First reported · updated · 4 reports zscaler.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported nhimg.org
AI browser guardrail bypass exposes a new data theft path
LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported huntress.com
New BioShocking attack manipulates AI browser into data theft
A new prompt injection attack dubbed 'BioShocking' reportedly tricks AI-powered browsers into treating risky real-world actions as part of a fictional scenario, bypassing safety guardrails and enabling data theft. Details →First reported thehackernews.com
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
LayerX disclosed a technique called BioShocking that convinces AI browsers they are playing a game, tricking them into copying a user's credentials and sending them to an attacker. Six AI browsers and assistants were affected, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. Details →First reported tabstack.ai
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed an exploit chain called AutoJack that hijacks an AI browsing agent to achieve host code execution. By steering the agent to load an attacker's web page, the page's JavaScript reaches a privileged local service and spawns a process on the host with no credentials or further user interaction. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector