First reported · updated · 7 reports varonis.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 5 reports bugcrowd.com
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
Researchers at Varonis Threat Labs (RovoBlast) and PromptArmor independently showed that Atlassian's Rovo AI assistant can be manipulated via prompt injection to collect Jira and Confluence data a signed-in user can access and exfiltrate it to an external server. Varonis found that the rovoChatPrompt URL parameter preloads attacker instructions so a single click by an authenticated user triggers execution; PromptArmor hid instructions in an uploaded file that Rovo reads, working even with web-search disabled. Varonis's route was responsibly disclosed and fixed (CVE-2026-50522), while the PromptArmor file-based bypass is single-sourced and its remediation is not confirmed. Details →First reported · updated · 5 reports mindgard.ai
Amazon Kiro: AI Is Breaking Vulnerability Disclosure Processes
Mindgard disclosed a prompt-injection vulnerability in Amazon Kiro, an AI-powered agentic IDE, that lets attacker-controlled repository content coerce the Kiro agent into reading local sensitive data, modifying a workspace URL, and triggering an outbound request that exfiltrates the secret. The flaw was reproduced in Kiro IDE 0.7.45 on Windows in both trusted and untrusted workspaces via Kiro Powers (MCP configs and POWER.md steering files); exploitation requires the user open a malicious workspace file and message the agent, and is assessed as low difficulty. Details →First reported · updated · 3 reports wiz.io
Red Agent Exploits Snowflake Vuln Created by Copilot Autofix
Wiz's autonomous AI-powered "Red Agent" discovered and exploited a script injection vulnerability in Snowflake's snowflakedb/snowflake-connector-net GitHub Actions workflow, where opening a GitHub issue with a crafted title allowed an unauthenticated user to run arbitrary commands in the runner and exfiltrate Jira credentials. The flaw was inadvertently introduced days earlier by GitHub Copilot Autofix, which stripped a sanitized input pattern in favor of direct string interpolation; Snowflake patched it the same day it was reported (June 23, 2026) via its HackerOne program and rotated the exposed token. Details →First reported · updated · 3 reports manifold.security
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
Manifold Security disclosed a confused-deputy flaw in Microsoft's official Azure DevOps MCP server where a tool returning pull request descriptions lacked the prompt-injection guardrail applied to other tools, letting a hidden PR comment inject instructions into a reviewer's AI coding agent. The agent then acts with the user's own permissions, reaching projects the attacker cannot access and quietly exfiltrating what it finds; Microsoft addressed it in a fix (v2.8.0). Details →First reported corgea.com
CVE-2026-55607 vulnerability: npm/@anthropic-ai/cl…
CVE-2026-55607 is a vulnerability affecting the npm package @anthropic-ai/claude-code, Anthropic's AI coding agent, tracked via GitHub Security Advisory GHSA-7835-87q9-rgvv and NVD, with a fix referenced in the v2.1.163 release. The Corgea page is an advisory catalog entry pointing to the upstream advisory and NVD record. Details →First reported nhimg.org
Copilot vulnerability turns AI assistance into a data theft force
A Copilot Enterprise vulnerability chain, detailed by Swarmnetics and Varonis Threat Labs, showed how prompt injection combined with browser handling quirks and whitelisted endpoints can let an attacker move from a link click to rapid theft of emails, files, and meeting data across a Microsoft environment. The core issue is a broken trust boundary between a query, a link, and the content the assistant is allowed to surface, letting attacker-shaped input ride through the assistant's trusted context. Details →First reported undercodetesting.com
Code Under Siege: New Vulnerabilities Turn AI Coding Assistants Into Hackers' Gateways + Video
Check Point Research disclosed critical vulnerabilities (CVE-2025-59536, CVE-2026-21852, CVSS 8.7) in agentic AI coding assistants like Anthropic's Claude Code that allow malicious repositories to weaponize the tool against its users. Through configuration files (.settings.json, .mcp.json), MCP hooks, and environment variables such as ANTHROPIC_BASE_URL, attackers can achieve consent-bypass arbitrary code execution and API key theft simply by getting a developer to open an untrusted project. Details →First reported · updated · 5 reports varonis.com
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
SearchLeak (CVE-2026-42824) is a critical three-stage vulnerability chain in Microsoft 365 Copilot Enterprise discovered by Varonis Threat Labs that lets an attacker steal MFA codes, emails, meeting details, and organizational files with a single click on a trusted microsoft.com link. It chains a Parameter-to-Prompt (P2P) injection via the search q parameter with an HTML rendering race condition and a CSP bypass through Bing's allowlisted image-search SSRF endpoint to silently exfiltrate a victim's mailbox, calendar, SharePoint, and OneDrive data. Microsoft remediated the flaw and rated it critical. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector