Johann Rehberger published a working indirect prompt injection against Windsurf's Cascade coding agent on August 21. Instructions hidden at the top of a source file cause Cascade, while analyzing that file, to read the developer's .env and send the contents out through its read_url_content tool, which issues outbound HTTP requests with no approval prompt. A second vector renders markdown images from attacker-controlled domains, encoding secrets in the request path — private data, untrusted content and network egress in one agent, the lethal trifecta pattern he credits to Simon Willison.

The findings were reported to Windsurf on May 30, 2025 and receipt was acknowledged within days, but Rehberger published after three months without a triage or fix update; the post records that Windsurf then said it would work on fixes, with no ETA. He withheld full payload details because the issues were still open.

Bloomberg reported on August 21 that Anthropic is nearing a deal to raise as much as $10 billion, up from the $5 billion it was discussing in late July, at the $170 billion valuation reported earlier that month, with Iconiq Capital leading. People familiar with the talks attributed the larger sum to investor demand rather than a change in the company's plans, and said terms are not final.

The raise buys training and inference capacity, and it sets the funding bar for every other model lab; valuations at this level imply a monetization expectation that surfaces for developers later as pricing, rate limits and license terms. It also lands in the same week that DeepSeek's open weights pushed per-token prices down while DeepSeek's own scheduled price increase moved up — the two halves of the model market pulling in opposite directions.

Brave's security team disclosed an indirect prompt-injection flaw in Perplexity's Comet: asked to summarize a webpage, Comet feeds page content to its LLM without separating the user's instruction from untrusted text, so payloads hidden in a Reddit comment behind a spoiler tag, in white-on-white text, or in HTML comments are executed as commands. The proof of concept walked the agent into the user's authenticated Perplexity account to lift an email address, into Gmail to read the one-time password sent there, then exfiltrated both by replying to the attacker's comment — with no further user input.

The disclosure timeline is the argument: reported July 25, an initial fix on July 27, judged incomplete on July 28, a one-week public notice on August 11, published August 20 — and Brave updated the post that same day, after further testing, to say the attack class was still not fully mitigated. Perplexity said the reported issue was fixed. Brave's write-up makes the structural point directly: when the assistant acts with the user's full privileges across logged-in sessions, same-origin policy and CORS are effectively useless.

Attorney general Ken Paxton opened an investigation on August 18 into Meta AI Studio and Character.AI, saying the platforms may be misleadingly marketing themselves as mental health tools, impersonating licensed professionals and fabricating qualifications. His office issued civil investigative demands — legal orders requiring documents, data or testimony — to test whether state consumer-protection law was broken. No charges have been filed.

The complaint is about disclosure and data use, not model quality: the release says the bots assert confidentiality while interactions are logged, tracked and exploited for targeted advertising and algorithmic development. Meta told TechCrunch its AIs are labeled as AI and are not licensed professionals; Character.AI said it is only beginning to explore targeted advertising and that this has not involved the content of chats. The probe follows an existing Texas investigation of Character.AI under the SCOPE Act, the state's minor online-safety law.