x.comthreadRichard Abishai (@richardabish_ai) on X
An X post by the creator of ROPE, a prompt-injection benchmark for LLM agents. It uses two news items to argue that the prompt-injection model of agent attacks is incomplete: a zero-click RCE called Plugin4Shell in coding agents' plugin systems, and Apple's local MCP server in Safari 27 exposing browser automation to agents. Neither involved persuading a model. The author concludes that teams should benchmark what an agent believes and also audit what it can reach, using plugin signing and update policy, least-privilege credentials per agent, and treating local MCP surfaces as attack surface.
TL;DR Agent threats aren't only prompt injection: plugin RCE (Plugin4Shell) and new local MCP surfaces (Safari 27) show that agent reach needs auditing too.
Organisations named here
- Plugin4Shell
Technologies named here
- Major coding agents
- ROPE
- Safari 27
- Plugin4Shell
- Safari 27 local MCP server
- AI Agent Store
- Model Context Protocol
- Safari
Techniques named here
- Prompt injection against LLM agents
- Zero click remote code execution via agent plugin
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle