Unverified50% confidenceSolutionExact time
攻击者提交如AGENTS.md这类被AI代理默认读取的文本规则文件，引导AI去读取一张恶意PNG图片
1
Sources
50%
Confidence
Long-term
Relevance
7/15/2026
First Seen
Sources
Related Claims
VerifiedPrompt injection attacks induce AI agents to execute malicious operations by embedding text disguised as system instructions in code comments, documentation, web content, or even file names.77% similarUnverified攻击者利用AI幻觉出的包名，提前在npm、PyPI等包注册表抢注并植入恶意代码，这种攻击手法被称为slopsquatting73% similarUnverifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.72% similarUnverifiedAI编程助手读取文件时内容会被序列化为token流，通过HTTPS加密传输至云端推理服务器，但数据在服务器端推理时处于明文状态71% similarUnverifiedAI 智能体可能读取敏感配置文件、执行 rm -rf 等破坏性命令、将数据发送至未授权外部服务69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/513733API
curl https://kongchang.com/api/v1/knowledge/claims/513733MCP
get_claim(id=513733)