Investigates how instructions hidden in webpages, code and tool responses can redirect AI agents, with concrete attack reports and the permissions that made them possible.
Why read Johann Rehberger?
Read Rehberger when you want to follow an agent attack from the content it encounters to the action it takes. His AI ClickFix report shows a computer-use agent following instructions on a webpage and running a terminal command. The case makes the trust boundary visible: a page the agent visits can influence what it does on the computer.
His Windsurf MCP report follows a different path: a source-code comment causes an agent to read a private Slack message and post it to a public channel in the tested setup. Read the recommendations on configuring individual tools after the attack anatomy. These are dated product reports, useful for identifying boundaries to check in your own workflow.
Start with the original
Selected work
-
Attack report ·
AI ClickFix: Hijacking Computer-Use Agents Using ClickFix
How can a webpage redirect a computer-use agent? His proof of concept follows a browser interaction into terminal execution, then discusses isolation, network boundaries and sensitive information inside the host.
Cite this selection
XFollowList, “AI ClickFix: Hijacking Computer-Use Agents Using ClickFix” reading notes in the Johann Rehberger profile. https://xfollowlist.com/people/johann-rehberger#work-ba7b822b9e24
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
Attack report ·
Windsurf MCP Integration: Missing Security Controls Put Users at Risk
How can an agent leak a private message through its tools? His tested source-code-comment attack links private Slack access to a public write. Continue to the recommendations for configuring each tool.
Cite this selection
XFollowList, “Windsurf MCP Integration: Missing Security Controls Put Users at Risk” reading notes in the Johann Rehberger profile. https://xfollowlist.com/people/johann-rehberger#work-80aef709b5ef
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
Projects & roles
Embrace The Red
His security research publication, covering application attacks, prompt injection and defensive design.
Community rating
Sources & further reading
Profile sources checked . This describes checking these references, separately from the publication dates of selected works.
- The author’s blog links @wunderwuzzi23; current X metadata names Johann Rehberger.
- Current profile name and own bio agree with the blog’s security-research identity.
Cite this profile’s source check
XFollowList, Johann Rehberger profile sources. Sources checked 2026-10-11. https://xfollowlist.com/people/johann-rehberger#sources-checked