First reported embracethered.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported mitiga.io
Modern Malware — Spyware Skills, Hijacked Base URLs, and 1,230+ Leaking API Keys in AI Instruction Files
Mitiga Labs details malware hidden in AI agent instruction files — Cursor rules, Anthropic Skills, Claude Hooks, AGENTS.md/CLAUDE.md context files, MCP server configs, and .pyc droppers — that AI agents follow with near-zero validation. The research found prompt-exfiltration tradecraft caught in the wild, attacker-controlled ANTHROPIC_BASE_URL overrides routing Claude traffic through MITM proxies, permission-bypass defaults, and over 1,230 hardcoded API keys and JWT tokens across tens of services. Mitiga also released a free scanner, Skillgate, built during the investigation. Details →First reported pillar.security
The Week of Sandbox Escapes
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged. Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported · updated · 2 reports asset-group.github.io
We put the exploit in a picture. Your AI code reviewer never opens it.
Researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrated 'Ghostcommit,' an attack that hides malicious prompt-injection instructions inside a PNG image so AI code reviewers (CodeRabbit, Cursor Bugbot) never see them. A benign-looking AGENTS.md convention file points to build-spec.png, whose rendered text instructs a coding agent to read the repo's .env byte-by-byte and emit the secrets as an integer tuple; the payload sits dormant until an unrelated agent session triggers exfiltration. A proof-of-concept is published on GitHub and the findings were disclosed to affected vendors. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →First reported · updated · 3 reports theregister.com
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security
Noma Security's "GitLost" research demonstrated that GitHub Agentic Workflows (AI agents backed by Claude or Copilot) could be tricked via indirect prompt injection: an unauthenticated attacker posts a crafted issue on a public org repo, and the agent fetches a private repo's README and posts it in a public comment. The PoC used an "Additionally" prefix to bypass guardrails and was disclosed to GitHub with no public patch date noted. Details →First reported nhimg.org
AI browser guardrail bypass exposes a new data theft path
LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported embracethered.com
From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal
Johann Rehberger (Embrace The Red) demonstrates a proof-of-concept where an indirect prompt injection hidden in a spreadsheet cell hijacks an LLM-integrated CLI tool to emit ANSI escape codes, which the macOS Terminal app interprets to issue DNS requests that exfiltrate data from other rows. Building on prior Terminal DiLLMa research and David Leadbeater's original finding, the post reports that Apple has fixed the macOS Terminal behavior enabling the DNS-based exfiltration. Details →First reported · updated · 2 reports paloaltonetworks.com
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
Palo Alto Unit 42 (Ori Hadad) disclosed CVE-2026-0257, a flaw in Google's Vertex AI Python SDK (python-aiplatform) where model uploads relied on an attacker-predictable Google Cloud Storage bucket, enabling 'bucket squatting.' An attacker could pre-register the expected bucket and substitute a malicious pickle/joblib model artifact, achieving cross-tenant remote code execution when the poisoned model was deserialized. Google fixed the issue in SDK releases v1.148.0/v1.148.1. Details →First reported mitiga.io
MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain
Mitiga Labs research details a man-in-the-middle attack chain against Claude Code in which a user-level post-install hook rewrites MCP server endpoints in ~/.claude.json to route MCP traffic through attacker-controlled infrastructure and steal OAuth tokens for connected SaaS (Jira, Confluence, GitHub, etc.). Because provider-side audit logs still show valid OAuth traffic from Anthropic's trusted egress range, the malicious activity blends in as legitimate user actions, and token rotation fails to break the chain while the hook keeps reseeding the config. Details →First reported · updated · 2 reports adversa.ai
The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
Adversa AI researcher Rony Utevsky details a Cursor IDE vulnerability (dubbed DeepJack) where a crafted `cursor://` deeplink installs an attacker-controlled MCP server that runs arbitrary, unsandboxed commands under the victim's account after one click and one confirmation. The install dialog renders the command in a single-line field so a malicious tail is pushed off-screen, and double-URL encoding disguises the `mcp/install` URI as a routine `pr-review` link. Cursor acknowledged the root cause but closed the reports as duplicates, and build 3.9.8 reportedly remains vulnerable. Details →First reported · updated · 2 reports tenetsecurity.ai
Fake Bug Report Hijacks AI Coding Agents at Scale
Tenet Security demonstrated "agentjacking," an indirect prompt-injection technique in which an attacker plants a single fake error report in a public bug-tracking service (Sentry) that hijacks AI coding agents into running attacker-controlled code on a developer's machine. In controlled testing, widely used assistants including Claude Code, Cursor, and Codex retrieved the poisoned error data and, in many cases, executed the code, opening a path to theft of cloud credentials, AWS keys, GitHub tokens, SSH keys, and CI/CD secrets. Details →First reported ainowinstitute.org
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
The AI Now Institute published an exploit brief and PoC (GitHub: Boyan-MILANOV/friendly-fire-ai-agent-exploit) demonstrating remote code execution against Anthropic's Claude Code CLI (auto-mode) and OpenAI's Codex CLI (auto-review) when these defensive coding agents are used to assess third-party or open-source libraries. The attack embeds prompt injections across a library's source code to hijack the AI agent, requiring no hooks, skills, plugins, MCP servers, or config files as an injection vector. Details →First reported 0din.ai
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review. Details →First reported arxiv.org
A Security Analysis of the OpenClaw AI Agent Framework
Researchers detailed three now-patched high-severity flaws (GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, GHSA-575v-8hfq-m3mc; CVE-2026-46817, CVE-2026-55200) in the OpenClaw personal AI assistant framework that compose into a complete unauthenticated remote code execution path — from an LLM tool call triggered via a WhatsApp message to command execution on the host. The chain abuses OS command injection and an incomplete disallowed-input filter in the exec allowlist, whose closed-world lexical parsing is defeated by shell line continuation, busybox multiplexing, and GNU option abbreviation; a companion arXiv analysis taxonomizes 470 advisories and shows a malicious plugin skill bypassing the exec pipeline entirely. Details →First reported · updated · 6 reports noma.security
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
Noma Security researchers demonstrated GitLost, an indirect prompt injection technique that lets an attacker open a normal-looking public GitHub issue to steer GitHub Agentic Workflows into leaking the contents of an organization's private repositories into a public comment. The attack requires no stolen credentials or access, only that the organization's agent has read access across its repos. Details →First reported huntress.com
New BioShocking attack manipulates AI browser into data theft
A new prompt injection attack dubbed 'BioShocking' reportedly tricks AI-powered browsers into treating risky real-world actions as part of a fictional scenario, bypassing safety guardrails and enabling data theft. Details →First reported simonwillison.net
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
Microsoft research describes how attackers can poison MCP tool descriptions to hijack AI agents into quietly exfiltrating company data to an outsider, without the agent visibly breaking any rule so default setups raise no alarm. Details →First reported · updated · 2 reports adversa.ai
GuardFall: a universal shell injection vulnerability in open-source AI agents
Adversa AI research describes GuardFall, a bypass of AI coding agents' safety filters using decades-old shell injection tricks to execute dangerous commands. The bypass reportedly worked against 10 of 11 tested popular open-source coding and computer-use agents, with only 'Continue' being resistant. Details →First reported bleepingcomputer.com
Clean GitHub repo tricks AI coding agents into running malware
An agentic coding tool instructed to run a seemingly benign GitHub repository could be tricked into executing a malicious payload that remains invisible to both security agents and human reviewers. Details →First reported thehackernews.com
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
Researchers at Zafran Security disclosed four vulnerabilities, collectively codenamed DifyTap, in the open-source agentic workflow platform Dify that could allow unauthenticated attackers to stealthily read AI conversations from other customers' applications across tenants. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed an exploit chain called AutoJack that hijacks an AI browsing agent to achieve host code execution. By steering the agent to load an attacker's web page, the page's JavaScript reaches a privileged local service and spawns a process on the host with no credentials or further user interaction. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector