days Reach Root on the Switches That Enforce OT Isolation
Why it matters: Unit 42 documented three chained zero-days in Siemens ROX II OT switches that move an attacker from initial foothold to persistent root access. These are the devices that enforce segmentation between IT and OT networks, so compromising them undermines the primary control most industrial operators rely on.
What is being misread: Operators treat network segmentation as a solved problem once the diagram shows separate zones. The diagram is not the control. The switch enforcing the boundary is itself a computer with a management plane, and when that plane is reachable and vulnerable, the boundary is only as strong as the least-patched networking device.
Think Red (Douglas McKee): What I’d keep looking at is that the segmentation switch has a reachable management plane in the first place. The three-CVE chain is impressive, but OT teams treat these devices as guardrails, then leave the guardrail’s admin interface accessible from anything upstream. Unit 42 needed three flaws to reach root. The researchers who invest in ROX II next don’t need three. They need one, on a device family that keeps exposing the same architecture. From an offensive research perspective, that’s where the funding goes, and defenders who fund the same class of research first will find these before they show up in a threat report.
Act Blue (Ismael Valenzuela): The architectural reality is that OT networking hardware is critical infrastructure in its own right, and the ROX II chain proves the enforcing device is a target, not a guardrail. Apply the Siemens fixes on an emergency change window, since a foothold-to-persistent-root chain on segmentation gear is not a routine patch cycle. Restrict the management plane of every OT switch to a dedicated administration network, because most of these chains begin with a reachable management interface. Physical or cryptographic segmentation between Level 3 and Level 4, enforced through a hardened OT DMZ, gives you a control that survives the compromise of any single device, as OT defenders have been arguing this week. The principle is that a boundary you cannot independently verify is a boundary you do not actually have.
Supporting sources:
SecurityWeek: The reality of OT vulnerability disclosure with legacy systems and safety constraints
Shieldworkz: Enforced IT/OT segmentation with a hardened OT DMZ as the highest-impact control during geopolitical events
Signal 4: North Korean Operators Turn the Coding Interview Into a Malware Delivery Channel
Why it matters: North Korean threat actors tied to the Contagious Interview campaign concealed a four-stage payload inside SVG flag images delivered through fake job postings and coding challenges. Any candidate who ran the project ended up compromised, which turns the hiring pipeline into an unmonitored ingress path.
What is being misread: Most defenders scope this as a job-seeker scam aimed at individuals. The enterprise exposure is the reverse case. Your own engineers run candidate take-home projects, and your recruiters open attachments, often on corporate laptops with full network access and no isolation.
Think Red (Douglas McKee): Let’s be honest, hiding a payload in an image is not new tradecraft. What’s actually offensive about this campaign is that the delivery mechanism is a business process the defender is required to participate in. You have to run candidate code to evaluate it. You have to open recruiter emails to respond to them. The hiring pipeline exists specifically to bring outside people and their code inside. Contagious Interview isn’t exploiting a security control. It’s exploiting the fact that no security control gets placed in the middle of a workflow whose job is to onboard strangers. The four-stage SVG payload is the headline. The unmonitored ingress path is the lesson.
Act Blue (Ismael Valenzuela): The reality is that any code executed during hiring, whether a candidate’s submission or a take-home your team reviews, is untrusted code running inside your perimeter. Route all interview and evaluation code through disposable, isolated environments, a throwaway VM or a sandboxed container with no path to production or corporate identity. Brief recruiters and engineering teams this week that steganographic payloads in image files and unusual project dependencies are the current tradecraft. Do not stop there. Monitor developer workstations for anomalous child processes spawned from code editors and IDEs, and watch for outbound connections from build-adjacent machines to unfamiliar infrastructure, because the payload’s value is the pivot from workstation to pipeline. The principle is that trust granted by a business process is still trust an attacker can exploit, and hiring is a business process with a direct line to your engineers.
Supporting sources:
Elastic Security Labs: Primary research on REF9403, documenting SVG steganography delivery with zero AV detections at time of publication
The Hacker News: North Korea-linked Contagious Interview actors hide four-stage payloads in SVG flag images via fake coding tests
Signal 5: Spirals Disabled the Recovery Stack Before It Encrypted the Network
Why it matters: Symantec documented a Spirals ransomware intrusion that progressed from initial access to data theft and network encryption in under 24 hours. Before encryption, the operators attempted to stop services associated with 23 backup, database, and virtualization products. The recovery infrastructure was not merely affected by the attack. It was one of the attacker’s first targets.
What is being misread: This is being treated as another story about ransomware speed. The deeper failure is recovery dependence. A backup or virtualization platform that can be disabled through the same identities, administrative pathways, and network segments used in production is not operationally isolated from the environment it is expected to restore.
Think Red (Douglas McKee): Ransomware operators have been compressing dwell time for years, so a sub-24-hour kill chain is the trend, not the surprise. What actually gave Spirals the advantage was a defender process, not an operational innovation. The team saw the activity in time. What they couldn’t do was act on it without a phone call to someone with authority to isolate a segment. That’s the gap Spirals exploited, and the next affiliate will exploit it whether their kill chain runs 22 hours or 6. Attackers didn’t build a new capability. Defenders kept a human approval step in the critical path that used to be safe when dwell time was measured in weeks.
Act Blue (Ismael Valenzuela): The operational reality is that a sub-24-hour kill chain breaks any response model that gates containment behind human approval. Pre-authorize automated network isolation for high-confidence ransomware indicators now, so a host exhibiting mass-encryption or rapid-staging behavior gets quarantined without waiting for a phone call. Define those triggers tightly and test them against your environment to control false positives. Ensure your backups are immutable and network-isolated, because when detection-to-encryption is measured in hours, recovery capability becomes the control that actually determines the outcome. The principle is that detection without pre-authorized containment is not defense, it is narration. If the adversary’s timeline is shorter than your approval chain, you have already lost the race before it starts.
Supporting sources:
Symantec Threat Intelligence: Primary analysis of the Spirals intrusion, including its sub-24-hour timeline and attempts to stop recovery services
Help Net Security: Spirals ransomware went from initial access to data theft and full encryption in under 24 hours against a South Asian IT firm
Dark Reading: Identity attacks overtake exploits as top ransomware cause, with MFA present in 97% of failed credential defenses
MEME OF THE WEEK
The agent has more standing access than the CISO. The CISO approved neither.
ROLE-BASED TAKEAWAYS
Executive / CISO / Board Level
AI agents are receiving standing access to email, documents, CRM platforms, and operational systems before organizations have established who owns their identities, permissions, and activity logs. Require a formal agent inventory, a security review before business-system access is granted, separate identities for every production agent, and task-scoped authorization instead of inherited user permissions.
OT segmentation depends on the integrity of the switches enforcing it. Authorize an emergency update cycle for affected Siemens ROX II devices and require an inventory of every OT networking management interface, its firmware version, and the networks from which it can be administered.
Spirals operators attacked recovery services before encryption. Direct infrastructure and security leaders to separate backup administration from production identity, maintain immutable and offline recovery copies, and prove through a quarterly restoration exercise that recovery still works after production credentials are assumed compromised.
Enterprise Architect
Design Principle Impact: Agent tool access must be modeled as a distinct identity and policy enforcement problem, not as an extension of the user who deployed the agent. Give every agent its own identity, bind permissions to the active task, constrain what data may leave the environment, and place an authorization layer between the model and connected services.
New Constraint/Dependency: OT switches enforcing IT and OT separation must be treated as critical assets themselves. Restrict their management planes to dedicated administration networks, forward configuration events to independently controlled logging, and add a separately enforced OT DMZ so compromise of one device does not redefine the entire boundary.
Security Operations
Implementation Watch Item: Inventory every browser extension across your managed fleet and enforce an allowlist via Chrome enterprise policy this week. The Claude for Chrome flaw exposed how a co-resident extension can borrow standing authorization from any AI assistant to reach Gmail, Google Docs, Calendar, and Salesforce through simulated clicks.
Common Failure Mode: Developers run external coding tests, freelance projects, or unfamiliar repositories on corporate workstations that contain source-control credentials, cloud tokens, SSH keys, and access to build systems. Route all outside code through disposable VMs or remote sandboxes with no corporate identity, internal repositories, or production network path.
Monitoring Patterns: For AI agents, log the content source, tool invocation, destination, and result for every action. Alert when an agent invokes mail forwarding, file transfer, authentication, or data export tools outside its assigned task. For OT switches, alert on management-plane access outside the dedicated administration network, unexpected configuration changes, new accounts, and firmware modifications.
Signal vs Noise Guidance: Normal agent activity is predictable tool calls scoped to the authorized task. Signal is an agent invoking tools outside task scope, especially forward-mail, file-transfer, or authentication actions immediately after processing external content. Normal OT switch traffic is routine SNMP polling and scheduled config backups. Signal is any interactive shell session or firmware-modification action on ROX II or similar segmentation gear.
Adversarial edge item: Pre-authorize automated host and segment isolation for a defined set of high-confidence ransomware behavioral indicators, specifically mass file encryption, rapid credential dumping, and Volume Shadow Copy deletion. Define the triggers tightly, test them against admin workflows to control false positives, and give the automation authority to act without waiting for a phone call.
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.
"Architectural property" is the right level. If an agent can read untrusted material and use tools with real reach, the system has created a channel from text to action. That cannot be patched by asking the model to be more suspicious. The architecture has to decide which data may instruct, which data may only inform, and which actions require proof outside the model's interpretation.