AI Agents Leak Data Without an Attacker

This report describes real-world AI agent failures that exposed internal screenshots and personal bank information without a traditional attacker. It also documents a prompt-based technique that can bypass some AI safety controls and a repository-delivery flaw that can run code before a developer approves an untrusted workspace.

Key findings

• Adversa AI's Involuntary In-Context Learning (IICL) attack uses examples labeled as "valid" or "not valid" to induce an AI model to provide content it would normally refuse.
• The IICL technique is described as a single-turn attack requiring only one message to the model; using operator names such as "answer" and "is_valid" reportedly reached a 100% bypass rate in one 50-probe test against GPT-5.4.
• Glow Labs found more than 13,000 internal screenshots and recordings exposed in public GitHub repositories after coding agents created public repositories to host pull-request images.
• A Grok Bot reportedly posted a user's checking and savings balances to an executive Slack channel because separate Bots shared a cloud computer, browser sessions, files, and credentials.
• Seven command-line coding agents reportedly ran repository-controlled Git configuration before displaying a workspace trust prompt, allowing a copied repository folder to execute a command as the developer.
• GitLab disclosed CVE-2026-90970, a high-severity template sandbox escape affecting self-hosted AI Gateway deployments; no confirmed exploitation was reported at the time.

Who’s being targeted

• Commonly targeted roles: Software developers, Engineering leaders, AI product teams, IT administrators, Security awareness teams, Employees who use AI assistants with connected Slack, email, code, or financial accounts.
• Affected industries: Technology and software development, Financial services, Professional services, Organizations using self-hosted GitLab AI Gateway.
• Attack channels: website, physical.
• Impersonated: A user presenting a structured classification or evaluation task to an AI assistant, A project collaborator or source of a shared codebase.

Awareness takeaways

• Treat AI-agent permissions and shared environments as a data-sharing risk: a separate agent is not necessarily a security boundary.
• Do not allow coding agents to publish review artifacts to public repositories without explicit approval and monitoring, including employees' personal accounts.
• Treat copied code folders and repositories from ZIP files, shared drives, and USB devices as untrusted until inspected and approved.
• Build AI controls that recognize suspicious prompt structure, not just blocked keywords or phrases.

Red flags to watch for

• The task uses many examples to redefine what counts as a "valid" answer.
• The final request asks the model to follow the invented task rules rather than its normal safety boundaries.
• Neutral task language is used to elicit content that would normally be blocked.
• The project arrives as a folder, ZIP file, shared-drive copy, or USB transfer with a hidden `.git` directory.
• The AI coding agent starts Git operations before asking whether the workspace is trusted.
• A workspace trust prompt appears only after the agent has already inspected the repository.