First reported arxiv.org
Research · latest
First reported · updated · 7 reports paloaltonetworks.com
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
Unit 42 researchers describe "Phantom Squatting," a software supply chain vector in which attackers register web domains that large language models and AI coding assistants hallucinate and recommend in generated code, so that developers who trust the AI output are steered toward attacker-controlled infrastructure. The research measures the phenomenon of AI-hallucinated domains (tagged Agentic AI, LLMs, and Malicious Domains) and frames it as an emerging supply chain risk. Details →First reported asset-group.github.io
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
ASSET Research Group's GhostSplice research shows a malicious MCP (Model Context Protocol) server can exfiltrate SSH keys, environment secrets, source code, and customer data from AI coding assistants by splitting a malicious request into individually benign fragments placed across tool descriptions, tool results, and server-initiated sampling. Because the agent combines instructions across these channels in a shared working context, no single fragment carries the whole malicious request, allowing the attack to succeed even after a blunt version of the same theft is refused. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector