First reported embracethered.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported pillar.security
The Week of Sandbox Escapes
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged. Details →First reported · updated · 5 reports varonis.com
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
SearchLeak (CVE-2026-42824) is a critical three-stage vulnerability chain in Microsoft 365 Copilot Enterprise discovered by Varonis Threat Labs that lets an attacker steal MFA codes, emails, meeting details, and organizational files with a single click on a trusted microsoft.com link. It chains a Parameter-to-Prompt (P2P) injection via the search q parameter with an HTML rendering race condition and a CSP bypass through Bing's allowlisted image-search SSRF endpoint to silently exfiltrate a victim's mailbox, calendar, SharePoint, and OneDrive data. Microsoft remediated the flaw and rated it critical. Details →First reported · updated · 3 reports theregister.com
Red teamers turned Claude Desktop into a double agent to do their evil bidding
Oasis Security disclosed "PromptFiction," a vulnerability in Anthropic's Claude Desktop where a single click on a trusted-looking claude:// URL silently submitted attacker-controlled prompts to the assistant with no user confirmation. Chained with the earlier "Claudy Day" trio of flaws, it could enable silent exfiltration of prior conversations and — when Anthropic's official Filesystem MCP server is installed — file read/write, persistence, and remote code execution. Anthropic has fixed the flaw. Details →First reported bugcrowd.com
One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo) - CrowdStream
A disclosed and now-patched vulnerability in Atlassian Rovo, the default AI assistant across Confluence and other Atlassian products, allowed the `rovoChatPrompt` URL parameter to preload an arbitrary prompt into a victim's Rovo chat. When an authenticated user clicked a crafted link, Rovo executed the embedded prompt as a genuine query, using indirect task-framed language ('help me identify this image') to bypass guardrails and exfiltrate Confluence pages, secrets, and connected-app data (Jira, SharePoint, Outlook) to an attacker host via an image-fetch URL. Atlassian remediated the issue server-side and the reporter validated the fix. Details →First reported · updated · 3 reports catonetworks.com
DuneSlide: Two Critical RCE vulnerabilities
Cato AI Labs disclosed two critical vulnerabilities in Cursor IDE, dubbed DuneSlide (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8), that allow zero-click prompt injection to escape the editor's command sandbox and achieve remote code execution. CVE-2026-50548 abuses the run_terminal_cmd tool's working_directory parameter to add attacker-chosen folders to the allowed-write list, letting an attacker overwrite the cursorsandbox binary or shell startup files and turn sandboxed commands into full system compromise. Cursor patched both in version 3.0, released April 2; earlier 2.x builds remain exposed. Details →First reported arxiv.org
A Security Analysis of the OpenClaw AI Agent Framework
Researchers detailed three now-patched high-severity flaws (GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, GHSA-575v-8hfq-m3mc; CVE-2026-46817, CVE-2026-55200) in the OpenClaw personal AI assistant framework that compose into a complete unauthenticated remote code execution path — from an LLM tool call triggered via a WhatsApp message to command execution on the host. The chain abuses OS command injection and an incomplete disallowed-input filter in the exec allowlist, whose closed-world lexical parsing is defeated by shell line continuation, busybox multiplexing, and GNU option abbreviation; a companion arXiv analysis taxonomizes 470 advisories and shows a malicious plugin skill bypassing the exec pipeline entirely. Details →First reported tabstack.ai
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector