First reported · updated · 2 reports arxiv.org
Research · latest
First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported promptarmor.com
Connecting AI agents to outside services explodes the risk radius
The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol | ACM Transactions on Software Engineering and Methodology
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust. Details →First reported arxiv.org
Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability
The paper "Rethinking MCP Security" presents MCPZoo, the largest collection of runtime Model Context Protocol (MCP) servers for dynamic analysis (64,611 unique servers, 37,288+ supporting dynamic analysis), built via a multi-agent framework that transforms static repositories into runnable services. Using it, the authors conduct an ecosystem-scale measurement showing that while existing MCP security scanners flag 96.89% of servers as risky, manual validation finds under 50% of sampled alerts are true positives, with inconsistent outputs across scanners. Details →First reported arxiv.org
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported aminrj.com
Deleting the Malicious MCP Server Doesn't Save You | Amine Raji, PhD
A lab-built demonstration (mcp-attack-labs, Lab 08) chains MCP tool-description poisoning into an Agent-to-Agent (A2A) intrusion: a poisoned tool instructs the compromised agent to register a rogue A2A agent, hijack routing via shadowing, exfiltrate data, and persist even after the malicious MCP server is deleted. Each stage maps to a named vulnerability class (OWASP MCP Top 10 MCP03, ASI10, ASI07) and is paired with a detection that fires on it. Details →First reported · updated · 2 reports canopii.dev
State of MCP Security 2026 v2
Canopii's "State of MCP Security 2026" report scanned more than 11,000 published Model Context Protocol servers and found 830 graded D or F, 232 with confirmed dangerous code sinks (eval, shell injection, unsafe deserialization) that can turn prompt injection into host code execution, 184 versions that silently altered tool definitions after publication ("rug pulls"), 1,617 servers shipping dependencies with known vulnerabilities, 260 running install-time scripts, and 7 confirmed typosquats. Popular servers with 1,000+ GitHub stars were over 5x more likely to be high-risk. Details →First reported mcpexplorer.com
We Ran a Live Handshake Against 995 MCP Servers. Only 39 Are Verified.
MCPExplorer ran a live MCP `tools/list` handshake against all 995 servers in its index on July 4, 2026; only 277 answered and just 39 met their verification bar. The scan found 59% of reachable servers expose at least one write tool, 67 expose destructive tools (e.g. `delete_instance`, `revoke_api_key`, `wipeLogs`), 467 have unknown provenance, and 30 different servers expose an identically-named `search` tool creating tool-name collision risks for agents. Details →First reported openaca.dev
Your Agent Risk Isn't in One Plugin. It's in the Composition.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure. Details →First reported snyk.io
What nearly 10,000 developer environments reveal about agentic development risk
Snyk analyzed nearly 10,000 developer environments to examine risks introduced by AI coding agents as a new layer in the software supply chain, highlighting issues around tools, instructions, and permissions in agentic development. Details →First reported lateos.ai
GPT-5 Nano IPI Assessment — LLM Vulnerability Research
A black-box prompt injection susceptibility assessment of GPT-5 Nano using the IPI Taxonomy v0.13 across 201 analyzed test cases, reporting a 38.3% overall susceptibility rate. The model was fully resistant to surface-level attacks (CSS concealment, HTML cloaking, SEO phishing, RAG corpus poisoning) but highly vulnerable to recursive instruction framing (100%) and MCP tool description poisoning (80%). Details →First reported trendmicro.com
Pwning Agentic AI Part I: Your AI Agent Is Already Compromised | Trend Micro (US)
Trend Micro's TrendAI Research describes a new agentic-AI exploitation pattern they call return-to-tool (RTT) exploits, where embedded instructions in benign-looking untrusted input cause an AI agent to invoke its authorized tools to perform attacker-intended actions such as exfiltrating production database credentials. The research notes a vulnerable PostgreSQL MCP server image pulled over 100,000 times from Docker Hub as a realistic exposure vector. Details →First reported originhq.com
When Background AI Agents Become a Security Boundary Problem | Origin
Origin researchers demonstrate how Claude Code's background sessions and undocumented supervisor daemon (introduced in recent versions) can be repurposed into a mostly invisible, persistent C2-like agent using only Markdown and JSON files after a one-time local code execution. They reverse-engineered the daemon's local IPC channel (named pipes on Windows, Unix sockets on macOS/Unix) that manages worker processes independently of the terminal lifecycle. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector