First reported youtube.com
Analysis · latest
First reported firetail.ai
LLM08: Vector & Embedding Weaknesses - FireTail blog posts
FireTail's blog explains OWASP LLM08: Vector and Embedding Weaknesses, covering risks such as unauthorized access, cross-context information leaks, embedding inversion attacks, data poisoning, and behavior alteration in RAG systems that use vector databases. The post lists mitigation techniques including access control, data validation, source authentication, and monitoring. Details →First reported · updated · 2 reports medium.com
RAG Security Guide: Prevent Enterprise AI Data Leakage
A vendor guide from LangProtect explains how Retrieval-Augmented Generation (RAG) systems can leak sensitive enterprise data, using an illustrative case of a healthcare AI assistant that returned document excerpts across business units because a shared vector index was queried before document permissions were evaluated. The article outlines the mechanism of RAG data leakage and references academic work on adaptively attacking RAG systems to exfiltrate private knowledge bases. Details →First reported · updated · 2 reports medium.com
Prompt Injection: The XSS of LLMs | Tomasus
Tomasus publishes an explainer framing prompt injection as "the XSS of LLMs," arguing that because a model reads instructions and data as one continuous token stream, the system/user prompt boundary is only a convention and later persuasive text can override the developer's rules. The piece walks through direct injection (override, role-play framing, payload smuggling) and indirect injection via retrieved content such as web pages, PDFs, and emails, referencing the OWASP LLM Top 10 and the Greshake et al. indirect prompt injection research. Details →First reported · updated · 2 reports kodemsecurity.com
LLM Security Testing: OWASP Top 10 Guide 2026
Openlayer's guide summarizes the 2025 OWASP Top 10 for LLM applications, explaining why LLM systems need dedicated security testing and detailing risk categories such as prompt injection, excessive agency, system prompt leakage, poisoned vector stores, unbounded consumption, and vector/embedding weaknesses. It argues that static code analysis and CVE scanning miss inference-time attacks and that agentic systems require session-level testing, while mapping OWASP results to EU AI Act obligations and promoting Openlayer's coverage. Details →First reported · updated · 15 reports everydayonai.com
What Is a Prompt Injection Attack? Types, Examples, and Defenses | AI EdgeLabs
An educational reference explainer, "What Is a Prompt Injection Attack? Types, Examples, and Defenses," catalogs prompt injection technique classes—including direct, indirect, and multimodal (hidden image/document) injection—and maps them to OWASP LLM01:2025, NIST AI 600-1, and mitigation guidance such as tool gating, source trust, and audit logs. The piece synthesizes existing research and known incidents (e.g., EchoLeak, the lethal trifecta) rather than presenting a specific new event or finding. Details →First reported petri.com
Copilot Didn’t Overshare Your Data. Your Permissions Did
Amy Babinchak argues that Microsoft 365 Copilot's tendency to surface confidential documents, emails, and SharePoint content is not a Copilot bug but a reflection of pre-existing permission sprawl — EEEU groups, broken inheritance, and unexpired sharing links — that plain-language prompts now make instantly discoverable. Citing Concentric AI research that 16% of business-critical data in the average tenant is overshared, the piece recommends restricting Copilot discovery from high-risk areas and using Purview and SharePoint Advanced Management to remediate. Details →First reported medium.com
Prompt Injection Is No Longer Just a Chatbot Problem
A Medium explainer titled "Prompt Injection Is No Longer Just a Chatbot Problem" argues that as AI applications gain the ability to search documents, retain memory, call APIs, and run autonomous agent workflows, prompt injection now extends beyond chatbots to poison retrieved knowledge, corrupt long-term memory, manipulate an agent's plan, or trigger unauthorized tool calls. The piece frames prompt injection as a core security challenge across prompts, RAG, tools, memory, and agents. Details →First reported sprinklenet.com
Prompt Injection Risk in Enterprise RAG Systems
Sprinklenet analysis explains how indirect prompt injection threatens enterprise RAG deployments, arriving not through the chat box but through poisoned corpus content — vendor PDFs with hidden white-on-white text, phishing-quoted support tickets, or crawled web pages — that competes with the system prompt once retrieval pulls it into context. The piece recommends architectural defenses: isolating retrieved content from instructions, allowlisting tool calls, tiering source trust, filtering outputs, running an injection evaluation suite, and logging prompts and completions. Details →First reported medium.com
Your AI Agent Will Leak Your Secrets One Letter at a Time | by Sebastian Buzdugan | Jul, 2026
An explainer by Sebastian Buzdugan describes how AI agents can be tricked into exfiltrating a user's private context-window data — names, employers, hometowns — one letter at a time via outbound URL requests, while the visible reply appears benign. The piece frames the risk around Simon Willison's 'lethal trifecta': an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Details →First reported netwrix.com
What is AI jailbreaking?
Netwrix's cybersecurity glossary entry defines AI jailbreaking as the practice of bypassing safeguards, restrictions, and safety controls built into AI models, and explains techniques including prompt injection, role-playing attacks, indirect prompt injection via external content, gradual context manipulation, and infrastructure-level tampering. Details →First reported crunchtools.com
The Prompt Injection That Copies Itself
Crunchtools publishes an explainer on prompt injection against AI agents, arguing that the quietest danger is self-replicating injection — citing the Morris II research worm (Cornell Tech and Technion, 2024) that embedded an adversarial prompt in an email, hijacked assistants across ChatGPT, Gemini, and LLaVA to leak data, and forwarded itself with no human clicks. The piece also references a Replit coding agent deleting a production database and the Pliny the Prompter jailbreak community, and mentions the author's defensive project 'Trentina' built to catch injection. Details →First reported lakera.ai
Memory poisoning in AI agents: are your controls keeping up?
An NHIMG editorial based on Lakera research discusses memory poisoning and long-horizon goal hijacks in AI agents, where attackers persistently alter what agents remember and optimize for, creating silent compromise paths that unfold across sessions. The piece offers governance guidance such as treating persistent memory as governed state, tracing provenance on memory items, and monitoring multi-step workflows for objective drift. Details →First reported agentsafelabs.com
Prompt Injection Is Not a Chatbot Problem: How the Attack Surface Changes When Your LLM Has Tools
An explainer arguing that chatbot-era prompt injection defenses (input filtering, output monitoring, instruction hierarchy, adversarial training) fail against agentic systems because injection enters through tools, retrieved documents, memory, API responses, and inter-agent instructions rather than the user message. It frames the issue as a system-architecture and trust-boundary problem rather than a model-tuning one. Details →First reported stackbuilders.com
Stack Builders - When Text Becomes Code: Securing LLM–Database Integrations
A technical guide based on a Quito Lambda talk demonstrating how prompt injection (direct, indirect, and confused-deputy/exfiltration) can compromise LLM applications that generate SQL over a live Postgres database, using an example LLM-powered SQL analyst with a Streamlit frontend. It walks through layered defenses and what they stop or fail to stop. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector