First reported arxiv.org
Tools · latest
First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.
jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - gaur-avvv/XGPT-WormGPT: [New Update](Added Agentic-Mode, Dark-GODMode)The Real BlackHat GPT - ai can do your illegal stuffs without saying anything. Use At Your Own Risk!
The GitHub repository XGPT-WormGPT (by user gaur-avvv) distributes a collection of jailbreak prompt files — including Agentic-Mode.txt, Dark-GODMode.txt, Dark.txt, and Gpt.txt — designed to bypass LLM safety guardrails and make AI models produce illicit content. Commit messages describe adding a 'fictional character WormGPT with malicious traits,' using the roleplay-persona framing as a technique to evade model refusals. Details →First reported github.com
GitHub - JustiNoel/LLM-Prompt-Injection: A .py code that acts as a middleware between the user and the LLM before producing the output
The GitHub repository JustiNoel/LLM-Prompt-Injection publishes 'prompt-shield', a Python middleware that sits between the user and an LLM to inspect input before output is produced, packaged with Docker Compose for deployment. The provided page shows only the repository file structure and no detailed technical mechanism or evaluation. Details →First reported giskard.ai
Prompt Injection | Giskard Documentation
Giskard's documentation describes the prompt-injection vulnerability category of its LLM red-teaming scanner, cataloguing runnable probes such as Best-of-N, DAN jailbreaks, math/Likert/citation/grandma framing, ASCII smuggling, encoding, transliteration, and the Deepset injection dataset used to test AI agents against OWASP LLM01. The probes reference underlying research including Best-of-N jailbreaking and Palo Alto Unit 42 multi-turn techniques. Details →First reported github.com
GitHub - bastion-soft/pi-detector-bench: Open, model-agnostic benchmark for prompt-injection detectors — scored on both axes (attack catch-rate and false positives on real traffic), threshold-agnostic, and reproducible from raw scores.
pi-detector-bench is an open, model-agnostic benchmark from bastion-soft for evaluating prompt-injection detectors, scoring both attack catch-rate and false positives on real traffic, with threshold-agnostic, reproducible results. It is published as a runnable GitHub repo with notebooks, scripts, and results. Details →First reported pypi.org
prompt-injection-defense
prompt-injection-defense is a Python package (pip install prompt-injection-defense) providing lightweight detection of prompt injection, jailbreaks, indirect injection, obfuscation, and unsafe content aligned to the OWASP LLM Top 10. It is an installable, MIT-licensed library maintained by Rajat Ghosh. Details →First reported github.com
GitHub - can995835646-byte/SentryGuard: Python CLI to detect Agentjacking injection attacks in Sentry error events
SentryGuard is a Python CLI that scans Sentry error events to detect 'Agentjacking' injection attacks — indirect prompt-injection payloads (e.g. system_prompt_injection, base64_shell_eval, 'ignore previous instructions', 'ADMIN OVERRIDE') that could trigger AI agents consuming error data. It also offers a sanitize command to strip system-prompt-style and prompt-override phrases from events. The repo is gated behind a Gumroad license check. Details →First reported ryandens.github.io
promptblock — block prompt injection in GitHub issues
promptblock is a GitHub tool that scans issue and comment bodies for prompt-injection payloads, specializing in instructions hidden inside HTML comments that GitHub's renderer drops but AI agents reading the raw API text still ingest. It splits bodies into visible and hidden segments, runs a bundled ML classifier, and flags risky content with a label and warning comment. Details →First reported github.com
GitHub - Jake-Schoellkopf/aicu: Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage
aicu is an open-source black-box security scanner for LLM applications that tests for prompt injection, safety bypass, and credential leakage. It ships with 173 payloads across seven test suites and a full-scan CLI command. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →First reported github.com
GitHub - denoland/clawpatrol: Security firewall for agents
Clawpatrol is an open-source security firewall for AI agents from denoland, designed to sandbox external plugins (treated as an untrusted supply-chain attack surface) using OS-level namespaces, Landlock, and macOS sandbox profiles, with permission lockfiles and brokered network dialing. Details →First reported github.com
GitHub - pixiebrix/agent-browser-shield: Browser extension with 35+ rules for keeping your AI agent safe while browsing
A GitHub repository for 'agent-browser-shield,' a browser extension by pixiebrix offering 35+ rules aimed at keeping AI agents safe while browsing. It is a defensive tool addressing risks to browser-based AI agents rather than a report of a specific threat. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector