Researchers disclosed a critical flaw in an AI assistant integrated with corporate project management tools, exploitable from a single interaction and capable of inducing the sending of content from internal systems.
The pattern repeats what appeared in the period's other episodes: the assistant reads content produced by third parties inside the workflow itself, and doesn't reliably distinguish information to process from instructions to obey.
Severity increases with the usage context. Project management tools concentrate task descriptions, team comments and frequently credentials or system paths, material nobody treats as public but that many people can write.
The technique that hijacked coding assistants through error logs shares that structure, as does the one that redirected AI browsers with a comment planted on a social thread.
The practical recommendation is the recurring one: treat everything the assistant reads as untrusted input, restrict what it can reach, and require confirmation before any action that sends data outside.