Welcome to The Senroc Download! This is your weekly briefing from the team at Senroc Technologies letting you know what we're seeing, what we're thinking, and tips you can use right now.

Johann Rehberger, a researcher who specializes in this class of problem, demonstrated that an AI coding assistant could be made to execute an attacker’s code after being given an apparently harmless instruction: summarize this website. The page was built to walk the assistant through a series of individually reasonable steps that ended with code running on the machine. Across the variants he tested, it worked as often as 80 percent of the time.

The underlying problem has a name — prompt injection — and it reaches well beyond coding tools. Any AI assistant that reads something on your behalf, whether a web page, a PDF or an email, is reading content somebody else wrote. If that content contains instructions, the assistant may simply follow them, because it has no dependable way to separate “text I was asked to read” from “text telling me what to do.”

The vendor’s response is worth quoting, “a convenience feature backed by a best-effort classifier, not a security guarantee.” This description holds true in all categories. Just because it is convenient does not mean it is in your best interest from a security perspective.

Takeaway: This isn’t an argument for avoiding AI tools. It’s an argument for being deliberate about how you’re using them. Before you let an assistant browse the web, open attachments, or reach into a company system on its own, ask what it’s permitted to do without a human acknowledgement, and keep that list short.

Between August 4 and 21, attackers got into roughly 5,000 Dropbox accounts without knowing a single Dropbox password. The flaw wasn’t at Dropbox. Instead Lenovo’s account system allowed someone to register a Lenovo ID using an email address that wasn’t theirs, and Dropbox accepted a “sign in with Lenovo” as proof of identity.

Dropbox has since expired those sessions and now asks for a password alongside a Lenovo sign-in. However, the overarching issue here is still relevant. Every “sign in with…” button (ex. Google, Microsoft, Facebook, etc.) is a trust relationship between two companies, and your account is only as well protected as the weaker one. Nobody consciously agreed to Lenovo’s security standards, they just wanted to avoid creating yet another password.

Takeaway: In each service holding real business data — file storage, accounting, CRM — open the account or security settings, look at connected sign-in methods, and remove any you don’t actively use. Where a service holds anything sensitive, prefer its own login with multi-factor authentication over a convenience button.

The exception here is if you are using Microsoft or Google as your business identity. These options are a strong identity provider that you actively administer with employee onboarding and offboarding.

This month, Microsoft acknowledged that Defender for Office 365 was blocking legitimate Google search links, warning users that opening the site might not be safe. Pasting the link directly into a browser didn’t help. It followed a separate glitch days earlier in which Defender told people their antivirus was switched off when it wasn’t.

Neither is dangerous by itself. However, the damage lies with the thing security depends on most, which is people taking warnings seriously. A tool that blocks an ordinary search result today is the same tool your staff learns to ignore tomorrow. The entire value of a warning is that it’s unusual and only happens when there is concern.

The second cost falls on whoever administers your systems. False alerts arrive in the same queue as real ones; Microsoft specifically warned administrators to expect related alerts needing manual review. The time spent clearing this kind of noise is time not spent on the alerts that matter.

Takeaway: Employees may be inclined to turn off security features if they are receiving false alerts or unnecessary noise, especially after a few days of nuisance. This is the wrong action to take! The right action is to notify your IT team, so they can investigate and determine if the alerts are legitimate or if there is a larger issue at play. Security features that get turned off even temporarily often never get turned back on leaving your systems vulnerable.