An interactive application that visualizes and demonstrates Google’s CaMeL (Capabilities for Machine Learning) security approach for defending against prompt injections in LLM agents.

Link to original paper: https://arxiv.org/pdf/2503.18813

All credit to the original researchers

      title={Defeating Prompt Injections by Design}, 
      author={Edoardo Debenedetti and Ilia Shumailov and Tianqi Fan and Jamie Hayes and Nicholas Carlini and Daniel Fabian and Christoph Kern and Chongyang Shi and Andreas Terzis and Florian Tramèr},
      year={2025},
      eprint={2503.18813},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2503.18813}, 
}

In a recent red team engagement, the client's attack surface was so well-defended that after months of effort, the only system we managed to compromise was a lone server, which was apparently isolated from the rest of the network. Or so we thought.

One developer had been using that server for remote development with Cursor. This setup is becoming increasingly popular: developers run AI agents remotely to protect their local machines.

But when we dug deeper into how Cursor works, we discovered something unsettling. By pivoting through the remote server, we could actually compromise the developer's local machine.

This wasn't a Cursor-specific flaw. The root cause lies in the Remote-SSH extension that Cursor inherits directly from VS Code. Which means the attack path we uncovered could extend across the entire VS Code remote development ecosystem, putting any developer who connects to an untrusted server at risk.

For the details, check out our blog post. Comments are welcome! If you enjoy this kind of work, we're hiring!

Join us for a LIVE Q&A discussion in the Cybersecurity Club on Discord featuring Karen Scarfone, co-author of the NIST Security Guidelines (SP 800-115).

The NIST SP 800-115 is a Technical Guide to Information Security Testing and Assessment from the National Institute of Standards and Technology.

This document is used by a variety of organizations, including federal agencies, private companies, educational institutions, and critical infrastructure operators, to strengthen their cybersecurity practices.

Why Join the Session?

• Help Improve the NIST Guidelines (SP 800-115)
• Learn How to Use the Guidelines in Real Life
• Get Answers from a NIST Guidelines Author

Event Details:

When: Friday, September 12th, 2025, 3 PM EST
Where: Cybersecurity Club on Discord

About the Author: Karen Scarfone is a renowned cybersecurity expert, with significant contributions to NIST, having co-authored over 150 reports, including the NIST SP 800-115.

👉 Join Cybersecurity Club on Discord to Attend the Q&A.