First reported · updated · 2 reports splunk.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports checkpoint.com
From SQLi to RCE - Exploiting LangGraph’s Checkpointer - Check Point Research
Check Point Research (Yarden Porat and Shahar Tal) disclosed 11 vulnerabilities across six major AI agent frameworks — LangChain, LangGraph, CrewAI, AutoGen, the Microsoft Agent Framework, and Google ADK — including insecure deserialization, SSRF, path traversal, SQL injection, and use-after-free flaws. The most severe were RCE chains: a checkpoint deserialization flaw in the Microsoft Agent Framework triggerable via prompt injection, unauthenticated code execution in Google ADK, and three LangGraph checkpointer bugs (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022). All disclosed issues were patched. Details →First reported · updated · 5 reports varonis.com
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
SearchLeak (CVE-2026-42824) is a critical three-stage vulnerability chain in Microsoft 365 Copilot Enterprise discovered by Varonis Threat Labs that lets an attacker steal MFA codes, emails, meeting details, and organizational files with a single click on a trusted microsoft.com link. It chains a Parameter-to-Prompt (P2P) injection via the search q parameter with an HTML rendering race condition and a CSP bypass through Bing's allowlisted image-search SSRF endpoint to silently exfiltrate a victim's mailbox, calendar, SharePoint, and OneDrive data. Microsoft remediated the flaw and rated it critical. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector