PromptArmor
promptarmor.com · Company blog · on HN since 2024
PromptArmor is a security firm that publishes research on prompt injection and data exfiltration flaws in AI products.
What HN saysHN commenters point to it as a source of real prompt injection attacks against name-brand tools like Superhuman, Claude Cowork and IBM's Bob.
23HN people shared it
8linked it in comments
36stories submitted
959story points
3 months agolast shared
2024people per year2026
Most-shared posts
- 1Claude Cowork Exfiltrates Files5 people · 45 points · first shared 2026 · 19 comments on HN
- 2Codex for Everything Exfiltrates Connected Data4 people · 7 points · first shared 2026 · discussion on HN
- 3Google Antigravity exfiltrates data via indirect prompt injection attack3 people · 768 points · first shared 2025 · 215 comments on HN
- 4Superhuman AI Exfiltrates Emails3 people · 3 points · first shared 2026 · 1 comments on HN
- 5IBM AI ('Bob') Downloads and Executes Malware2 people · 49 points · first shared 2026 · 15 comments on HN
- 6Data Exfiltration in Claude for Excel2 people · 20 points · first shared 2025 · 1 comments on HN
- 7Remote Code Execution on a $1B Legal AI Tool2 people · 9 points · first shared 2025 · discussion on HN
- 8Unpatched Ollama Vulnerabilities: Phishing Overlays and Data Exfiltration2 people · 6 points · first shared 2026 · discussion on HN
- 9Microsoft Copilot Cowork Exfiltrates Files2 people · 5 points · first shared 2026 · discussion on HN
- 10LLM Data Exfiltration via URL Previews (With OpenClaw Example and Test)2 people · 4 points · first shared 2026 · discussion on HN
- 11Notion AI: Unpatched Data Exfiltration2 people · 3 points · first shared 2026 · discussion on HN
- 12Ramp's Sheets AI Exfiltrates Financials2 people · 2 points · first shared 2026 · discussion on HN
- 13Ramifications of Using an Agent-in-the-Loop to Approve Commands2 people · 2 points · first shared 2026 · discussion on HN
- 14ChatGPT for Google Sheets Exfiltrates Workbooks2 people · 2 points · first shared 2026 · discussion on HN
- 15Screen Takeover Attack in AI Tool Acquired for $1B1 people · 7 points · first shared 2025 · 1 comments on HN
What HN people wrote when they linked it
danenania · 2026-03-11
> I thought we might finally have a high profile prompt injection attack against a name-brand company we could point people to.
These folks have found a bunch: https://www.promptarmor.com/resources
But I guess you mean one that has been exploited in the wild?
saberience · 2026-01-26
Literally this from the past two weeks, a prompt injection attack that works on Superhuman, the AI email assistant application.
https://www.promptarmor.com/resources/superhuman-ai-exfiltrates-emails
https://news.ycombinator.com/item?id=46592424
yunwal · 2026-01-21
> apparently completely written by Claude Code
https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files
> Claude Cowork Exfiltrates files
That explains it
rvz · 2026-01-20
> LLMs agents are not exploiting kernels to get out of the sandbox.
You can't assume that.
Attackers with LLMs have enough capabilities to engineer them to build exploits for kernel vulnerabilities [0] or to bypass sandboxes to exfiltrate data [0] in covert ways.
It is completely possible to craft a chained attack for an agent to bypass sandboxes even with or without a kernel exploit.
From [0] and [1]
[0] https://sean.heelan.io/2026/01/18/on-the-coming-industrialisation-of-e…
[1] https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files
ChrisArchitect · 2026-01-08
jingkai_he · 2026-02-08
Creator here. A few key differences:
1. from isolation pov, Matchlock launch Firecracker microvm with its own kernel, so you get hardware-level isolation rather than bubblewrap's seccomp/namespace approach, therefore a sandbox escape would require a VM breakout.
2. Matchlock intercepts and controls all network traffic by default, with deny-all networking and domain allowlisting. Bubblewrap doesn't provide this, which is how exfiltration attacks like the one recently demonstrated against Claude co-work (https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files)…
3. You can use any Docker/OCI image and even build one, so the dev experience is seamless if you are using docker-container-ish dev workflow.
4. The sandboxes are programmable, as Matchlock exposes a JSON-RPC-based SDK (Go and Python) for launching and controlling VMs programmatically, which gives you finer-grained control for more complex use cases.
OakNinja · 2026-01-08
"IBM Bob is IBM’s new coding agent, currently in Closed Beta. "
Promptarmor did a similar attack(1) on Google's Antigravity that is also a beta version. Since then, they added secure mode(2).
These are still beta tools. When the tools are ready, I'd argue that they will probably be safer out of the box compared to a whole lot of users that just blindly copy-paste stuff from the internet, adding random dependencies without proper due diligence, etc. These tools might actually help users acting more secure.
I'm honestly more worried about all the other problems these tools create. Vibe coded problems scale fast. And businesses have still not understood that code is not an asset, it's a liability. Ideally, you solve your business problems with zero lines of code. Code is not expensive to write, it's expensive to maintain.
(1) https://www.promptarmor.com/resources/google-antigravity-exfiltrates-d…
(2) https://antigravity.google/docs/secure-mode
htrp · 2026-08-05
I feel like prompt armor writes the exact same blog post for every agentic tool because they all suffer from the ignore previous instructions prompt injections.
https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files
https://www.promptarmor.com/resources/google-antigravity-exfiltrates-d…
https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via
https://www.promptarmor.com/resources/gpt-for-google-sheets-data-exfil…
https://www.promptarmor.com/resources/notion-ai-unpatched-data-exfiltr…
https://www.promptarmor.com/resources/ramps-sheets-ai-exfiltrates-fina…
https://www.promptarmor.com/resources/superhuman-ai-exfiltrates-emails