First reported · updated · 3 reports thehackernews.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 8 reports enklypesalt.com
Document-borne AI worms can self-propagate through Copilot for Word | Hacker News
Researchers at enklypesalt.com demonstrated a document-borne, self-replicating prompt-injection worm that spreads through Microsoft Copilot for Word: a malicious Word document contains a hidden self-propagating prompt that, when processed by Copilot, forces the assistant to embed the same payload into other documents it drafts or edits, enabling zero-click chain propagation and data exfiltration. The write-up notes that at publication no robust mitigation for the broader vulnerability class was available, and the work is associated with assigned CVEs (CVE-2026-55145, CVE-2026-50522). Details →First reported substack.com
Data Exfiltration from Slack AI via indirect prompt injection
PromptArmor identified an indirect prompt injection vulnerability in Slack AI, a RAG-style chat search interface, where an attacker seeds poisoned tokens into a public channel or an imported document. When a user later queries Slack AI, the injected instructions cause private data (e.g. an API key from a private channel) to be embedded into a malicious Markdown link that exfiltrates the secret to the attacker's server when clicked. Details →First reported · updated · 5 reports varonis.com
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
SearchLeak (CVE-2026-42824) is a critical three-stage vulnerability chain in Microsoft 365 Copilot Enterprise discovered by Varonis Threat Labs that lets an attacker steal MFA codes, emails, meeting details, and organizational files with a single click on a trusted microsoft.com link. It chains a Parameter-to-Prompt (P2P) injection via the search q parameter with an HTML rendering race condition and a CSP bypass through Bing's allowlisted image-search SSRF endpoint to silently exfiltrate a victim's mailbox, calendar, SharePoint, and OneDrive data. Microsoft remediated the flaw and rated it critical. Details →First reported wraith.sh
Data Exfiltration via Markdown Images: The Quiet AI Vulnerability
Wraith's attack guide by Anthony D'Onofrio details data exfiltration via markdown image rendering in AI products, where an injected payload (via prompt injection, RAG doc, shared document, or email) causes an LLM to emit a markdown image whose URL embeds secrets like system prompts, conversation history, or API keys; when the chat client renders the markdown, the browser silently fetches the attacker's URL, leaking the data with zero clicks and no visible artifact. The guide notes variants have hit ChatGPT, Microsoft Copilot, GitHub Copilot Chat, Slack AI Assistant, Google Bard, and Claude.ai, and covers four defensive patterns. Details →First reported elborai.me
Polymarket annotation injection
The author found injected annotations on a Polymarket event page that are rendered server-side and therefore visible to LLMs via web_search even when hidden in the browser. A planted annotation (source 'grok') contained a fake emergency-rate-cut message directing users to withdraw funds at a phishing-style domain, representing an indirect prompt-injection vector through Polymarket's annotation API endpoints. Claude's web search saw the content but correctly flagged it as phishing. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector