Hacking neural networks so that we don’t get stuck in the matrix. Builder and Breaker. Opinions are my own. monthofaibugs.com
127.0.0.1
- Tweets 2,435
- Following 685
- Followers 11,590
- Likes 4,390
Pinned Tweet
A . is all you need! 🔥
RCE in Copilot for Visual Studio and SSMS.
A trailing dot added to a config filename bypasses Copilot's security controls, leading to remote code execution in Visual Studio and SQL Server Management Studio.
embracethered.com/blog/posts…
21
15
76
4,336
@wunderwuzzi23 just showed how one trailing dot let Copilot in Visual Studio rewrite its own config.
Copilot wasn't supposed to touch .mcp.json or its settings files. There was a check for exactly that. But the check compared the filename as a string. "settings.json." with a dot at the end is a different string, so it passed. Then Windows dropped the dot when writing, and the write landed on the protected file.
From there, he showed a hijacked agent could add its own MCP server and get command execution. He also showed it could be triggered through indirect prompt injection. Microsoft patched it Oct 13 (CVE-2026-103572).
The agent didn't break anything clever. The check looked at what the request was called, not what it would actually touch.
This is why I don't trust a protection that lives next to the agent and reads the name of the thing. The only check that holds is one that sees the final write on the real file, after Windows or the shell or the framework has done its translating.
If you let an agent edit files, test it. Try the same target through odd spellings: trailing dots, ../ paths, symlinks. Check what the file system actually changed, not whether your guard said no.
Full write-up by Johann: embracethered.com/blog/posts…
7
2
10
884
The first car to exceed 100 km/h was electric... in 1899.
Let's see what we get today. 🚘 + 🚀
1
6
1,060
It led to a high severity RCE in Visual Studio and SQL Server Management Studio and the patch shipped today for Patch Tuesday. CVE-2026-103572
MSRC Bulletin:
msrc.microsoft.com/update-gu…
Full write-up will be published soon. 🔥
4
11
988
Published it:
A . is all you need! 🔥
RCE in Copilot for Visual Studio and SSMS.
A trailing dot added to a config filename bypasses Copilot's security controls, leading to remote code execution in Visual Studio and SQL Server Management Studio.
embracethered.com/blog/posts…
4
487
A . is all you need! 🔥
RCE in Copilot for Visual Studio and SSMS.
A trailing dot added to a config filename bypasses Copilot's security controls, leading to remote code execution in Visual Studio and SQL Server Management Studio.
embracethered.com/blog/posts…
21
15
76
4,336
Johann Rehberger retweeted
legend author @wunderwuzzi23
Stop the robot apocalypse. 🤖
Learn to hack AI apps and agents to make sure they’re safe and secure.
Take our course and develop your AI hacking skills:
HACKING AI APPS & AGENTS
by Johann Rehberger (@wunderwuzzi23)
✔️ 11 hands-on labs
✔️ 6+ hours of video content
✔️ Lifetime access & updates
✔️ Community access
✔️ Real hunter strategies
Still on 40% OFF PROMO!
Johann found and disclosed some of the first major prompt injection attacks against production AI agents. Learn his methodology straight from him.
1
1
424
Monitor your agents, folks!
I had GLM-5.3 running in a lab overnight to build a POC, but also have a sentinel agent (GPT-6) to check what's going on and instructions to kill GLM if it goes off track.
Overnight, the sentinel caught GLM attempting to connect to a totally different host and killed it.
121
104
1,904
171,609
If you are interested in AI security and red teaming at large, check out my blog:
embracethered.com/blog
18
6,374
Johann Rehberger retweeted
A prompt can ask an agent to be read-only. Only a permission can make it read-only.
Copilot in SQL Server Management Studio is a good example. It relied on its system prompt plus a regex blocklist, and Johann showed that calling EXEC through a variable got past both. It's patched now.
If the connection can write, the agent can write. Great write-up and talk, worth the time.
From SELECT to SYSADMIN 🔥
Happy to share my research on the Microsoft's AI database assistant in SQL Server Management Studio, aka SQL Copilot.
This led to discovery of critical elevation paths. Make sure your SSMS installations are up to date.
Thanks to Microsoft for patching quickly and selecting this research to be presented at BlueHat Asia two weeks ago. 🙏
Have you heard of database CONSTITUTION.md before? 🤔
If not, read on and check out the blog for the full technical details and video demos.
🔽 🔽 🔽
embracethered.com/blog/posts…
1
1
7
546
Johann Rehberger retweeted
Machine Learning Attack Series.
Still worth a reading
embracethered.com/blog/posts…
1
12
36
1,356
When I started writing about ml attacks 6 years ago, the main reason was the gap I noticed between ml safety research and security.
It's a good strategy to assume stuff is compromised and ask question like:
- How would we even know it happened?
- What are we gonna do about it?
8
4
36
1,968
Machine Learning Attack Series.
Still worth a reading
embracethered.com/blog/posts…
1
12
36
1,356