First reported · updated · 4 reports edgelabs.ai
Analysis · latest
First reported forkast.news
Memory Poisoning: AI Security Threat Explained | Forkast Learn
Forkast's glossary entry defines memory poisoning, an attack against LLM-based AI agents in which adversaries inject malicious or false data into an agent's persistent long-term memory layer (vector databases, semantic indexes, grounding caches, or stored conversation histories). The entry explains its temporal decoupling and persistent blast radius, cites OWASP's ASI06 classification, and describes common vectors such as poisoned PDFs, web pages, and support tickets leveraging indirect prompt injection. Details →First reported truefoundry.com
LLM Agent Security: Runtime and Control Planes
A TrueFoundry blog post frames LLM agent security as a systems problem, discussing how untrusted content can redirect agent control flow, misuse tool privileges, corrupt persistent state, and leak data, and arguing for runtime and control-plane defenses. The piece draws on a linked arXiv survey ('Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation') that synthesizes 247 papers, while also promoting the vendor's TrueForge agent harness. Details →First reported · updated · 2 reports acalvio.com
AI Agent Security Risks: What Happens When Agents Are Manipulated
Acalvio's write-up synthesizes OWASP's agentic AI security guidance (the AI Agent Security Cheat Sheet, Top 10 for LLM Applications, and Top 10 for Agentic Applications 2026), mapping risks like prompt injection (LLM01), excessive agency, and trust-chain abuse to detection requirements, and argues deception (decoy APIs, deceptive credentials, honeytokens) adds a runtime detection layer. It frames the challenge using the disclosed GTG-1002 AI-orchestrated espionage campaign, in which a Chinese state-sponsored group manipulated Anthropic's Claude Code to execute an autonomous intrusion at machine speed. Details →First reported beam.ai
When AI Agent Memory Becomes a Liability
An analysis piece from beam.ai argues that persistent memory in AI agents is a design liability, cataloging four failure modes: error compounding, context degradation, security exposure via memory poisoning, and compliance risk. The article notes that a maliciously poisoned memory entry planted once can fire weeks later across users, expanding the blast radius from a single request to an agent's entire workflow history, and cites controlled-benchmark research on how irrelevant context degrades LLM reasoning. Details →First reported · updated · 5 reports nhimg.org
AI Agent Memory Poisoning: Persistent Agent Attacks
An explainer on agent memory poisoning describes how a single adversarial write into an LLM agent's persistent memory store is retrieved and executed across future sessions, unlike a prompt injection that dies when the turn ends. It draws on red-team research (AgentPoison, which backdoors memory/RAG knowledge bases, and MINJA, which injects malicious records via query-only interaction) and recommends architectural defenses: authorising writes outside the model, provenance stamping, trust-weighted retrieval, and quarantining new writes. Details →First reported substack.com
Coding Agent Security: Lessons from Claude Code, Cowork, Codex, and Copilot in the Wild
Ken Huang's survey "Coding Agent Security" reviews documented 2025-2026 incidents involving AI coding agents (Claude Code, Cowork, Codex, Copilot, Amazon Q), including agents that deleted databases, leaked credentials, and merged malicious code after indirect prompt injection via GitHub Issues, source-code comments, or MCP tool results. The piece maps a four-stage risk chain (untrusted text enters context, model can't separate instruction from data, model issues a tool call, tool call has real-world effect) and argues policy enforcement must live at the action boundary. Supporting evidence includes embracethered's Amazon Q Developer VS Code extension RCE via prompt injection abusing the readonly-classified find -exec flag. Details →First reported medium.com
Indirect prompt injection: what LLM bounty triagers actually reward | InfoSec-Writes Up
An InfoSec-Writes Up article by Muhammad Haider Tallal explains why bug bounty triagers at Google, OpenAI, and Mozilla's Odin frequently close direct prompt injection and jailbreaks as informational while paying for indirect injection chains that produce real account or data impact. It cites a case where a malicious task planted in a Jira ticket silently wiped a victim's Gemini memory and earned a $15,000 payout. Details →First reported intigriti.com
RAG and ruin: why your existing controls may miss AI poisoning attacks
An Intigriti blog post titled "RAG and ruin: why your existing controls may miss AI poisoning attacks" discusses how retrieval-augmented generation (RAG) systems can be compromised through data/knowledge-base poisoning, and argues that traditional security controls fail to detect such AI-specific poisoning attacks. Details →First reported · updated · 2 reports arthur.ai
One Poisoned Agent Infects the Whole Chain | Ravoid
An explainer on how prompt injection propagates across multi-agent LLM systems, showing that a payload buried in a retrieved document, tool result, subagent output, or shared memory becomes trusted input to downstream agents and rides the chain past a single front-door guardrail. The piece argues every inter-agent handoff must be treated as a trust boundary and references the 'Prompt Infection' research on self-replicating LLM-to-LLM injection. Details →First reported aws.com
Memory Poisoning Attack in AI Agents - Attack vectors and defenses on AWS | AWS Builder Center
An AWS Builder Center article titled "Memory Poisoning Attack in AI Agents" discusses attack vectors and defenses for memory poisoning against AI agents on AWS. The retrievable page body contains only cookie-consent boilerplate, so the substantive technical content could not be analyzed. Details →First reported detect.fyi
Detection Engineering in the Era of Semantic Malware
A detection-engineering analysis examines "semantic malware" / "promptware" — malware delivered through prompt injection rather than binaries — using Origin's Brainworm PoC (a poisoned CLAUDE.md file that hijacks AI coding assistants into registering with a C2 server over RabbitMQ) and the Ben-Gurion/Tel Aviv/Harvard/Toronto "Promptware Kill Chain" arXiv paper as anchors. The kill chain formalizes seven stages (initial access via prompt injection, jailbreaking, reconnaissance, memory/retrieval poisoning, command-and-control, lateral movement, actions on objective) across 36 documented incidents, and the piece discusses how defenders can detect such trust-boundary failures. Details →First reported agentsafelabs.com
Prompt Injection Is Not a Chatbot Problem: How the Attack Surface Changes When Your LLM Has Tools
An explainer arguing that chatbot-era prompt injection defenses (input filtering, output monitoring, instruction hierarchy, adversarial training) fail against agentic systems because injection enters through tools, retrieved documents, memory, API responses, and inter-agent instructions rather than the user message. It frames the issue as a system-architecture and trust-boundary problem rather than a model-tuning one. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector