First reported codesecai.com
Analysis · latest
First reported simonwillison.net
Understanding ChatGPT Work
Simon Willison's teardown of OpenAI's ChatGPT Work (specifically the cloud variant, Work Cloud) argues its feature set — internet-enabled code execution, a headless Chrome browser, a persistent scratch filesystem, sub-agents, scheduled automations, and Cloudflare Workers site deploys — combines all three elements of his 'lethal trifecta': access to private data, exposure to untrusted content, and a channel to exfiltrate stolen data. Willison does not demonstrate an exploit but asks OpenAI to explain how it defends Work sessions against prompt injection, criticizing the product's opacity around system prompts and tool descriptions. Details →First reported humansecurity.com
AI Crawler, Agent, and Bot Guide: How to Identify AI Traffic Patterns
HUMAN Security's explainer distinguishes categories of AI-driven web traffic—scrapers and crawlers that feed LLMs (e.g. GPTBot, ClaudeBot), RAG retrieval bots, AI browsers, and full agentic systems that plan and act across multiple steps. The piece argues these classes behave differently and that lumping them together leads security teams toward blunt, ineffective controls. Details →First reported · updated · 2 reports whenmachines.com
AI Agent Computer Use Safety: How to Deploy One Without Getting Burned | WhenMachines
WhenMachines publishes a guide on safely deploying computer-use AI agents, explaining why these agents are riskier than chatbots because they can act on a machine, and detailing risks like indirect prompt injection. The article recommends defensive measures including disposable isolated environments, least privilege, separating reading from acting, human approval at consequential boundaries, guardrails, logging, and governance frameworks. Details →First reported cruxdigits.nl
AI Browser Agents in 2026: The Security Verdict
An analysis piece surveys the security state of AI browser and computer-use agents in 2026, citing a June 2026 University of Washington study that found four of seven popular agentic browsers let a malicious webpage bypass the same-origin policy, and discussing prompt-injection risks alongside Anthropic's Claude Opus 5 defenses. The article synthesizes findings on Perplexity Comet, OpenAI Atlas, and Anthropic's Computer Use API rather than presenting new primary research. Details →First reported nhimg.org
AI-driven browser prompt injection exposes account takeover gaps
NHIMG summarizes Fingerprint's analysis of the Comet AI-powered browser incident, arguing that prompt injection can turn hidden web content into unauthorized actions, data leakage, and account takeover when AI agents interpret injected instructions as trusted commands. Fingerprint recommends layered device intelligence, behavioral checks, and step-up authentication to challenge malicious browser automation before credentials or payment flows are completed. Details →First reported appscale.blog
Browsing Agent Prompt Injection: The Architecture Fix
An AppScale blog post analyzes indirect prompt injection against browsing agents, arguing the risk cannot be reliably fixed at the model layer and must instead be contained architecturally. It recommends a dual-LLM split (a privileged planner that never reads raw page text plus a quarantined, tool-less reader), egress allowlists, human gates on irreversible actions, and per-task capability tokens to break the 'lethal trifecta' of private-data access, untrusted content, and exfiltration paths. Details →First reported pushsecurity.com
How to discover AI, enforce policies, and prevent data loss
A Push Security blog argues that blocking AI tools at the network level drives shadow AI underground, and outlines a governance approach for discovering unapproved AI apps, browser extensions, OAuth integrations, and MCP connections, plus enforcing data-flow controls (blocking uploads/downloads/clipboard pastes and monitoring AI chat transcripts). The piece cites telemetry claiming the average organization runs 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in a typical week, most unapproved. Details →First reported · updated · 2 reports nhimg.org
AI Browser Agents: 6 Enterprise Security Risks (2026)
An analysis of enterprise security risks from AI browser agents argues that indirect prompt injection lets attackers hide malicious instructions inside content an agent consumes, turning the agent's autonomy—acting under a user's identity with access to mail, documents, and connected services—into a data-exfiltration and unauthorized-action risk. The piece frames agentic browsers as a new trust boundary that IAM, PAM, and NHI programs must govern, citing Noma Security's analysis. Details →First reported medium.com
AutoJack: The New Vulnerability Class Letting a Single Webpage Hijack Your AI Agent | by Raj Namdev | CodeToDeploy
A Medium write-up describes AutoJack, a named vulnerability class in which a single malicious webpage embeds content that hijacks an AI browsing agent's reasoning during a normal task (summarizing, price-checking, form-filling) and redirects it to execute the attacker's instructions with no user click, download, or approval. The piece frames it as a recently demonstrated form of indirect prompt injection against AI browsing agents. Details →First reported schneier.com
Anthropic's Opus 5 Is Better at Resisting Prompt Injection - Schneier on Security
Schneier highlights results from Anthropic's Claude Opus 5 system card showing improved robustness on the indirect prompt injection (IPI) benchmark, reducing an attacker's success probability within 15 attempts from 5.5% (Opus 4.8) to 2.0%, and outperforming rival models like GPT 5.6 Sol (20.0%) and Muse Spark (16.5%). The post notes that while prompt injection is considered impossible to prevent in the general case, models are getting substantially better at blocking it in specific cases. Details →First reported falshaw.de
Prompt Injection Is a Confused-Deputy Problem We Already Solved
Nick Falshaw argues that indirect prompt injection against AI agents is a classic confused-deputy problem — a trusted agent with real authority tricked into misusing it by attacker-supplied content it cannot distinguish from legitimate instructions — and that it cannot be fixed by making models smarter, only contained with network-security-style boundaries. The piece draws on a 2026 study (arXiv:2605.17634) finding direct prompt injection succeeded over 79% of the time against browser agents and Simon Willison's 'lethal trifecta' framing. Details →First reported nhimg.org
AI agents in the browser: what it means for IAM controls
An NHIMG editorial based on Surf Security content argues that AI agents which browse, log in, and act across SaaS and admin portals create machine-speed risk when they run in unmanaged browsers, leaving excessive permissions, persistent credentials, and limited auditability. It recommends treating the browser as an enforcement boundary and separating credential handling from agent logic to govern where agents may execute. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector