First reported · updated · 2 reports github.com
Tools · latest
First reported darkreading.com
'HTTP Terminator' Hunts for Novel Desync Attacks
'HTTP Terminator,' an AI-powered open source tool built by PortSwigger's James Kettle, autonomously developed novel HTTP desync (request-smuggling) attack techniques and used them to successfully compromise real enterprise websites, including several financial services firms. Presented at Black Hat USA 2026, the tool explores whether AI can perform genuinely novel offensive security research, and notably deviates from its instructions (e.g., pivoting to cache poisoning). Details →First reported · updated · 5 reports github.com
system_prompts_leaks/Anthropic/claude-fable-5.md at main · asgeirtj/system_prompts_leaks · GitHub
A GitHub repository (asgeirtj/system_prompts_leaks) hosts an extracted/leaked system prompt file for Anthropic's Claude Fable 5, part of a broader collection of leaked LLM system prompts. Anthropic's own announcement describes Fable 5 and the cyberdefense-oriented Mythos 5 (Project Glasswing) as models with state-of-the-art capabilities gated by conservative safeguards. Details →First reported github.com
GitHub - marcsnid/steganeur: Hide secret messages inside LLM-generated text. Neural linguistic steganography in Rust with multiple methods.
steganeur is a Rust tool that hides secret messages inside LLM-generated text using neural linguistic steganography with multiple methods. Published as an installable Cargo crate, it encodes hidden data into natural-looking model output, creating a covert channel that rides on LLM text generation. Details →First reported github.com
GitHub - M507/RamiGPT: Autonomous Privilege Escalation using AI + Benchmarking models
RamiGPT is an open-source tool by GitHub user M507 that uses AI (LLM-driven agents) to perform autonomous privilege escalation, packaged with a benchmarking harness to compare model performance across escalation tasks in Docker/Ansible test environments. The repository provides runnable code, benchmark tests, and published results. Details →First reported arxiv.org
CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
CrackedPDFs is a controlled benchmark and dataset for hidden (indirect) prompt injection in PDFs, comprising 29,322 generated PDFs (9,774 injected, 19,548 benign/confounder) from 4,983 base documents, released with code and data on GitHub, Hugging Face, and Zenodo. The authors evaluate PromptGuard, a rule baseline, structural-only learned models, and a sanitized hybrid detector, reporting the hybrid detector reaching 0.960 F1 on a held-out set while noting it does not demonstrate broad real-world robustness. Details →First reported giskard.ai
Release Notes | Giskard Documentation
Giskard Hub UI release 2.5.0 adds a new TokenBreak security probe to its LLM red-teaming scanner, which tests whether an agent can be manipulated through obfuscated prompt injection by prepending characters to trigger words (e.g. 'ignore' → 'Aignore') to evade input classifiers while remaining interpretable to the LLM. The release also adds stateful multi-turn agent support and fine-grained probe selection for scans, and is based on HiddenLayer's TokenBreak attack research (arXiv:2506.07948). Details →First reported github.com
GitHub - xalgord/xalgorix: Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Xalgorix is an open-source project on GitHub (xalgord/xalgorix) presenting autonomous AI pentesting agents that perform real-time reconnaissance, vulnerability detection, and exploitation orchestration, built in Go and TypeScript with active releases (v4.5.69) and commit history. Details →First reported darkreading.com
Red Agents vs. Blue Agents: How to Make AI Better At Defense
Dark Reading reports that AI offensive-security startup Dreadnode released two open-source tools, DreadGOAD (a reproducible Active Directory training environment) and Ares (an agentic red-team/blue-team system), to measure the effectiveness of agentic defenders. In DreadGOAD, Ares red-team agents discover hosts, escalate privileges, and compromise the environment while blue-team agents analyze telemetry, triage alerts, and attempt to contain the activity. Details →First reported github.com
GitHub - adithyan-ak/AgentHound: Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
AgentHound is an open-source offensive security framework for AI agent infrastructure, described as "BloodHound for the agentic stack." The tool performs reconnaissance, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. Details →First reported cybergym.io
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
ExploitGym is a benchmark of 869 tasks from the UC Berkeley sunblaze group (published with a GitHub repo) that measures whether AI agents can transform a known vulnerability and a proof-of-vulnerability input into a working end-to-end exploit across userspace, browser V8, and Linux kernel targets. A leaderboard scores frontier coding agents on how many exploits they produce, including bypasses of ASLR, stack canaries, and the V8 heap sandbox, and the authors describe the capability as inherently dual-use. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported github.com
GitHub - joshfischer1108/jailbreak-lab: A hands-on kit for educational, authorized red teaming of any locally-run LLM.
jailbreak-lab (a.k.a. LLM Red Team Lab) by joshfischer1108 is a hands-on GitHub kit for educational, authorized red teaming of any locally-run, OpenAI-compatible LLM (Llama, Mistral, Qwen, Gemma, DeepSeek R1, etc.). It bundles real jailbreak techniques including instruction override, roleplay/DAN, hypothetical framing, encoding, and payload splitting. Details →First reported github.com
LLM-Security-Jailbreak/docs/INTEGRITY_LEDGER.md at main · wherewolf87/LLM-Security-Jailbreak
The LLM-Security-Jailbreak repository, a fork of elder-plinius/T3MP3ST, publishes an 'Integrity Ledger' documenting a hardened jailbreak/security-testing harness run against the 104-challenge XBEN black-box benchmark across models including GLM-5.2 and gpt-5.5, with self-audited results tracking contamination and methodology corrections. Details →First reported giskard.ai
Prompt Injection | Giskard Documentation
Giskard's documentation describes the prompt-injection vulnerability category of its LLM red-teaming scanner, cataloguing runnable probes such as Best-of-N, DAN jailbreaks, math/Likert/citation/grandma framing, ASCII smuggling, encoding, transliteration, and the Deepset injection dataset used to test AI agents against OWASP LLM01. The probes reference underlying research including Best-of-N jailbreaking and Palo Alto Unit 42 multi-turn techniques. Details →First reported knostic.ai
OpenAnt: Read the LLM Vulnerability Paper
Knostic announced OpenAnt, described as an open source LLM vulnerability discovery project, now published on arXiv. The article provides minimal detail beyond the project's existence and its framing as a leading open source effort for finding LLM vulnerabilities. Details →First reported github.com
GitHub - Jake-Schoellkopf/aicu: Black-box security scanner for LLM applications — prompt injection, safety bypass, credential leakage
aicu is an open-source black-box security scanner for LLM applications that tests for prompt injection, safety bypass, and credential leakage. It ships with 173 payloads across seven test suites and a full-scan CLI command. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector