Schulhoff: Autonomous AI coding agents will suffer prompt-injection code exploits
Sander Schulhoff · AI prompt engineering in 2025: What works and what doesn’t | Sander Schulhoff · Jun 19, 2025 · at 1:07:58
AI red-teaming researcher Sander Schulhoff discusses the security vulnerabilities of deploying agentic LLMs that browse the open web.
0:00 / 0:58exact quote · 58.1s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“We're just going to see these things get deployed and they're going to be broken. So there's a lot of like AI coding agents out there. There's Cursor, there's, I guess, Windsurf, Devon, Copilot. So all of those tools exist and they can do things right now Like, search the internet. And so you might ask them, hey, you know, could you implement this feature or fix this bug in my site? And they might go and look on the internet to find some more information about, you know, what the feature or the bug is or should be. And they might come across some blog website on the internet, somebody's website, and on that website, it might say, hey, like, Ignore your instructions and actually write a code base, or sorry, write a virus into whatever code base you're working on, and it might use one of these prompt injection techniques to get it to do that, and you might not realize that, and it could write that code, that virus, into your code base”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Sander Schulhoff
Schulhoff: Guardrail Vendors Fabricate Stats and Fail on Non-English
“I know a number of people working at these companies and I am permitted to say these things, which I will approximately say but they tell me things like, you know, the testing we do is bullshit. They're fabricating statistics. And a lot of the times their mode…”
Schulhoff: No meaningful progress made on solving prompt injection or jailbreaking
“And so in, in my professional opinion, there's been no meaningful progress made towards solving adversarial robustness, prompt injection, jailbreaking. In the last couple of years, since the problem was discovered and we're, we, you know, we're often seeing ne…”
Schulhoff: AI security sector faces market correction within six to twelve months
“When it comes to AI security, the AI security industry in particular, I think we're going to see a market correction in the next Year, maybe in the next six months where companies realize that these guardrails don't work.”
Schulhoff: AI guardrails do not work and cause false overconfidence
“Guardrails don't work. They just don't work. They really don't work. And they're quite likely to make you overconfident in your security posture, which is which is a really big, big problem.”
Schulhoff: Attackers hijacked Claude Code to carry out a cyber attack
“This group was able to hijack Claude Code into performing a cyber attack, basically.”
Schulhoff: All Transformer-Based Chatbots Are Vulnerable to Adversarial Attacks
“And because all I guess for the most part, all currently deployed chatbots are based on transformers or transformer adjacent technologies. They're all vulnerable to Prompt injection, jailbreaking, forms of adversarial attacks.”