Skip to content

The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported 21 Jul · updated 29 Aug · 3 reports embracethered.com

AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.

indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide

Read the full dispatch Query the index

0.85

The wire · latest

CLASS

All Threats News Research Analysis Tools

TAGS

indirect-prompt-injection tool-abuse supply-chain data-exfiltration

More filters

TYPE

incident research advisory analysis

STATUS

In the wild PoC Disclosed Patched

Filtering

First reported 20 Aug · updated 22 Aug · 5 reports adversa.ai

Grok chat history leak: Cryptographic Context Injection

Adversa AI disclosed a technique it calls Cryptographic Context Injection that hides malicious instructions inside AES-256-GCM ciphertext, then induces an LLM to decrypt them in its own code-execution sandbox so the plaintext arrives as trusted runtime output that bypasses static guardrails. Demonstrated against live production Grok and Gemini, an ordinary 'summarize this page' request silently exfiltrates a Grok user's chat data with no click; the researchers reported it to xAI in June 2026 and say it was still reproducible against Grok as of August 19.

First reported 18 Jul nhimg.org

AI browser guardrail bypass exposes a new data theft path

LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session.

First reported 13 Jul · updated 13 Jul · 2 reports hiddenlayer.com

EchoGram and guardrail bypass: are AI defenses keeping up?

HiddenLayer research dubbed EchoGram demonstrates that carefully chosen token sequences can flip verdicts in LLM guardrail models, causing harmful prompts to be marked safe or benign prompts to trigger false alarms. The NHIMG editorial summarizes the finding and its implications for organizations relying on probabilistic AI safety layers to protect deployed LLMs and agents.

See the API docs to pull all 954 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI Threats AI Security Research Agentic AI Security Tools Prompt Injection Tool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

GET /feed.xml — RSS 2.0, every item
GET /api/items — read-only

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

GET /api/items?tags=&minSeverity=&itemType=
GET /api/search?q= — keyword
GET /api/semantic?q= — vector

Preview semantic search