First reported ssrn.com
Research · latest
First reported akamai.com
Top 5 Enterprise AI Risks 2026 Research
Akamai's State of the Internet: Enterprise AI Usage Risk Report 2026 (drawing on LayerX telemetry) finds that the top 5% of enterprise AI power users interact with AI models at 12 times the rate of the bottom 50%, hardcoding unvetted AI tools into critical operations. The report enumerates the top five enterprise AI risks, including shadow AI from personal accounts, data leakage, unnoticed browser/IDE extensions, and AI agents operating outside guardrails, citing named attack techniques such as CursorJacking and CometJacking. Details →First reported · updated · 2 reports calcalistech.com
Israeli researchers uncover zero-click attacks targeting AI browsers | Ctech
Israeli researchers demonstrated zero-click attacks against AI-powered browsers, reportedly hijacking agentic assistants like Anthropic's Claude and OpenAI's ChatGPT Atlas via malicious content embedded in emails and X posts. The attacks use indirect prompt injection that executes without any user interaction once the AI browser processes the poisoned content. Details →First reported medium.com
Black Hat 2026: A Browser Bug Alone Is Harmless. Hand It to an AI Agent, and It Isn’t.
A Medium write-up covers research presented by Gareth Heyes at Black Hat USA 2026 showing that previously low-severity browser bugs — dismissed because they required improbable, precise user interaction — become dangerous account-takeover chains when an AI browsing agent, rather than a human, is the one interacting with the page. The proof-of-concept work covers multiple real chains, several already reported to and partially fixed by affected companies. Details →First reported infosecwriteups.com
Black Hat 2026: A Browser Bug Alone Is Harmless. Hand It to an AI Agent, and It Isn’t. | by Raj Namdev | Aug, 2026 | Medium
Coverage of research by Gareth Heyes presented at Black Hat USA 2026 demonstrating that previously low-severity browser bugs—often left unpatched because they required implausible user interaction—become account-takeover chains when an AI browsing agent, rather than a human, is the entity interacting with a page. The proof-of-concept work covers multiple real chains, several already reported to and partially fixed by the affected companies. Details →First reported scworld.com
Agentic anarchy: Why using AI browsers just isn't worth the risk | news | SC Media
At Black Hat 2026, Zenity researchers Michael Bargury and Stav Cohen demonstrated prompt-injection ('persuasion') attacks against AI browsers including Perplexity Comet, Microsoft Edge with Copilot, Chrome with Gemini, the Anthropic Claude extension, and OpenAI's Atlas. Injections embedded in calendar invites, emails, and social posts led agents to take over a PC in seconds, steal 1Password credentials and recovery keys, send phishing email, exfiltrate files, delete AWS instances, and expose private GitHub repos; Perplexity has since fixed the local-file flaw. Details →First reported arxiv.org
Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-World Web Agents
StakeBench is a stakeholder-centric benchmark for evaluating prompt-injection risk in LLM-based web agents used for online shopping, decomposing risk into 12 attack objectives across User, Seller, and Platform stakeholder classes via 22 templates and 264 executable adversarial cases. Evaluating four deployable agent-backbone configurations across 3,168 attacked runs, the authors find no attack objective is reliably resisted, with outcomes spanning robust behavior, stealthy parasitism, misaligned disruption, and compounded failure. Details →First reported techxplore.com
Some agentic AI browsers may come with major cybersecurity risks
University of Washington researchers studied seven agentic AI browsers and found four allow attackers to bypass the same-origin policy, running a successful proof-of-concept attack against ChatGPT Atlas in which a malicious embedding website used prompt injection and the agent's cross-origin access to steal data from another embedded site. Similar attack conditions were identified in Chrome with Gemini, Claude for Chrome, and Perplexity Comet. Details →First reported darkreading.com
Agentic Browsers Rewind Web Security by 20 years
Zenity researchers, led by CTO Michael Bargury, disclosed a new class of vulnerabilities dubbed 'PleaseFix' affecting agentic browsers, to be presented at Black Hat. The flaws exploit how agentic browsers strip out cross-origin security mechanisms to let agents reach across web domains, enabling attacks ranging from account takeover to full browser escape and remote compromise of the underlying system. Details →First reported checkpoint.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point Research
Check Point Research (Alexey Bukhteyev) describes how DeepSeek turned an unrealistic AI-generated browser-malware hallucination into a plausible browser-native ransomware technique that abuses Chrome's File System Access API. The demonstrated PoC uses a fake AI image-enhancement workflow to socially engineer users into granting folder-level access to photo directories on Android, requiring no native payload, APK install, browser exploit, or root. Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported arxiv.org
MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks
MUZZLE is an automated agentic red-teaming framework, presented in a USENIX Security 2026 paper by researchers from Northeastern University and Mozilla, for evaluating the security of LLM-based web agents against indirect prompt injection attacks embedded in untrusted web content. Muzzle uses agent trajectories to identify high-salience injection surfaces and adaptively generates context-aware malicious instructions, discovering 44 new attacks across 4 web applications, including 3 cross-application prompt injection attacks and an agent-tailored phishing scenario. Details →First reported arxiv.org
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Prismata is a research defense for autonomous web agents that confines cross-site prompt injection by enforcing contextual least privilege, using dynamic trust derivation to produce permission labels for page content and mechanical confinement to redact content and restrict agent capabilities. The authors report it substantially reduces attack success across recent published web-agent attacks, including adaptive variants, while preserving benign task utility and requiring no developer annotations. Details →First reported embracethered.com
Computer-Use and TOCTOU: What You Click Is Not What You Get!
The author reproduces a previously disclosed TOCTOU race-condition vulnerability against ChatGPT Operator, a computer-use AI agent, demonstrating that what the agent clicks is not what the user expects. A video demo of the attack was presented at the Real-world AI security conference. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector