First reported · updated · 5 reports adversa.ai
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports darkreading.com
AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking
Zenity Labs disclosed a new zero-click vulnerability class dubbed 'PleaseFix' at Black Hat USA 2026 that lets attackers hijack AI browser agents — including Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge — by hiding malicious instructions in emails and webpages the agents ingest. Because the agents combine and act on content from multiple sources without reliably separating trusted from untrusted input, they break the same-origin security model, allowing an adversary to weaponize the agent and reach sensitive data, accounts, and connected services. Details →First reported · updated · 5 reports zscaler.com
Indirect Prompt Injection Targets AI Agents | ThreatLabz
Zscaler ThreatLabz observed two real-world indirect prompt injection (IPI) campaigns that hide malicious instructions inside web content, which is invisible to humans but read and executed by web-enabled AI agents. One campaign was a payment scam directing agents to initiate cryptocurrency payments, and the other used typosquatting to impersonate a cryptocurrency platform; researchers also tested a custom autonomous agent against the sites across multiple LLMs. Details →First reported mallory.ai
Researchers Expose Prompt Injection and Cross-Origin Risks in AI Browsers
Researchers and vendors disclosed serious weaknesses in AI-enabled browsers, warning that agentic features undermine same-origin policy, tab isolation, and cross-origin content handling. In one chain against OpenAI's ChatGPT Atlas, Hacktron AI reported that exposed Chromium Mojo IPC interfaces reachable from allowlisted OpenAI origins were combined with a postMessage XSS on forums.openai.com and a login CSRF flaw to control browser functions, read live tab URLs, and steal OAuth codes enabling account takeover; OpenAI fixed it in Atlas 1.2025.288.15 and paid a $5,000 bounty. Brave separately detailed indirect prompt injection risks in Perplexity Comet. Details →First reported nhimg.org
AI browser guardrail bypass exposes a new data theft path
LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported huntress.com
New BioShocking attack manipulates AI browser into data theft
A new prompt injection attack dubbed 'BioShocking' reportedly tricks AI-powered browsers into treating risky real-world actions as part of a fictional scenario, bypassing safety guardrails and enabling data theft. Details →First reported thehackernews.com
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
LayerX disclosed a technique called BioShocking that convinces AI browsers they are playing a game, tricking them into copying a user's credentials and sending them to an attacker. Six AI browsers and assistants were affected, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. Details →First reported tabstack.ai
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed an exploit chain called AutoJack that hijacks an AI browsing agent to achieve host code execution. By steering the agent to load an attacker's web page, the page's JavaScript reaches a privileged local service and spawns a process on the host with no credentials or further user interaction. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector