First reported darkreading.com
Research · latest
First reported youtube.com
Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data - Sachin Kumar, LexisNexis
Sachin Kumar (LexisNexis) presents peer-reviewed research (accepted at IJCNN, with open-source code) on detecting sleeper-agent backdoors in fine-tuned LLMs that pass behavioral evals yet flip to harmful output on an untested trigger. The proposed 'delta monitor' trains a sparse autoencoder on the difference between base and fine-tuned model activations, which in a controlled SQL-injection backdoor experiment flagged the backdoor with 40x the signal of crosscoder joint features, perfect precision, and zero false positives from a single layer. Details →First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported google.com
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
Researchers from Tel Aviv University, Technion, and Intuit disclosed 'HalluSquatting' (adversarial hallucination squatting), a technique that exploits the predictable tendency of LLMs to hallucinate resource identifiers (repos, skills, URLs) in tool calls. By preemptively registering the hallucinated resources, attackers can achieve scalable, untargeted remote tool execution and remote code execution across popular agentic LLM applications without any direct injection channel, potentially building agentic botnets. Details →First reported · updated · 2 reports arxiv.org
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
The paper 'Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions' systematically analyzes vulnerabilities in Model Context Protocol (MCP) servers, finding that taint-style vulnerabilities (e.g., SSRF as in the Markdownify server, CVE-2025-5276) make up a substantial fraction and are slow to be remediated. It proposes SpellSmith, which builds tool-level risk profiles and embeds behavioral guidance into MCP tool descriptions plus LLM self-reflection to mitigate exploitation without code-level fixes. Details →First reported promptarmor.com
Connecting AI agents to outside services explodes the risk radius
The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported semgrep.dev
Researcher poisons open-weight AI model for under $100
Researcher Katie Paxton-Fear of Manchester Metropolitan University and Semgrep demonstrated that she could install a reliable backdoor into an open-weight AI model in about an hour for under $100, using only ten fine-tuning examples to make the model emit remote-code-execution-vulnerable code even for novel prompts, with larger models being easier to poison. The Register also cites a related PoC by Origin's David Kaplan (originsec/lora-backdoor-poc) that creates a compromised model designed to exfiltrate data via a send_email tool call. Details →First reported · updated · 6 reports paloaltonetworks.com
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
Palo Alto Networks Unit 42 documents "Phantom Squatting," a software supply-chain technique in which attackers register web domains that large language models frequently hallucinate, so that when developers or agents follow LLM-suggested URLs they land on attacker-controlled infrastructure. The research extends the concept of slopsquatting from hallucinated package names to hallucinated domains and measures how LLM temperature and prompting produce consistent, registrable phantom domains. Details →First reported aclanthology.org
Data Exfiltration via Backdoored Tool Use
Researchers present Back-Reveal, a data exfiltration attack that embeds semantic triggers into fine-tuned tool-use LLM agents; when triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and covertly transmits it to an attacker-controlled server disguised as legitimate retrieval/search API requests. The paper shows multi-turn interaction amplifies leakage, as attacker-controlled retrieval responses steer subsequent agent behavior to induce cumulative disclosure, and evaluates defenses like NeMo Guardrails and LLM Guard as targets. Details →First reported arxiv.org
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
CareAttack is a model-centric attack framework that edits the parameters of open-source dense retrievers (Qwen3-Embedding-0.6B and BGE-M3) to promote malicious passages into the top-k retrieved evidence of RAG systems, bypassing detectable corpus-manipulation approaches. Evaluated on three benchmark datasets, it uses conflict-aware retriever editing and attack-preserving anchor repair to inject malicious knowledge for batches of target prompts while preserving behavior on non-target prompts; code is published. Details →First reported arxiv.org
Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability
The paper "Rethinking MCP Security" presents MCPZoo, the largest collection of runtime Model Context Protocol (MCP) servers for dynamic analysis (64,611 unique servers, 37,288+ supporting dynamic analysis), built via a multi-agent framework that transforms static repositories into runnable services. Using it, the authors conduct an ecosystem-scale measurement showing that while existing MCP security scanners flag 96.89% of servers as risky, manual validation finds under 50% of sampled alerts are true positives, with inconsistent outputs across scanners. Details →First reported arxiv.org
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported · updated · 2 reports canopii.dev
State of MCP Security 2026 v2
Canopii's "State of MCP Security 2026" report scanned more than 11,000 published Model Context Protocol servers and found 830 graded D or F, 232 with confirmed dangerous code sinks (eval, shell injection, unsafe deserialization) that can turn prompt injection into host code execution, 184 versions that silently altered tool definitions after publication ("rug pulls"), 1,617 servers shipping dependencies with known vulnerabilities, 260 running install-time scripts, and 7 confirmed typosquats. Popular servers with 1,000+ GitHub stars were over 5x more likely to be high-risk. Details →First reported mcpexplorer.com
We Ran a Live Handshake Against 995 MCP Servers. Only 39 Are Verified.
MCPExplorer ran a live MCP `tools/list` handshake against all 995 servers in its index on July 4, 2026; only 277 answered and just 39 met their verification bar. The scan found 59% of reachable servers expose at least one write tool, 67 expose destructive tools (e.g. `delete_instance`, `revoke_api_key`, `wipeLogs`), 467 have unknown provenance, and 30 different servers expose an identically-named `search` tool creating tool-name collision risks for agents. Details →First reported air.security
The Story of Skills - How We Hijacked 26,000 Agents With One Instagram Ad
Security firm AIR demonstrated that a malicious AI agent 'skill' (brand-landingpage) could pass current skill security scanners and reach over 26,000 users via an open-source agents repository and Instagram ads. The skill directed agents to install a fake Stitch SDK from an attacker-controlled domain (stitch-design.ai) that redirected to the real Google Stitch site, evading static SKILL.md analysis and later allowing payload changes. Details →First reported anthropic.com
Disclosed CVEs: 3.5× Spike After Claude Mythos | Epoch AI
Epoch AI reports a more-than-3.5x spike in high- and critical-severity CVE disclosures (around 1,500 in June 2026) from 21 major organizations, correlated with Anthropic's April 2026 announcement that Claude Mythos Preview can autonomously discover and exploit software vulnerabilities. Anthropic's Project Glasswing and OpenAI's Daybreak have used frontier models to find and fix bugs, with Glasswing claiming over 10,000 high/critical vulnerabilities identified. Details →First reported openaca.dev
Your Agent Risk Isn't in One Plugin. It's in the Composition.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure. Details →First reported thehackernews.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents
Security firm AIR built a fake AI agent skill and distributed it via a popular skill marketplace and an Instagram ad, reportedly reaching roughly 26,000 agents including some on corporate accounts. Every skill security scanner tested marked it safe, though the payload was harmless by design and only collected the user's email address. Details →First reported snyk.io
What nearly 10,000 developer environments reveal about agentic development risk
Snyk analyzed nearly 10,000 developer environments to examine risks introduced by AI coding agents as a new layer in the software supply chain, highlighting issues around tools, instructions, and permissions in agentic development. Details →First reported trymastro.com
Is security a skill issue? Five scanners, 3,084 skills, a different verdict 64% of the time · Mastro
A Mastro study analyzed 3,084 agent skills across five security scanners and found they disagree on a verdict 63.9% of the time, with 14.2% rated CRITICAL by one scanner and SAFE by another. The piece frames the broader supply-chain risk of AI agent skills—markdown files agents execute with full tool access—citing reported incidents where malicious skills lifted SSH keys, cloud credentials, and crypto wallets, and a fake download counter pushed a dummy skill to #1. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector