First reported theregister.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports thehackernews.com
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
Manifold Security identified 77 counterfeit "evil twin" extensions uploaded to the Open VSX registry between July 26 and August 1, 2026, each impersonating a real extension's name and namespace at version 0.0.1 and beaconing to a newly registered domain; 19 carried a full reconnaissance payload exfiltrating git remote host/org, commit email domain, workspace path, branch, HEAD commit, and CI project identifiers (effectively private repo paths on build runners). The packages were removed from Open VSX by August 3, though the contacted infrastructure remained live. The research ties the risk to automated name resolution by AI coding agents, devcontainer configs, and provisioning scripts that install by name across registries, citing Anthropic's July 30 slopsquatting disclosure where a model-invented package name was executed by fifteen real systems. Details →First reported foxnews.com
HalluSquatting attack exploits AI hallucinations to spread malware
The HalluSquatting attack exploits AI hallucinations by registering package or software names that large language models invent when suggesting dependencies, so developers who trust AI-recommended names end up installing attacker-controlled malware. The technique weaponizes the tendency of LLMs to hallucinate plausible-sounding but nonexistent package names. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector