First reported youtube.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 3 reports sonarsource.com
Arbitrary code execution and Claude Code CLI: How Claude executed code before you click 'trust' | Sonar
Researchers disclosed that AI coding agents including Anthropic's Claude Code, OpenAI Codex, Cursor, and goose can be tricked into executing attacker code via malicious Git configuration in an untrusted repository. Setting core.fsmonitor in a repo's .git/config causes the agent's git diff context-gathering to run arbitrary commands on the host before any trust prompt, model call, or tool approval (CVE-2026-72718 for goose, fixed in 1.44.0; Claude Code fixed in v2.0.71). The commands run with the user's privileges, enabling secret and API-key exfiltration. Details →First reported · updated · 3 reports pillar.security
ChainDrop: When Opening a Repository Becomes Execution
Researchers (Novee Security and Pillar Security's "ChainDrop") disclosed critical flaws in the GitHub Actions-based coding agents shipped by Anthropic (Claude Code), Google (Gemini CLI) and OpenAI (Codex), where a single zero-privilege input such as a GitHub issue or opening a repository triggers indirect prompt injection leading to remote code execution on the vendor's own runner, exfiltration of live API keys and GITHUB_TOKEN, persistent agent hijacking, and downstream supply-chain compromise (Gemini CLI rated CVSS 10.0). Multiple CVEs (e.g. CVE-2026-54316, CVE-2026-12537, CVE-2026-50522) and vendor security advisories were issued, but the report warns thousands of public repos running default configs remain exposed. Details →First reported corgea.com
CVE-2026-55607 vulnerability: npm/@anthropic-ai/cl…
CVE-2026-55607 is a vulnerability affecting the npm package @anthropic-ai/claude-code, Anthropic's AI coding agent, tracked via GitHub Security Advisory GHSA-7835-87q9-rgvv and NVD, with a fix referenced in the v2.1.163 release. The Corgea page is an advisory catalog entry pointing to the upstream advisory and NVD record. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector