Unverified50% confidenceEventExact time
The Brave security team demonstrated hiding text invisible to the human eye within a screenshot, which, when read by a browser agent, caused it to open Gmail and send email subject lines to an attacker's URL.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/25/2026
First Seen
Valid until: 12/24/2026
Sources
Related Entities
Related Claims
UnverifiedAttackers can hide malicious instructions in web pages, documents, or even images, and when an agent reads this content it may mistake the instructions for legitimate commands and execute them72% similarUnverifiedThe Contact field of security.txt provides the security team's email address, page link, or phone number for researchers to report vulnerabilities.69% similarUnverified攻击者提交如AGENTS.md这类被AI代理默认读取的文本规则文件，引导AI去读取一张恶意PNG图片66% similarUnverifiedA developer posted on Hacker News describing their experience of being banned by Anthropic on the grounds of 'suspicious signals'65% similarUnverified感染Pegasus后攻击者可获取短信、通话记录、位置信息、加密聊天内容，并可远程激活摄像头和麦克风65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/948686API
curl https://kongchang.com/api/v1/knowledge/claims/948686MCP
get_claim(id=948686)