Cases › security breach › LR-2026-0371
Prompt injection leads to simulated /etc/passwd disclosure
Preliminary Why: Publisher not yet named · subject to change
Status: advice only, no fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity negligible: no effect beyond the system itself; the scenario is simulated, even without real system access
The Resecurity write-up presents a practical proof of concept in which an AI-powered HR assistant, designed to answer policy and process questions only, was steered by a prompt injection attacker into behaving as if it had local system access. The attacker first framed the assistant as an internal Linux support tool, then introduced a troubleshooting scenario, and finally asked it to read /etc/passwd. The source states that this tests whether the model enforces its lack of filesystem access instead of hallucinating or simulating sensitive data. The scenario shows how role confusion and gradual trust escalation can lead an assistant to produce sensitive-looking output without real system access. Its recommendations include least-privilege access, output validation, human approval for high-risk actions and adversarial testing.
What happened
What was done
“Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions.”
Risks
Primary50 incidents
Rising: 6 vs 2.8 a week
Read from the sources; not yet reviewed by a person.
Controls
HarnessDid not exist Validation of tool inputs and outputs
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Validation of tool inputs and outputs | L2 Harness | Did not exist |
| Tool allow-list | L2 Harness | Not stated in sources |
| Confirmation after untrusted input | L2 Harness | Not stated in sources |
| Outside content treated as data, not instructions | L2 Harness | Not stated in sources |
| Prompt-injection detection | L2 Harness | Not stated in sources |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Segmentation of agent components | L3 Application | Not stated in sources |
| Alerts on unusual tool use | L3 Application | Not stated in sources |
Evidence
- What set it off hidden instructions in its input
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.
Show the full account: 3 items from the primary sources
What happened, in order
Not dated in the sources:
- Step 1: the attacker frames the AI as an internal Linux or IT support assistant.
- Step 2: the attacker introduces a troubleshooting scenario about login issues.
- Step 3: the attacker asks the AI to read /etc/passwd.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Controls and remediations are generic recommendations in the article and are cited as advice only. The article's introduction mentions a Fortune 100 customer incident, but no details of that incident are given, so it is not recorded.
LR-2026-0371 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON