A thought on prompt injections. Could this defensive countermeasure work?

Before sending off a prompt, hash sign it using an ... MCP-prompt sign endpoint.

Then within the prompt ask the "agent" once completed with it's job, always use the MCP-prompt sign endpoint to sign what it believes is it's current prompt.

Once the LLM has completed processing, signed it's "current prompt", the original requestor can compare the two signed hashes.

I know I'm missing stuff here, but might this be worth exploring?

#LLM #AI #PromptInjection

Hacking AI is TOO EASY (this should be illegal)

https://tube.blueben.net/w/vgMT9j9tpNwjUE9DreejG7

Ever imagine your calendar invite could secretly control your smart home? A glitch in Gemini AI is letting hackers slip in hidden commands through Google Calendar, sparking serious cybersecurity alarm. What’s really lurking in your schedule?

https://thedefendopsdiaries.com/understanding-the-gemini-ai-vulnerability-in-google-calendar-invites/

#geminiaivulnerability
#googlecalendarhack
#promptinjection
#cybersecuritythreats
#smartdevicecontrol

How to outsmart an AI scammer bot | TikTok

It appears that you can also verbally command an AI to give you a cookie recipe?

https://www.tiktok.com/@jessharrison243/video/7536227986396302614

#ai #llm #promptInjection #scammer

"The core problem is that when people hear a new term they don’t spend any effort at all seeking for the original definition... they take a guess. If there’s an obvious (to them) definiton for the term they’ll jump straight to that and assume that’s what it means.

I thought prompt injection would be obvious—it’s named after SQL injection because it’s the same root problem, concatenating strings together.

It turns out not everyone is familiar with SQL injection, and so the obvious meaning to them was “when you inject a bad prompt into a chatbot”.

That’s not prompt injection, that’s jailbreaking. I wrote a post outlining the differences between the two. Nobody read that either.

The lethal trifecta Access to Private Data Ability to Externally Communicate Exposure to Untrusted Content

I should have learned not to bother trying to coin new terms.

... but I didn’t learn that lesson, so I’m trying again. This time I’ve coined the term the lethal trifecta.

I’m hoping this one will work better because it doesn’t have an obvious definition! If you hear this the unanswered question is “OK, but what are the three things?”—I’m hoping this will inspire people to run a search and find my description.""

https://simonwillison.net/2025/Aug/9/bay-area-ai/

#CyberSecurity #AI #GenerativeAI #LLMs #PromptInjection #LethalTrifecta #MCPs #AISafety #Chatbots

Attacking GenAI applications and LLMs

LLM prompt attacks leak data, abuse tools

https://security.humanativaspa.it/attacking-genai-applications-and-llms-sometimes-all-it-takes-is-to-ask-nicely/

#AI #promptInjection

Woof. This is pretty rough for Sam. I haven't even gotten to play with it.

https://www.securityweek.com/red-teams-breach-gpt-5-with-ease-warn-its-nearly-unusable-for-enterprise/

#genai #promptinjection