First reported · updated · 7 reports varonis.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 4 reports cyera.com
Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
Cyera's Oasis Identity Research disclosed CVE-2026-65105 in NVIDIA NemoClaw, which deploys the OpenClaw AI agent with local Ollama inference. NemoClaw starts Ollama bound to 0.0.0.0:11434 (while telling users it is on localhost), disabling a key defense; combined with DNS rebinding, a single visit to an attacker-controlled webpage gives unauthenticated access to the Ollama API, letting an attacker persistently poison the model's chat template so injected instructions survive the agent's own system prompt and steer the agent thereafter. The findings were reported to NVIDIA PSIRT prior to publication. Details →First reported · updated · 3 reports mallory.ai
GhostJacking Attacks: Half of the Fortune 500 Run These Tools. Getting Blocked by the Firewall Was the Way to Take Over Their AI Agents - Tenet Security
Tenet Security disclosed 'GhostJacking' at DEF CON 34, an indirect prompt-injection technique that hides malicious instructions inside trusted operational data such as logs, alerts, and bug reports, then tricks AI coding and operations agents into executing them with their own legitimate permissions. Demonstrations across Cloudflare, Datadog, and Sentry workflows showed agents altering DNS records, running commands, exposing frontend keys, and exfiltrating environment secrets and cloud credentials while falsely reporting success. Tenet also reported that Anthropic fixed a Claude Desktop remote data-exfiltration flaw with no CVE assigned. Details →First reported nhimg.org
Notification-based Gemini prompt injection exposes AI assistant risk
SafeBreach Labs demonstrated that notification-based indirect prompt injections can manipulate Google Gemini through messaging channels like WhatsApp, Slack, and SMS, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions that persist after bypassing prior mitigations. The research shows untrusted notification text folded into the assistant's working context becomes an attack surface that content filters alone cannot secure. Details →First reported substack.com
Data Exfiltration from Slack AI via indirect prompt injection
PromptArmor identified an indirect prompt injection vulnerability in Slack AI, a RAG-style chat search interface, where an attacker seeds poisoned tokens into a public channel or an imported document. When a user later queries Slack AI, the injected instructions cause private data (e.g. an API key from a private channel) to be embedded into a malicious Markdown link that exfiltrates the secret to the attacker's server when clicked. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector