First reported youtube.com
Analysis · latest
First reported medium.com
Security as Code: AI Agent Security — Poisoned Weights and the Supply Chain You Can’t Scan (Part 3 of 3) | by Vitaliy Zhhuta | Jul, 2026
Part 3 of a 'Security as Code' series by Vitaliy Zhhuta examines AI model supply-chain risk, using an illustrative scenario in which a deleted Hugging Face namespace is re-registered by an attacker and a poisoned 'v2.1' model with clean safetensors format passes CI while carrying a behavioral backdoor. The piece argues that statistical backdoors — weights trained to silently alter behavior on trigger phrases — cannot be detected by malware scanners and have no CVE. Details →First reported deepinspect.ai
MCP Server Supply Chain Security: The Install Path Nobody Reviews
A DeepInspect analysis lays out five review gates for securing the MCP server supply chain, arguing that adding a third-party MCP server grants code execution, credential access, and text injection with far less scrutiny than an npm dependency. It cites CSA/OX Security research finding 9 of 11 MCP marketplaces affected by a STDIO-interface design flaw, 40+ MCP CVEs in early 2026 (including CVE-2026-33032 in nginx-ui MCP and CVE-2026-0755 in gemini-mcp-tool, both CVSS 9.8), and details tool-description poisoning as indirect prompt injection (MITRE ATLAS AML.T0051.001). Details →First reported · updated · 2 reports kodemsecurity.com
LLM Security Testing: OWASP Top 10 Guide 2026
Openlayer's guide summarizes the 2025 OWASP Top 10 for LLM applications, explaining why LLM systems need dedicated security testing and detailing risk categories such as prompt injection, excessive agency, system prompt leakage, poisoned vector stores, unbounded consumption, and vector/embedding weaknesses. It argues that static code analysis and CVE scanning miss inference-time attacks and that agentic systems require session-level testing, while mapping OWASP results to EU AI Act obligations and promoting Openlayer's coverage. Details →First reported keycard.ai
The Agent Security Stack: Transport, Identity, Policy, Runtime
A Keycard explainer maps the "agent security stack" into distinct layers — transport (MCP/OAuth 2.1 authorization), identity, policy, and runtime guardrails that watch for prompt injection — arguing that agent security cannot be collapsed into a single control surface. The piece frames how multi-agent call chains multiply control surfaces (LLM tool invocation, transport, credential, authorization) and argues identity/authorization is the most under-served layer, citing recent CrowdStrike/SGNL and Palo Alto/CyberArk acquisitions. Details →First reported · updated · 25 reports ulad.net
Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service | Microsoft Community Hub
A Microsoft App Service blog reports that only 8.5% of Model Context Protocol (MCP) servers implement OAuth, leaving the vast majority without client authentication, and provides guidance on hosting an MCP server securely with OAuth on Azure App Service. The piece frames unauthenticated MCP servers as an exposed gateway for AI agents to sensitive data and offers hardening recommendations. Details →First reported medium.com
The Last Patch. The MCP Attack Surface We’re Building… | by Zac | Jul, 2026
An opinion piece by Zac on Medium argues that the rush to expose MCP endpoints and build agent-to-agent (A2A) orchestration is creating a large new attack surface, where every MCP endpoint is an agent-callable function and every A2A handoff is a traversable trust boundary. The article draws on Anthropic's report mapping 832 accounts banned for malicious cyber activity (March 2025–March 2026) against MITRE ATT&CK, noting medium-or-higher-risk actors rose from 33% to 56% and that AI is increasingly used deeper in the attack lifecycle. Details →First reported traefik.io
MCP Gateway Best Practices | Traefik Hub Documentation
Traefik Hub documentation outlines security best practices for deploying an MCP Gateway in production, covering On-Behalf-Of (OBO) token delegation per RFC 8693, Task-Based Access Control (TBAC) for AI agents, and a defense-in-depth 'Triple Gate' pattern. The guidance emphasizes least-privilege access so that a compromised MCP server does not grant an attacker access to all backend resources. Details →First reported embracethered.com
Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise
An embracethered.com analysis examines two reported autonomous-AI intrusions: a Hugging Face compromise that Hugging Face says was driven end-to-end by an autonomous AI agent (entering via a malicious dataset and code-execution paths in its processing pipeline, then harvesting cloud/cluster credentials and moving laterally across 17,000+ recorded actions), and Sysdig's JADEPUFFER agent-driven ransomware that autonomously enumerated services, exploited Nacos auth bypass (CVE-2021-29441), forged JWTs, and self-corrected failed payloads to insert a backdoor admin. The write-up highlights a defensive asymmetry in which commercial-model safety guardrails blocked Hugging Face's own forensic analysis, forcing a pivot to a locally hosted open-weight model, and criticizes the lack of shared IOCs. Details →First reported · updated · 3 reports medium.com
Your AI Agent Trusts Every Tool It's Ever Been Introduced To
An analysis piece, 'The MCP paradox,' argues that the Model Context Protocol standardized not only how agents reach tools but also how attackers reach agents, walking through concrete vectors like tool poisoning attacks where a malicious tool description instructs an agent to exfiltrate secrets (e.g. SSH keys) via text the user never sees. The article cites Invariant Labs' April 2025 tool-poisoning proof of concept and MCP's own design choices, and proposes defensive controls to harden MCP servers. Details →First reported sprinklenet.com
Prompt Injection Risk in Enterprise RAG Systems
Sprinklenet analysis explains how indirect prompt injection threatens enterprise RAG deployments, arriving not through the chat box but through poisoned corpus content — vendor PDFs with hidden white-on-white text, phishing-quoted support tickets, or crawled web pages — that competes with the system prompt once retrieval pulls it into context. The piece recommends architectural defenses: isolating retrieved content from instructions, allowlisting tool calls, tiering source trust, filtering outputs, running an injection evaluation suite, and logging prompts and completions. Details →First reported · updated · 4 reports reversinglabs.com
MCP Supply Chain Attacks: Why Better Models Make It Worse
A dope.security blog post argues that the Model Context Protocol (MCP) has become a new shadow-IT and supply-chain risk because MCP servers create outbound HTTPS connections that read files, hit APIs, and move data on an agent's behalf while looking indistinguishable from ordinary encrypted traffic. It contends DNS filters and cloud proxies cannot see the URL paths, payloads, or tool calls inside MCP sessions, and promotes the vendor's device-level SWG and DLP as a means to name, allow, or block MCP servers at egress. Details →First reported clawsecure.ai
AI Agent Security: The Complete 2026 Guide
ClawSecure's blog post is a 2026 explainer guide on AI agent security, describing why autonomous agents break traditional security (broad access, autonomy, and treating data as instructions) and cataloging risks like prompt injection, tool poisoning, credential theft, and data exfiltration mapped to the OWASP Top 10 for Agentic Applications. It cites ClawSecure's finding that 41% of popular OpenClaw skills carry security vulnerabilities and promotes the company's runtime monitoring and integrity-layer product. Details →First reported · updated · 5 reports venturebeat.com
Forget typosquatting; slopsquatting is the software supply chain threat created by AI coding tools | VentureBeat
VentureBeat explains slopsquatting, an emerging software supply-chain threat in which attackers exploit LLM coding assistants' tendency to hallucinate plausible-sounding but nonexistent package names, then register those names and populate them with malicious code that gets pulled into developer codebases. The piece notes that traditional registry protections against typosquatting do not catch these fabricated names, and cites research showing high hallucination rates and rising OSS vulnerability trends, including work on adversarial hallucination squatting used to build agentic botnets. Details →First reported aicerts.ai
Undetectable AI Model Backdoors Imperil Neural Security
AI CERTs News synthesizes cryptography research on undetectable AI model backdoors, citing Goldwasser et al. (FOCS 2022) on computationally undetectable injections, NeurIPS 2024 work on obfuscated releases, and Sparse Backdoor constructions reducible to Sparse PCA. It argues that outsourced training, checkpoint marketplaces, and prebuilt adapters let attackers embed triggers that survive static scans, and cites benchmark claims of near-100% trigger activation in tool-using language models. Details →First reported forbes.com
Hidden LLM Backdoors Could Detonate At Massive Scale
A Forbes analysis warns about 'sleeper agent' LLM backdoors — models trained to stay dormant until a trigger phrase causes malicious behavior such as exfiltrating credentials and API keys. The piece references Anthropic's January 2024 proof-of-concept paper 'Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training' and argues that AI-security defensive funding lags far behind enterprise model deployment. Details →First reported morphisec.com
Prompt Injection, Model Poisoning, and AI Supply Chain Attacks Explained
A Morphisec blog post titled "Prompt Injection, Model Poisoning, and AI Supply Chain Attacks Explained" presents an educational overview of major AI/LLM security threat categories. The provided page content is largely site navigation boilerplate, with the substantive material framed as an explainer of these attack classes. Details →First reported anaconda.com
AI Model Security Best Practices
Anaconda's blog post is an explainer on AI model security best practices, outlining how models introduce a distinct attack surface across training data, runtime inputs, algorithms, and toolchains. It enumerates common threats including prompt injection (citing the 2025 EchoLeak Microsoft 365 Copilot data-exfiltration vulnerability), model extraction and inversion, and open-source supply-chain risks, framed against the NIST AI Risk Management Framework. Details →First reported worldinsight.com
AI Coding Assistants Leak Internal Secrets and Fake Bug Reports Waste Developers’ Time — Calculating the Invoice for ‘AI Security Debt’ in Small and Medium Enterprises
WORLD INSIGHT analysis discusses how AI coding assistants such as GitHub Copilot, Cursor, and Cline can leak internal secrets—API keys, authentication tokens, and internal endpoints—when malicious prompt-injection files planted in a repository cause the assistant to exfiltrate confidential context to external servers. The piece also flags a surge of AI-generated fake security vulnerability reports flooding open-source Node.js projects and frames these costs as accumulating 'AI security debt' for small and medium enterprises. Details →First reported medium.com
Why Your MCP Server Fails Its First Security Review: 14 Gaps and a Scorecard (TypeScript Edition) | by Rick Hightower | Jun, 2026 | Spillwave Solutions
Rick Hightower's article presents a TypeScript-focused security-review checklist for Model Context Protocol (MCP) servers, enumerating 14 production gaps including shared API keys, missing audit logs, prompt-only guardrails, prompt injection through tool results, weak tenant isolation, non-idempotent mutations, schema drift, unmanaged secrets, and missing DLP, plus a maturity scorecard. It offers code patterns to close the most dangerous gaps and hardening guidance for moving MCP servers from demo to production. Details →First reported · updated · 2 reports cloudsecurityalliance.org
MCP Security in the Cloud: Where the Real Risks Begin
A Darktrace/CSA analysis (drawing on the arXiv paper 'Securing the Model Context Protocol (MCP): Risks, Controls, and Governance') outlines seven MCP security risks CISOs should prepare for, including content-injection/prompt-injection attacks, over-privileged agents, tool poisoning, supply-chain compromise via malicious MCP servers, and data exfiltration. It notes MCP handles only connection mechanics without built-in identity or access controls, amplifying the 'lethal trifecta' of sensitive-data access, untrusted content exposure, and external communication. Details →First reported · updated · 2 reports darkreading.com
AI Coding: Do Security Risks Outweigh Productivity Gains?
A Dark Reading analysis weighs the security risks of AI coding tools against their productivity gains, citing surveys showing near-universal enterprise adoption and research finding AI-generated code carries more high-risk vulnerabilities, hardcoded secrets, and hidden costs from scanning, remediation, and false positives. It references large-scale studies (e.g., arXiv analyses of GitHub repositories and human-vs-AI code) plus issues like slopsquatting and trust-boundary gaps in AI coding assistants. Details →First reported howtoharden.com
Cursor Hardening Guide
The Cursor Hardening Guide from howtoharden.com compiles defensive controls for the Cursor AI code editor, covering AI privacy settings, MCP server security, agent sandboxing, API key management, rules-file integrity, and extension supply-chain risk. It draws on 2025-2026 CVE analysis (including CurXecute RCE via MCP prompt injection CVE-2025-54135, MCPoison persistent compromise CVE-2025-54136, and sandbox/file-overwrite bugs) and ships runnable config packs mapped to OWASP LLM/Agentic Top 10, NIST AI RMF, and MITRE ATLAS. Details →First reported powerdmarc.com
Malicious MCP Servers & Email Security: The New Supply Chain Threat
The article analyzes the postmark-mcp incident, where a malicious actor published an exact-name lookalike npm package impersonating Postmark's official Model Context Protocol (MCP) server. Across 15 clean releases it built trust before adding a hidden BCC rule that silently forwarded 3,000-15,000 corporate emails per day to an attacker-controlled domain, leaking passwords, invoices, customer data, and auth tokens; because mail flowed through legitimate infrastructure, SPF and DKIM passed automatically. Details →First reported detect.fyi
Detection Engineering in the Era of Semantic Malware | by Koifsec | Jul, 2026
A detection-engineering analysis examines "semantic malware" / "promptware" — malware delivered through prompt injection rather than binaries — using Origin's Brainworm PoC (a poisoned CLAUDE.md file that hijacks AI coding assistants into registering with a C2 server over RabbitMQ) and the Ben-Gurion/Tel Aviv/Harvard/Toronto "Promptware Kill Chain" arXiv paper as anchors. The kill chain formalizes seven stages (initial access via prompt injection, jailbreaking, reconnaissance, memory/retrieval poisoning, command-and-control, lateral movement, actions on objective) across 36 documented incidents, and the piece discusses how defenders can detect such trust-boundary failures. Details →First reported bleepingcomputer.com
The Replicant in Your Directory: AI Agents and the Identity Security Gap
A sponsored analysis piece by Netwrix CEO Grady Summers argues that AI agents, service accounts, OAuth apps, and other non-human identities now vastly outnumber human users and fall outside identity governance built for people. It cites the 2025 UNC6395 campaign, in which an OAuth token tied to Salesloft's Drift integration was abused to pivot across hundreds of Salesforce environments and reach AWS/Snowflake credentials, as an example of how a single trusted machine identity can cascade—an issue AI agents accelerate by creating and inheriting identities at machine speed. Details →First reported thehackernews.com
What Changes When Your Software Supply Chain Includes AI Writing Your Code?
An analysis/webinar-tied piece from The Hacker News arguing that AI-assisted coding and agentic tooling (via MCP, autonomous package-pulling agents, and prompts as build inputs) have expanded the software supply chain attack surface beyond traditional dependency risk. It references prior incidents (SolarWinds, Log4Shell, XZ Utils, and the self-propagating Shai-Hulud package campaign) to frame why knowing what's in your code is no longer sufficient. Details →First reported ncsc.gov.uk
The 'vibe coding spectrum' approach to AI-assisted software development
An NCSC blog frames 'vibe coding' — giving AI agents high-level prompts to autonomously build software — as a spectrum requiring calibrated oversight based on the code's risk profile. It cites research (arXiv:2510.26103 and an IOActive report) showing AI-generated code can contain security vulnerabilities, arguing high-stakes code like authentication or CNI systems needs deeper review than low-risk prototypes. Details →First reported snyk.io
The New Security Risks of the Agentic Development Lifecycle
An article discussing how AI agents are reshaping the software development lifecycle and shifting where security risk originates, arguing that securing the development process matters as much as securing code. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector