First reported substack.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported · updated · 5 reports varonis.com
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
SearchLeak (CVE-2026-42824) is a critical three-stage vulnerability chain in Microsoft 365 Copilot Enterprise discovered by Varonis Threat Labs that lets an attacker steal MFA codes, emails, meeting details, and organizational files with a single click on a trusted microsoft.com link. It chains a Parameter-to-Prompt (P2P) injection via the search q parameter with an HTML rendering race condition and a CSP bypass through Bing's allowlisted image-search SSRF endpoint to silently exfiltrate a victim's mailbox, calendar, SharePoint, and OneDrive data. Microsoft remediated the flaw and rated it critical. Details →First reported bugcrowd.com
One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo) - CrowdStream
A disclosed and now-patched vulnerability in Atlassian Rovo, the default AI assistant across Confluence and other Atlassian products, allowed the `rovoChatPrompt` URL parameter to preload an arbitrary prompt into a victim's Rovo chat. When an authenticated user clicked a crafted link, Rovo executed the embedded prompt as a genuine query, using indirect task-framed language ('help me identify this image') to bypass guardrails and exfiltrate Confluence pages, secrets, and connected-app data (Jira, SharePoint, Outlook) to an attacker host via an image-fetch URL. Atlassian remediated the issue server-side and the reporter validated the fix. Details →First reported wraith.sh
Data Exfiltration via Markdown Images: The Quiet AI Vulnerability
Wraith's attack guide by Anthony D'Onofrio details data exfiltration via markdown image rendering in AI products, where an injected payload (via prompt injection, RAG doc, shared document, or email) causes an LLM to emit a markdown image whose URL embeds secrets like system prompts, conversation history, or API keys; when the chat client renders the markdown, the browser silently fetches the attacker's URL, leaking the data with zero clicks and no visible artifact. The guide notes variants have hit ChatGPT, Microsoft Copilot, GitHub Copilot Chat, Slack AI Assistant, Google Bard, and Claude.ai, and covers four defensive patterns. Details →First reported elborai.me
Polymarket annotation injection
The author found injected annotations on a Polymarket event page that are rendered server-side and therefore visible to LLMs via web_search even when hidden in the browser. A planted annotation (source 'grok') contained a fake emergency-rate-cut message directing users to withdraw funds at a phishing-style domain, representing an indirect prompt-injection vector through Polymarket's annotation API endpoints. Claude's web search saw the content but correctly flagged it as phishing. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector