First reported · updated · 2 reports cyera.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported nist.gov
NVD - CVE-2026-59819
CVE-2026-59819 is a vulnerability in LiteLLM, an AI gateway/proxy for calling LLM APIs, where prior to version 1.83.10-stable the /health/test_connection endpoint resolved request-supplied environment and OIDC file references in litellm_params, allowing a privileged caller to read arbitrary local files via an oidc/file/ reference (CWE-73). The issue is fixed in version 1.83.10-stable. Details →First reported bugcrowd.com
One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo) - CrowdStream
A disclosed and now-patched vulnerability in Atlassian Rovo, the default AI assistant across Confluence and other Atlassian products, allowed the `rovoChatPrompt` URL parameter to preload an arbitrary prompt into a victim's Rovo chat. When an authenticated user clicked a crafted link, Rovo executed the embedded prompt as a genuine query, using indirect task-framed language ('help me identify this image') to bypass guardrails and exfiltrate Confluence pages, secrets, and connected-app data (Jira, SharePoint, Outlook) to an attacker host via an image-fetch URL. Atlassian remediated the issue server-side and the reporter validated the fix. Details →First reported · updated · 3 reports catonetworks.com
DuneSlide: Two Critical RCE vulnerabilities
Cato AI Labs disclosed two critical vulnerabilities in Cursor IDE, dubbed DuneSlide (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8), that allow zero-click prompt injection to escape the editor's command sandbox and achieve remote code execution. CVE-2026-50548 abuses the run_terminal_cmd tool's working_directory parameter to add attacker-chosen folders to the allowed-write list, letting an attacker overwrite the cursorsandbox binary or shell startup files and turn sandboxed commands into full system compromise. Cursor patched both in version 3.0, released April 2; earlier 2.x builds remain exposed. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector