First reported windowsforum.com
Lead dispatch
First reported · updated · 2 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers disclosed a vulnerability in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file (indirect prompt injection) can make Kiro rewrite its own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine without any approval prompt. Because Kiro can write to these files without user consent, the human-in-the-loop approval boundary is bypassed entirely. Amazon issued CVE-2026-10591 and the flaw is now fixed.indirect-prompt-injection · tool-abuse · remote-code-execution · supply-chain
ai-agents · mcp · llm · coding-agent · ide
Severity
0.85
The wire · latest
First reported nist.gov
NVD - CVE-2026-44192
CVE-2026-44192 is a path-traversal flaw in the Ansible Lightspeed Model Context Protocol (MCP) server that lets an attacker manipulate an AI agent via indirect prompt injection to write files to unauthorized locations. Red Hat rates it CVSS 3.1 base 6.6 (Medium), and successful exploitation can expose sensitive host information and enable malicious command execution leading to full system compromise. Details →First reported feedly.com
CVE-2026-30623 - Exploits & Severity
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable. Details →First reported nist.gov
NVD - CVE-2026-70477
CVE-2026-70477 is a critical (CVSS 9.5) vulnerability in Flowise prior to 3.1.3, where a prompt injection sent to a chatflow using the CSV Agent node can cause the LLM to emit malicious Python that bypasses the blocklist validator (validatePythonCodeForDataFrame) and executes in an unsandboxed Pyodide environment. The flaw in the CSV_Agents class run method lets an attacker achieve arbitrary code execution in the context of the service account; it is fixed in version 3.1.3. Details →First reported thehackernews.com
Search results for database — Latest News, Reports & Analysis
Researchers at Obsidian Security disclosed a chain of three vulnerabilities in LiteLLM, a widely deployed open-source AI gateway, that lets a default low-privilege account escalate to full admin and execute code on the server. A takeover exposes every model-provider key it holds, the secrets decrypting its stored credentials, and all prompts and responses passing through it; Obsidian rates the full chain CVSS 9.9. Maintainer BerriAI shipped the complete fix in LiteLLM v1.83.14-stable. Details →First reported ca.gov
CYBER ADVISORY
Cal-CSIC issued an advisory for CVE-2026-61459, a critical (CVSS 9.8) argument injection vulnerability in MCP Server Kubernetes, a component that bridges AI assistants and automated tools to Kubernetes clusters. If the MCP server is externally exposed, an attacker can send crafted requests to steal credentials, bypass security checks, inject malicious arguments, and compromise the entire cluster with potential lateral movement across clusters. A fix is available in version 3.9.0. Details →First reported amazon.com
CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
CVE-2026-18655 is a vulnerability in the AWS Labs Amazon MQ MCP Server where prompt injection can cause disclosure of broker credentials and OAuth tokens. AWS published security bulletin 2026-070-AWS marking it as Important (requires attention), with a corresponding GitHub security advisory (GHSA-xwj6-8x5h-hjp6). Details →First reported cve.org
CVE Record: CVE-2026-47427
CVE-2026-47427 is a null pointer dereference denial-of-service in GitHub's official MCP Server (github-mcp-server) prior to version 1.1.0, where the CompletionsHandler in pkg/github/server.go accesses params.Ref without a nil check. A completion/complete JSON-RPC request with a missing or empty ref field triggers a Go runtime panic before any authentication, letting any unauthenticated client crash the server. The issue is fixed in version 1.1.0 (CVSS 7.5 HIGH). Details →First reported github.com
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server · Advisory · awslabs/mcp
A vulnerability (CVE-2026-18954, GHSA-j694-4m5j-w8hc) in Amazon AWS Labs DocumentDB MCP Server lets an authenticated MCP client bypass read-only mode enforcement by submitting aggregation pipelines with write-capable stages ($out, $merge) through the aggregate tool, which fails to validate pipeline stages. The issue is fixed in version 1.0.12; a workaround is to configure the server with a read-only database user. Details →First reported visualstudio.com
AI security in VS Code
VS Code documentation describes built-in security controls for AI-powered agentic development, including Workspace Trust restricted mode, agent sandboxing to limit file system and network access, mandatory review of file edits, protection of sensitive files, session-scoped auto-approval, and vetting of MCP servers before trusting them. The page frames these as trust boundaries to limit the impact of autonomous agent actions on untrusted projects. Details →First reported · updated · 33 reports ulad.net
Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service
A Microsoft Community Hub article reports that only 8.5% of Model Context Protocol (MCP) servers use OAuth and provides guidance on how to host an MCP server securely on Azure App Service, addressing the widespread lack of authentication on network-exposed MCP servers that connect LLM agents to external tools and data. Details →First reported · updated · 2 reports thehackernews.com
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Security flaws in agent infrastructure from AWS (Bedrock AgentCore's InvokeHarness API), Google (Agent Development Kit for Python), and Vercel (AI SDK harness packages for Codex and OpenCode) allow untrusted or forged instructions to reach an agent's tools without verifying that a model turn authorized them. In several attack paths the model never ran, so system prompts, content filters, and model-level guardrails never engaged. AWS fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28. Details →First reported · updated · 4 reports cve.org
IBM's agentic AI platform is under active attack - patch now
A critical vulnerability, CVE-2026-9198, in IBM-owned low-code AI agent builder Langflow lets unauthenticated attackers achieve remote code execution on default deployments by chaining an auto-login endpoint that mints superuser tokens with a code-validation endpoint that runs arbitrary Python. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation; IBM says Langflow OSS 1.0.0 through 1.10.0 are affected and urges upgrading to 1.10.1 or later. Sysdig telemetry documents in-the-wild attack chains (including related CVE-2026-33017 RCE and CVE-2026-55255 IDOR) that probe /api/v1/auto_login, enumerate flows, and deliver second-stage loaders. Details →First reported oasis.security
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two flaws in Paperclip, an open-source control plane for teams of AI agents, let attackers execute host commands by importing and starting a malicious agent. The server-side path CVE-2026-41679 (CVSS 10.0) needs no account or victim interaction against authenticated deployments with default registration, while GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) triggers when a user opens an attacker-controlled page in default local_trusted mode; a third flaw exposed sensitive data via API routes lacking access checks. Version v2026.416.0 adds import-authorization and hostname-validation fixes. Details →First reported corgea.com
CVE-2026-55607 vulnerability: npm/@anthropic-ai/cl…
CVE-2026-55607 is a vulnerability affecting the npm package @anthropic-ai/claude-code, Anthropic's AI coding agent, tracked via GitHub Security Advisory GHSA-7835-87q9-rgvv and NVD, with a fix referenced in the v2.1.163 release. The Corgea page is an advisory catalog entry pointing to the upstream advisory and NVD record. Details →First reported · updated · 2 reports zafran.io
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Zafran Labs disclosed three high-severity flaws, collectively named FaceHugger, in Hugging Face's Diffusers library (CVE-2026-44827 CVSS 8.8, CVE-2026-45804 CVSS 7.5, and CVE-2026-44513 CVSS 8.8) that let a malicious model repository silently execute arbitrary code on any machine loading it. The flaws stem from a Time-of-Check to Time-of-Use race that bypasses the trust_remote_code safeguard by splitting a model download into two non-atomic HTTP requests, so a routine model load becomes an initial-access vector across CI/CD, container, and production pipelines. Details →First reported · updated · 2 reports openai.com
Lockdown Mode | OpenAI Help Center
OpenAI documented "Lockdown Mode," an optional advanced security setting for ChatGPT that limits outbound network requests to reduce the risk of data exfiltration from prompt injection attacks. The mode disables or limits live web browsing, image retrieval, deep research, agent mode, Canvas networking, file downloads, and live connector access, while noting it does not prevent prompt injections from appearing in processed content. Details →First reported · updated · 8 reports redhat.com
LiteLLM AI Gateway: Active Exploitation via MCP Injection – Lab Space
LiteLLM, an open-source AI gateway proxy with roughly 95 million monthly PyPI downloads, is affected by a cascading 2026 vulnerability chain that exposes the aggregated provider API keys it stores. The chain includes a March 2026 PyPI supply-chain compromise attributed to TeamPCP (CVE-2026-33634), a pre-auth SQL injection (CVE-2026-42208) that dumps stored credentials, and a command-injection flaw in LiteLLM's MCP server test endpoints (CVE-2026-42271) chained with a Starlette host-header bypass (CVE-2026-48710) for unauthenticated RCE assessed at CVSS 10.0; CISA added CVE-2026-42271 to its KEV catalog on June 8, 2026 with remediation required by upgrading to v1.83.10-stable. Details →First reported nist.gov
NVD - cve-2024-5184
CVE-2024-5184 is a prompt injection vulnerability in the EmailGPT service, whose API allows a malicious user to inject a direct prompt and take over the service logic. Attackers can force the AI service to leak hard-coded system prompts or execute unwanted prompts, and the flaw can be exploited by anyone with access to the service (CVSS 3.x base 9.1 CRITICAL per NIST). Details →First reported giskard.ai
Release Notes | Giskard Documentation
Giskard Hub UI release 2.5.0 adds a new TokenBreak security probe to its LLM red-teaming scanner, which tests whether an agent can be manipulated through obfuscated prompt injection by prepending characters to trigger words (e.g. 'ignore' → 'Aignore') to evade input classifiers while remaining interpretable to the LLM. The release also adds stateful multi-turn agent support and fine-grained probe selection for scans, and is based on HiddenLayer's TokenBreak attack research (arXiv:2506.07948). Details →First reported · updated · 2 reports google.com
Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation
Google Cloud documentation describes indirect prompt injection risks from the Google Cloud MCP integration in coding agents (VS Code and Antigravity IDE), explaining how agents running with a user's delegated privileges may misinterpret attacker-planted data in email, Cloud Storage, or BigQuery as instructions. It recommends guardrails such as running agents in constrained environments (e.g., Cloud Workstations) with disabled internet access and no root privileges. Details →First reported redhat.com
CVE-2026-49468 - Red Hat Customer Portal
CVE-2026-49468 is an Important-severity (CVSS 8.1) authentication-bypass flaw in LiteLLM, a proxy server (AI Gateway) used to call LLM APIs. A remote attacker sending a crafted Host header can bypass the proxy authentication layer to gain unauthenticated access to protected management routes, potentially leading to full system compromise. The issue is fixed in LiteLLM v1.84.0 (GHSA-4xpc-pv4p-pm3w), and Red Hat notes its default images do not start the vulnerable proxy. Details →First reported redhat.com
CVE-2026-12112 - Red Hat Customer Portal
CVE-2026-12112 is a session management flaw in the foreman-mcp-server (MCP Server) shipped with Red Hat Satellite 6.18 and 6.19, where unauthenticated attackers can hijack active administrative sessions because the server caches authenticated client connections and trusts a non-secret session ID without re-validating authentication tokens, while also logging newly created session IDs to standard logs. Rated 7.8 CVSS v3 (Important), it can lead to privilege escalation and infrastructure-wide code execution; Red Hat has issued fixes via RHSA-2026:28405 and RHSA-2026:28438. Details →First reported windowsforum.com
Microsoft AI Agent Guidance: Enforce Least-Privilege Identities
Microsoft published guidance ("Least privilege for AI agents: Identity, access, and tool binding," July 16) urging organizations to treat every AI agent as a distinct managed identity with a unique principal, named human owner, explicit purpose, narrowly scoped RBAC, and access to only a pre-approved set of tools and actions. The guidance warns that agents planning multi-step workflows and chaining tool calls turn a permissive role into a much larger exposure, and advises against reusing shared service accounts or secrets. Details →First reported gitlab.com
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | GitLab Advisory Database (GLAD)
CVE-2026-59822 is an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint, where the OAuth2 passthrough fallback path replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object. An unauthenticated attacker could supply an arbitrary/fabricated Bearer token to establish an authenticated MCP session, then list and call configured MCP tools and access connected services. The issue is fixed in LiteLLM v1.84.0. Details →First reported vuldb.com
CVE-2026-7755 IBM Langflow MCP Server Configuration input validation
CVE-2026-7755 is a critical (CVSS 10.0) input-validation vulnerability in IBM Langflow OSS 1.0.0 through 1.10.0 that could allow unauthenticated remote code execution due to incomplete validation enforcement on MCP server configuration files. The flaw affects the MCP Server Configuration component and can be exploited remotely without authentication; no public exploit is currently available. Details →First reported undercodetesting.com
Code Under Siege: New Vulnerabilities Turn AI Coding Assistants Into Hackers' Gateways + Video
Check Point Research disclosed critical vulnerabilities (CVE-2025-59536, CVE-2026-21852, CVSS 8.7) in agentic AI coding assistants like Anthropic's Claude Code that allow malicious repositories to weaponize the tool against its users. Through configuration files (.settings.json, .mcp.json), MCP hooks, and environment variables such as ANTHROPIC_BASE_URL, attackers can achieve consent-bypass arbitrary code execution and API key theft simply by getting a developer to open an untrusted project. Details →First reported nist.gov
NVD - CVE-2026-61439
CVE-2026-61439 affects PraisonAI versions before 4.6.78, where a prompt injection defense misconfiguration defaults the block threshold to CRITICAL severity, letting HIGH-level threats pass unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation to achieve system prompt extraction and unauthorized tool invocations; VulnCheck rates it CVSS 8.7 HIGH and a fix is available in 4.6.78. Details →First reported nist.gov
NVD - CVE-2026-57300
CVE-2026-57300 is a missing permission check in the Jenkins MCP Server Plugin (version 0.177.v629fdb_2557fe and earlier) that allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. CISA-ADP scored it CVSS 3.1 4.3 (Medium), and a Jenkins security advisory dated 2026-06-24 addresses the flaw. Details →First reported github.com
AI Agents Project Viewer Privilege Escalation via run_node_tool · Advisory · n8n-io/n8n
A GitHub Security Advisory (GHSA-x5vx-c2c8-m3w9) for n8n discloses a privilege-escalation flaw in its AI Agents feature: a read-only Project Viewer could chat with an agent whose node tools were enabled and, via the run_node_tool authorized only by the agent:execute scope, execute arbitrary tool nodes using the project's credentials without authorization checks. Where command- or file-capable nodes (Execute Command, SSH) are enabled, this could extend to arbitrary command execution on the n8n host. The issue is fixed in n8n versions 2.29.8 and 2.30.1. Details →First reported cloudsecuritywire.com
Securing LLM API Credentials in Cloud Environments: Preventing AI Key Theft and Inference Abuse
A hardening guide from Cloud Security Wire explains how stolen LLM API keys (for AWS Bedrock, Azure OpenAI, and GCP Vertex AI) create a distinct threat model — cost amplification, data exfiltration via model context windows, prompt-injection pivoting, and shared-infrastructure abuse — and provides IAM scoping, credential-exposure prevention, and inference-abuse monitoring steps. Details →First reported microsoft.com
Defending the Inbox Against Prompt Injection Attacks
Microsoft announced a new Microsoft Defender for Office 365 capability that detects and quarantines malicious AI instructions (prompt injection) embedded in email before delivery, aiming to stop indirect prompt injection from reaching Copilot and Microsoft 365 agents. The post cites publicly disclosed research such as Morris II and EchoLeak as evidence that email is a high-volume ingress channel for AI-targeted attacks, describing techniques like white-on-white text, zero-width Unicode, and hidden HTML instructions. Details →First reported · updated · 2 reports cyera.com
Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
Cyera researchers disclosed CVE-2026-7482 ("Bleeding Llama", CVSS 9.1), a heap out-of-bounds read in Ollama's GGUF model loader that lets a remote, unauthenticated attacker leak the entire process memory of an Ollama server. The flaw is fixed in Ollama 0.17.1 and is estimated to affect over 300,000 exposed servers globally. Details →First reported nist.gov
NVD - CVE-2026-30741
CVE-2026-30741 is a remote code execution vulnerability in OpenClaw Agent Platform v2026.2.6 that allows attackers to execute arbitrary code via a request-side prompt injection attack. CISA-ADP rated it CVSS 3.1 base 9.8 (Critical), classified as CWE-94 code injection, with public exploit references including a GitHub PoC repository. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported nist.gov
NVD - CVE-2026-59819
CVE-2026-59819 is a vulnerability in LiteLLM, an AI gateway/proxy for calling LLM APIs, where prior to version 1.83.10-stable the /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a privileged caller to read arbitrary local files via an oidc/file/ reference (CWE-73). The issue is fixed in version 1.83.10-stable. Details →First reported paloaltonetworks.com
Potential denial of wallet abusing AI services • Cortex XSIAM Analytics Alert Reference by data source • Palo Alto Networks documentation portal
A Palo Alto Networks Cortex XSIAM analytics alert reference page documents a detection named 'Potential denial of wallet abusing AI services,' which flags abuse of cloud AI services (via AWS Audit Log data) to drive up costs in a denial-of-wallet style attack. The page is a product documentation entry describing the built-in detection rather than a technical write-up of the attack mechanism. Details →First reported microsoft.com
Prompt injection protection in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn
Microsoft documentation describes prompt injection protection built into Microsoft Defender for Office 365, which detects attacker-authored instructions embedded in inbound email (body, subject, quoted replies, attachments, or hidden markup) before that content reaches a user or an AI assistant such as Microsoft 365 Copilot. The feature explains indirect prompt injection techniques including direct instructions to the model and hidden/invisible text (white-on-white fonts, zero-size text, HTML/CSS tricks) and detects them as part of existing mail-flow inspection. Details →First reported · updated · 2 reports talosintelligence.com
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365
Cisco Talos documents ARToken, a phishing-as-a-service affiliate panel sharing infrastructure with the EvilTokens platform, that abuses Microsoft's OAuth device authorization grant to steal tokens and bypass MFA. The AI element is an AI-augmented BEC pipeline chaining Groq-hosted Llama models for financial exposure scoring and GPT-4o-mini for email translation, plus AI-powered personalized lures, to automate fraud against compromised Microsoft 365 mailboxes. Details →First reported theregister.com
Microsoft builds a bouncer to keep bots out of Teams meetings
The Register reports that Microsoft is rolling out bot-detection technology for Teams meetings that uses behavioral and infrastructure signals to distinguish bots from humans, requiring a human in the lobby to deliberately admit a bot. The move responds to unwanted bots—including third-party transcription and meeting-assistant bots—automatically joining meetings that may involve sensitive or NDA-covered discussions, and will add an ISV registration path for known bots while retiring CAPTCHAs. Details →First reported pypi.org
prompt-injection-defense
prompt-injection-defense is a Python package (pip install prompt-injection-defense) providing lightweight detection of prompt injection, jailbreaks, indirect injection, obfuscation, and unsafe content aligned to the OWASP LLM Top 10. It is an installable, MIT-licensed library maintained by Rajat Ghosh. Details →First reported darkreading.com
DifyTap Bugs Let Attackers 'Wiretap' AI Chat Histories
Four vulnerabilities dubbed 'DifyTap' in Dify, a platform for building and managing AI applications, allow attackers to silently access and exfiltrate sensitive data, including AI chat histories. Details →First reported arstechnica.com
Millions of AI agents imperiled by critical vulnerability in open source package
A critical authentication-bypass vulnerability (CVE-2026-48710, dubbed BadHost) in the Starlette framework lets a single character injected into the HTTP Host header bypass path-based authorization. Because Starlette underpins FastAPI, vLLM, LiteLLM, and many MCP servers and agent harnesses, the flaw exposes millions of AI agents and their stored third-party credentials and sensitive data to trivial exploitation. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector