Developments elsewhere that bear on this problem: research, results, incidents and policy, each with its source. The UNSOLVED editors choose them every week, with AI research help. They are not verdicts: the review board rules only on contributions.
Google says adversarial training and real-time checks put Argon ahead on Gray Swan's indirect prompt-injection benchmark, cutting attack success across 15 adaptive attempts to 0.7%. The figure is self-reported and not zero; this problem asks for zero successful attacks from an independent adaptive red team.
Google · Developing Gemini 4 Argon responsibly and safely
A researcher disclosed CVE-2026-103572, which Microsoft patched on 13 October. A trailing dot in a filename got past the agent's protected-file check, so injected text could make it edit its own settings or add an MCP server and run code. Microsoft rated it Important. Another working exploit chain against a mainstream coding agent.
Embrace The Red · Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
The preprint routes every file, program and network action of a coding agent through a broker that checks the exact object acted on. Tested on 74 attacks, including replays of 10 public incidents, it lost 2, both secrets encoded into traffic to an allowed endpoint, held 14 for review and completed 43 of 46 benign operations. A system-level design measured on usefulness as well as attacks.
arXiv · Names Are Not Objects: Object-Bound Confinement for Compromised AI Coding Agents
Anthropic reports the adaptive Shade attacker succeeded in 0.08% of coding attempts, breaking 6 of 40 scenarios, and in 2 of 2,800 computer-use attempts. On Gray Swan's indirect injection benchmark, success at 15 attempts fell from 83.2% for Haiku 4.5 to 7.1%, but was 24.4% on computer use. No attack worked in 110 browser scenarios; Anthropic is dropping that test as a primary measure.
Anthropic · Claude Haiku 5.5 System Card
The preprint masks untrusted interface regions and has the agent commit to a per-action transaction before seeing them, which the authors say makes it secure by design under their threat model. On 400 WebArena tasks it reached 53.55% success against 55.12% undefended and 13.17% for a CaMeL-style baseline. The utility figures come from benign runs; it bears on criterion (b).
arXiv · Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents
Across 2,250 tasks, four agent setups and six model backbones, the authors report that localized visual perturbations made web agents select attacker-controlled elements and carry out the matching browser action 91.9% of the time on average, against 17.4% for the strongest baseline attack. It stayed effective against three agent-level defences. Injection does not need text.
arXiv · Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution
Adversa AI reports that Copilot CLI in autopilot mode decrypted instructions hidden on an attacker's page, treated them as its own and sent local files such as .env secrets to the attacker. The same instructions in plaintext were refused, and whether the attack worked depended on which model handled the session. Adversa says GitHub validated the finding but did not treat it as a vulnerability.
Adversa AI · GitHub Copilot CLI vulnerability: Cryptographic Context Injection steals developer secrets