- IBM’s GenAI tool “Bob” is vulnerable to indirect prompt injection attacks in beta testing
- CLI faces prompt injection risks; IDE exposed to AI-specific data exfiltration vectors
- Exploitation requires “always allow” permissions, enabling arbitrary shell scripts and malware deployment
IBM’s Generative Artificial Intelligence (GenAI) tool, Bob, is susceptible to indirect prompt injection, a common vulnerability among similar tools.
Indirect prompt injection occurs when the AI tool accesses content from other applications, such as emails or calendar entries.
A malicious actor can send a seemingly harmless email or calendar entry containing a hidden prompt that instructs the tool to perform harmful actions, including data exfiltration, downloading and executing malware, or establishing persistence.
Risky Permissions
Recently, security researchers from Prompt Armor released a report indicating that IBM’s coding agent, currently in beta, can be accessed via CLI (a terminal-based coding agent) or IDE (an AI-powered editor). The CLI is vulnerable to prompt injection, while the IDE is at risk from known AI-specific data exfiltration methods.
“We have opted to disclose this work publicly to ensure users are informed of the acute risks of using the system prior to its full release,” they stated. “We hope that further protections will be implemented to address these risks for IBM Bob's General Access release.”
However, for attackers to exploit this vulnerability, users must first configure Bob to grant broad permissions, specifically enabling the ‘always allow’ permission for any command.
This requirement may deter even the least security-conscious users. As the tool is still in beta, it remains unclear whether this permission is enabled by default, but it is unlikely.
According to Prompt Armor, the vulnerability allows threat actors to deliver arbitrary shell script payloads to victims, utilizing known and custom malware variants to execute various cyberattacks, including ransomware, credential theft, spyware, device takeover, and botnet assimilation.
