Research · latest

More filters

(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents

Researchers from Simon Fraser University, CUHK, Shandong University, and QAX's Xingtu Lab published an arXiv paper (arXiv:2607.00333) demonstrating seven concrete attacks against five open-source mobile AI agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA). A malicious Android app without privileged permissions can slip invisible on-screen text that the VLM-driven agent reads and acts on, exploiting a 'Screen Perception' surface (human-vs-machine vision gap) and a 'Misused Channel' surface to hijack agent actions and even achieve arbitrary command execution on the host PC driving the agent. All five frameworks fell to at least six of the seven attacks; no CVE was assigned and authors report no evidence of in-the-wild use. Details →

Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses

Researchers at Penn State introduce FARMA (Forged Amplifying Rationale Memory Attack), which poisons an LLM agent's remembered reasoning history rather than its factual knowledge, inserting forged reasoning traces with evasive language that bypass keyword filters and self-referential reinforcement that defeats consensus-based defenses like A-MemGuard, achieving up to 100% attack success. They also present SENTINEL, a layered defense pipeline whose Reasoning Guard structurally analyzes entries using five weighted signals, reducing FARMA's success rate to as low as 0% with no false positives across 326 benign traces. Details →

Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents

Alan Turing Institute researchers Abhishek Kumar and Carsten Maple demonstrated a "workflow-level jailbreak construction" against GitHub Copilot in VS Code, showing that harmful requests refused in direct chat succeed when decomposed across ordinary multi-turn IDE coding tasks. Across 204 prompts from Hammurabi's Code, HarmBench, and AdvBench, four closed-weight backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) refused in 808/816 direct tries but produced unsafe outputs in all 816/816 runs when the harmful objective was embedded as an input to a coding workflow. Details →

Connecting AI agents to outside services explodes the risk radius

The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →

Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime). Details →

Agent Data Injection Attacks are Realistic Threats to AI Agents

A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →

Prompt Injection as Role Confusion

The paper "Prompt Injection as Role Confusion" (arXiv:2603.12277, ICML 2026) by Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell traces prompt injection to role confusion: LLMs perceive the source of text from how it sounds rather than its labeled role, so injected text occupies the same representational space as the trusted role it imitates. The authors introduce role probes to measure internal role perception and demonstrate CoT Forgery, a zero-shot attack injecting fabricated reasoning into user prompts and tool outputs that yields 60% attack success against frontier models with near-zero baselines. Details →

Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices

A research paper, "Devil in the Lens," characterizes physical prompt injection attacks against Vision-Language Models on wearable devices such as AI glasses, where malicious text embedded in real-world environments acts as an indirect prompt-injection channel that hijacks model behavior. Using photos captured from AI glasses across 200+ environments, the authors identify 6 threat vectors, evaluate 12 VLMs (achieving attack success rates up to 96% simulated and 60% real-world), and propose two defenses: a mask-based external filter and a semantic-vector-based internal detector. Details →

Confused Deputy Attack Against Model Context Protocol | ACM Transactions on Software Engineering and Methodology

An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →

Solving GitHub’s Secure Code game with an AI red teaming agent

Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust. Details →

DualView: Preventing Indirect Prompt Injection in Personal AI Agents

DualView is a defense presented in an arXiv paper that extends untrusted-data tracking from a personal AI agent's context out into the user's environment (file system, shell, network, and other agents) to block indirect prompt injection, including a newly-highlighted 'stored IPI' variant where an agent saves attacker-controlled data and later rereads it as trusted. Deployed as an OpenClaw plugin using only tool hooks, DualView gives each channel an AgentView (untrusted data shown as symbols) and a HumanView (original data), and reportedly blocked every IPI attack on an IPI benchmark and PinchBench while preserving utility. Details →

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

MUZZLE is an automated agentic red-teaming framework, presented in a USENIX Security 2026 paper by researchers from Northeastern University and Mozilla, for evaluating the security of LLM-based web agents against indirect prompt injection attacks embedded in untrusted web content. Muzzle uses agent trajectories to identify high-salience injection surfaces and adaptively generates context-aware malicious instructions, discovering 44 new attacks across 4 web applications, including 3 cross-application prompt injection attacks and an agent-tailored phishing scenario. Details →

The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →

DualView: Preventing Indirect Prompt Injection in Personal AI Agents

DualView is a research system from CompSec Lab @ SNU (arXiv:2607.03821) that defends personal AI agents like OpenClaw against indirect prompt injection, including a variant called 'stored IPI' where attacker-controlled text persists in the user's file system, shell, or network and is re-read later as trusted data. DualView extends untrusted-data tracking from the agent context into the user's environment by maintaining two views (AgentView shows untrusted data as symbols; HumanView preserves originals) and deploys as an OpenClaw plugin using tool hooks; in evaluation on an IPI benchmark and PinchBench it blocked every IPI attack while keeping utility near the unprotected baseline. Details →
See the API docs to pull all 342 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

  • GET /api/items?tags=&minSeverity=&itemType=
  • GET /api/search?q= — keyword
  • GET /api/semantic?q= — vector
Preview semantic search