First reported daily.dev
Research · latest
First reported arxiv.org
From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications
A research paper by Spiros Tsigkopoulos and Christoforos Ntantogian introduces "LLM-mediated web attacks," a class where attacker-controlled input is transformed by an LLM-integrated application and then reaches traditional web-app sinks, systematized as LLM2X variants (LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2CSRF, LLM2XXE, LLM2SSRF). The authors implement TicketOracle, a Flask-based LLM-integrated app, to evaluate LLM2SSRF across five scenarios and seven LLMs, finding substantial model-specific variation in susceptibility. Details →First reported · updated · 2 reports arxiv.org
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime). Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector