First reported wiz.io
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 5 reports adversa.ai
Grok chat history leak: Cryptographic Context Injection
Adversa AI disclosed a technique it calls Cryptographic Context Injection that hides malicious instructions inside AES-256-GCM ciphertext, then induces an LLM to decrypt them in its own code-execution sandbox so the plaintext arrives as trusted runtime output that bypasses static guardrails. Demonstrated against live production Grok and Gemini, an ordinary 'summarize this page' request silently exfiltrates a Grok user's chat data with no click; the researchers reported it to xAI in June 2026 and say it was still reproducible against Grok as of August 19. Details →First reported nhimg.org
Notification-based Gemini prompt injection exposes AI assistant risk
SafeBreach Labs demonstrated that notification-based indirect prompt injections can manipulate Google Gemini through messaging channels like WhatsApp, Slack, and SMS, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions that persist after bypassing prior mitigations. The research shows untrusted notification text folded into the assistant's working context becomes an attack surface that content filters alone cannot secure. Details →First reported exploiting.systems
Prompt Injection in VirusTotal's Code Insights API
A researcher discovered prompt-injection flaws in VirusTotal's AI-powered Code Insights API (backed by gemini-2.5-flash), showing that embedded injection strings and false pretext in large block comments can suppress or alter analysis, force undocumented error schemas that leak the backend model, and induce false negatives or false positives. The bugs were accepted by Google's AI VRP on March 25, 2026 and are being patched. Details →First reported infosecwriteups.com
Google fixing Android lock screen bug that lets Gemini send SMS without a PIN
Google is fixing an Android 16 lock screen bypass in which Gemini, accessible from the lock screen, can be tricked into sending SMS and WhatsApp messages without a PIN. Pressing Gemini's "Continue" prompt simultaneously with its "Add attachment" button lets an attacker with physical access dispatch messages and re-enable Gemini's access to previously disconnected apps, all while the device stays locked. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector