First reported youtube.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 3 reports sonarsource.com
Arbitrary code execution and Claude Code CLI: How Claude executed code before you click 'trust' | Sonar
Researchers disclosed that AI coding agents including Anthropic's Claude Code, OpenAI Codex, Cursor, and goose can be tricked into executing attacker code via malicious Git configuration in an untrusted repository. Setting core.fsmonitor in a repo's .git/config causes the agent's git diff context-gathering to run arbitrary commands on the host before any trust prompt, model call, or tool approval (CVE-2026-72718 for goose, fixed in 1.44.0; Claude Code fixed in v2.0.71). The commands run with the user's privileges, enabling secret and API-key exfiltration. Details →First reported wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
The s1ngularity attack compromised the widely used Nx build system (roughly six million weekly installs) via a shell-injection flaw in a pull_request_target GitHub Actions workflow, letting attackers steal an npm publishing token and push malicious npm releases. The postinstall payload weaponized locally installed AI CLI tools (Claude, Gemini, and Amazon Q), prompting them with dangerous flags like --dangerously-skip-permissions and --yolo to inventory and harvest secrets, then exfiltrated credentials to attacker-created public GitHub repos; over 400 users and 5,500 private repositories were exposed. Details →First reported paloaltonetworks.com
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
Unit 42's "State of AI-Enabled Malware August 2026" surveys how adversaries have moved from AI-assisted brand abuse toward agentic execution, alongside Symantec's observations of real phishing campaigns delivering LLM-generated PowerShell downloaders. The observed campaigns used malicious .lnk files in password-protected ZIPs to trigger LLM-authored scripts that deployed payloads such as Rhadamanthys, CleanUpLoader (Broomstick/Oyster), NetSupport, ModiLoader, LokiBot, and Dunihi. Details →First reported threatdown.com
Criminal AI tool Kriminal is mostly just Grok with a jailbreak, ThreatDown finds
ThreatDown analysis, reported by SiliconANGLE, found that the criminal AI tool marketed as 'Kriminal' is largely just xAI's Grok wrapped with a jailbreak that bypasses safety guardrails to produce illicit content. The tool is sold to cybercriminals as a purpose-built malicious LLM but relies on circumventing a commercial model's protections rather than being a bespoke system. Details →First reported towardsai.net
AI Agents are Now Recommending Their Own Malware
Security researchers at Island documented a campaign dubbed "AgentBaiting" involving roughly 7,600 malicious GitHub repositories — more than 800 disguised as AI skills or MCP servers — engineered to be discovered and recommended by AI coding agents. Instead of phishing a human, attackers plant repos that look legitimate so that an agent searching GitHub finds them, reads the README, and recommends installing the malware, effectively removing the human-in-the-loop from the supply-chain attack chain. Details →First reported sonicwall.com
AI Meets Ransomware : Open‑Weight AI Models Fueling Ransomware Evolution
SonicWall Capture Labs analyzed PromptLock, a ransomware sample that ships hardcoded natural-language prompts instead of precompiled routines, calling OpenAI's gpt-oss:20b model via an Ollama-compatible API to generate Lua scripts at runtime for file enumeration, target classification, SPECK-based encryption, and ransom-note creation. Because code is generated dynamically per infection, both static signatures and behavioral detection are undermined, pushing defenders toward monitoring LLM interaction patterns and Ollama network traffic. Details →First reported medium.com
$1,500 AI System Prompt Leak: Using this Burp Suite Configuration
A bug bounty write-up by tinopreter describes leaking an AI application's system prompt at a company that rolled out AI across its assets, earning a $1,500 payout, and attributes the discovery to a particular Burp Suite proxy configuration that surfaced the prompt in intercepted traffic. Specific details, endpoints, and screenshots were altered for confidentiality. Details →First reported · updated · 2 reports nhimg.org
Agentjacking exposes a broken trust model in AI coding agents
"Agentjacking," documented by Swarmnetics and Tenet Security, abuses the trust AI coding agents place in external error-report telemetry: an attacker who obtains a publicly exposed Sentry DSN can inject malicious instructions into error reports that the agent treats as actionable, enabling theft of cloud keys, Git credentials, and private repo URLs. The core flaw is that systems built to process trusted telemetry conflate source trust with action trust in MCP-connected agent workflows. Details →First reported nhimg.org
Copilot vulnerability turns AI assistance into a data theft force
A Copilot Enterprise vulnerability chain, detailed by Swarmnetics and Varonis Threat Labs, showed how prompt injection combined with browser handling quirks and whitelisted endpoints can let an attacker move from a link click to rapid theft of emails, files, and meeting data across a Microsoft environment. The core issue is a broken trust boundary between a query, a link, and the content the assistant is allowed to surface, letting attacker-shaped input ride through the assistant's trusted context. Details →First reported medium.com
A Fake Bug Report Made an AI Agent Steal a Live AWS Key. It’s Called Agentjacking & There’s No Patch | by @pramodchandrayan | Predict
A Medium write-up describes "agentjacking," an indirect prompt-injection technique in which a fake Sentry bug report contains hidden instructions that AI coding agents (Claude Code, Cursor, Codex) execute when a developer asks them to triage errors, leading to exfiltration of a live AWS secret key. It cites a security firm's demonstration reporting 2,388 exposed organizations and an 85% success rate with no malware or user clicks, and argues that instructing an agent to "ignore untrusted content" does not prevent the attack. Details →First reported crowdstrike.com
Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks
CrowdStrike details SANDWORM_MODE, a multi-stage npm supply chain worm first documented by Socket.dev in February 2026 that spanned 19 malicious packages and specifically exploited the runtime behaviors of AI coding assistants (Copilot, Cursor, Claude Code), CI automation, and LLM toolchains. The infection chain uses an obfuscated multi-layer loader (Base64/zlib/XOR, indirect eval) to bypass static analysis, then fingerprints the environment and performs reconnaissance and credential harvesting across the AI-driven CI/CD pipeline. Details →First reported substack.com
Data Exfiltration from Slack AI via indirect prompt injection
PromptArmor identified an indirect prompt injection vulnerability in Slack AI, a RAG-style chat search interface, where an attacker seeds poisoned tokens into a public channel or an imported document. When a user later queries Slack AI, the injected instructions cause private data (e.g. an API key from a private channel) to be embedded into a malicious Markdown link that exfiltrates the secret to the attacker's server when clicked. Details →First reported foxnews.com
HalluSquatting attack exploits AI hallucinations to spread malware
The HalluSquatting attack exploits AI hallucinations by registering package or software names that large language models invent when suggesting dependencies, so developers who trust AI-recommended names end up installing attacker-controlled malware. The technique weaponizes the tendency of LLMs to hallucinate plausible-sounding but nonexistent package names. Details →First reported paloaltonetworks.com
OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat
Unit 42 describes an emerging AI supply-chain threat in which malicious "skills" published to the OpenClaw agent skill marketplace act as a distribution channel for malware and data theft. Corroborating research from Trend Micro (Atomic macOS Stealer delivery), Bitdefender, Koi.ai (341 malicious ClawedBot skills) and JFrog documents how attackers hide payloads inside agent skills users install to extend AI-agent capabilities. Details →First reported wraith.sh
Data Exfiltration via Markdown Images: The Quiet AI Vulnerability
Wraith's attack guide by Anthony D'Onofrio details data exfiltration via markdown image rendering in AI products, where an injected payload (via prompt injection, RAG doc, shared document, or email) causes an LLM to emit a markdown image whose URL embeds secrets like system prompts, conversation history, or API keys; when the chat client renders the markdown, the browser silently fetches the attacker's URL, leaking the data with zero clicks and no visible artifact. The guide notes variants have hit ChatGPT, Microsoft Copilot, GitHub Copilot Chat, Slack AI Assistant, Google Bard, and Claude.ai, and covers four defensive patterns. Details →First reported sans.edu
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials
A SANS ISC diary by Manuel Humberto Santander Peláez reports that analysis of 14 days of Apache/ModSecurity logs from a small web host revealed distributed internet scanning specifically targeting Model Context Protocol (MCP) servers, AI assistant configuration files, and locally exposed LLM endpoints. Notably, the POST /mcp probes carried valid JSON-RPC 2.0 MCP 'initialize' handshakes from 49 distinct source IPs, indicating scanners that speak the protocol and would enumerate tools and data sources if a real MCP server responded. Details →First reported · updated · 2 reports hiddenlayer.com
EchoGram and guardrail bypass: are AI defenses keeping up?
HiddenLayer research dubbed EchoGram demonstrates that carefully chosen token sequences can flip verdicts in LLM guardrail models, causing harmful prompts to be marked safe or benign prompts to trigger false alarms. The NHIMG editorial summarizes the finding and its implications for organizations relying on probabilistic AI safety layers to protect deployed LLMs and agents. Details →First reported elborai.me
Polymarket annotation injection
The author found injected annotations on a Polymarket event page that are rendered server-side and therefore visible to LLMs via web_search even when hidden in the browser. A planted annotation (source 'grok') contained a fake emergency-rate-cut message directing users to withdraw funds at a phishing-style domain, representing an indirect prompt-injection vector through Polymarket's annotation API endpoints. Claude's web search saw the content but correctly flagged it as phishing. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector