First reported · updated · 3 reports openai.com
News · latest
First reported · updated · 2 reports thehackernews.com
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
Microsoft's Security Research team reports a high-volume phishing campaign using invisible Unicode tag characters — the same ASCII smuggling technique used for AI prompt injection — to split financial lure words like 'funding' and evade email filters. The attacks, first observed in early February 2026, show AI-era evasion techniques crossing over into traditional phishing and spam. Details →First reported google.com
AI Protection overview | Security Command Center | Google Cloud Documentation
Google Cloud's Security Command Center documentation describes AI Protection, a set of defensive services for securing AI workloads on Google Cloud, including AI Discovery, Model Armor (protection against prompt injection and jailbreak), Agent Platform Threat Detection, Agent Platform Vulnerability Assessment, Notebook Security Scanner, and Sensitive Data Protection. The page catalogs detection services, compliance frameworks, and Event Threat Detection rules for Gemini Enterprise Agent Platform assets. Details →First reported cisco.com
Secure Claude Enterprise with Cisco AI Defense - Cisco Blogs
Cisco describes an integration between Cisco AI Defense and Claude Enterprise that uses Anthropic's newly introduced inference hooks to inspect each governed prompt before inference, returning an allow/deny verdict to block prompt injection and jailbreak attempts. The piece also notes evaluation of agent conversation transcripts, including MCP tool calls and results, to catch poisoned content before the next inference. Details →First reported theregister.com
OpenAI ditches Recall-style screenshot surveillance for friendly keylogging
OpenAI's new opt-in 'Computer History' feature for the ChatGPT macOS desktop app captures user interaction events (clicks, typing, keyboard shortcuts, app switches) via macOS accessibility APIs, turning them into text summaries and local memory files to build ChatGPT memories. The Register notes the files are stored unencrypted locally for up to 48 hours, are accessible to other programs running as the same user, and increase the user's exposure to prompt injection. Details →First reported openagent.in
MCP support: OpenAgent as an MCP client
OpenAgent, a commercial AI support platform, describes its MCP client implementation and the security controls it wraps around the raw Model Context Protocol: per-tool admin approval, 'rug-pull' defense that re-flags tools when a server silently changes tool descriptions or input schemas, AES-256-GCM encrypted credentials, a PII-redacted audit log, and an untrusted-output marker that prefixes tool results with a warning to the LLM not to follow embedded instructions. Details →First reported theregister.com
Claude Code puts auto mode in the driver's seat
Anthropic is making auto mode the default in Claude Code from August 14, letting the agent execute file writes and bash commands without manual approval, relying on a classifier to block actions that are irreversible, destructive, or aimed outside the environment. Anthropic says it ran internal and third-party red-teaming plus prompt-injection evaluations, reporting auto mode stopped all 720 attack attempts tested and blocked 89 percent of deliberately inserted dangerous commands versus 13.6 percent caught by human testers. Details →First reported · updated · 2 reports simonwillison.net
Opus 5 may have solved browser-based prompt injection, the biggest security flaw haunting AI agents
Anthropic's Claude Opus 5 system card, highlighted by Boris Cherny and Simon Willison, claims the model is its least prompt-injectable yet, reporting the largest gains in prompt injection robustness across coding, computer use, and browser use in its agentic safety evaluations. The-decoder frames this as potentially addressing browser-based prompt injection, a major security weakness in AI agents. Details →First reported thenewstack.io
OpenAI's GPT-Red automates prompt injection testing to harden AI agents
The New Stack reports on OpenAI's GPT-Red, described as a tool that automates prompt injection testing to help harden AI agents. The provided article body contains only cookie-consent boilerplate, so no technical mechanism, evaluation details, or runnable artifact description is available beyond the headline framing. Details →First reported openai.com
Continuously hardening ChatGPT Atlas against prompt injection attacks
OpenAI describes how it hardens ChatGPT Atlas's browser agent-mode against prompt injection, using reinforcement-learning-powered automated red teaming to discover novel attack strategies internally before they appear in the wild. The post details a recent security update that shipped a newly adversarially trained model and strengthened safeguards after internal red teaming uncovered a new class of prompt-injection attacks, and outlines a rapid response loop for continuously finding and patching agent exploits. Details →First reported microsoft.com
Defending the Inbox Against Prompt Injection Attacks
Microsoft announced a new Microsoft Defender for Office 365 capability that detects and quarantines malicious AI instructions (prompt injection) embedded in email before delivery, aiming to stop indirect prompt injection from reaching Copilot and Microsoft 365 agents. The post cites publicly disclosed research such as Morris II and EchoLeak as evidence that email is a high-volume ingress channel for AI-targeted attacks, describing techniques like white-on-white text, zero-width Unicode, and hidden HTML instructions. Details →First reported microsoft.com
Prompt injection protection in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn
Microsoft documentation describes prompt injection protection built into Microsoft Defender for Office 365, which detects attacker-authored instructions embedded in inbound email (body, subject, quoted replies, attachments, or hidden markup) before that content reaches a user or an AI assistant such as Microsoft 365 Copilot. The feature explains indirect prompt injection techniques including direct instructions to the model and hidden/invisible text (white-on-white fonts, zero-size text, HTML/CSS tricks) and detects them as part of existing mail-flow inspection. Details →First reported theregister.com
Infosec professionals sour on automated pentesting tools
A Register report on Cobalt's 2026 State of Pentesting survey (450 respondents) finds support for fully automated pentesting collapsing from 29% to 9%, largely because automated scanners miss AI-specific flaws like prompt injection and excessive agency that require creative, multi-turn adversarial testing. Cobalt also reports 32% of vulnerabilities in AI/LLM environments are high or critical severity, versus 12% in traditional environments. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector