Скачать или смотреть GitLab Duo AI Vulnerability Exposed

Researchers found a critical prompt injection flaw in GitLab Duo that allowed attackers to exfiltrate private code & confidential data — all through hidden instructions in code, comments, and merge requests.

💻 How it worked:
• Hidden prompts (invisible text, encoding tricks) manipulated Duo’s behavior
• Combined with HTML injection, Duo could leak data via malicious img tags
• Private source code & even zero-days could be stolen using Duo’s own permissions 😱

🔒 GitLab has patched it, blocking unsafe HTML to external domains. But the exploit shows how AI assistants can be weaponized through subtle manipulations.

#CyberSecurity #GitLab #PromptInjection #AIHacking #DataLeak #ZeroDay #InfoSec #SecureAI #AIExploitation #BugBounty #ResponsibleDisclosure #DevSecOps

https://arstechnica.com/security/2025...

https://www.legitsecurity.com/blog/re...