Block red-teamed its own AI agent to run an infostealer

Block's CISO describes how the company red-teamed its internal AI agent Goose, successfully executing a prompt injection attack that installed infostealer malware on an employee laptop. The attack exploited poisoned recipes (reusable workflows) with malicious instructions hidden in invisible Unicode characters. Block has since Show more