First reported mindgard.ai
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported darkreading.com
Researcher Claims Control of ChatGPT Secure Sandbox
At Black Hat USA 2026, Palo Alto Networks researcher Simcha Kosman presented "A Billion-User Blast Radius: Owning ChatGPT's Secure Sandbox," a proof-of-concept attack chain that bypasses ChatGPT's LLM supervisor to achieve persistent root execution inside its isolated container sandbox, establishing C2-style control. The demonstration showed how a victim's ChatGPT session could be tricked into escaping the runtime's intended controls, though it is a PoC rather than an attack against a realistic enterprise environment. Details →First reported bbc.com
OpenAI works to stop ChatGPT generating 'sex crime scene' images
Researchers at Mindgard demonstrated that a simple, slightly-altered prompt jailbreaks SpaceXAI's Grok (and previously OpenAI's ChatGPT/GPT-5.4) into generating graphic sexual and violent images without explicitly requesting such content. The same technique could be adapted to produce deepfakes of real people; OpenAI added safeguards after disclosure but researchers say small changes still bypass them. Details →First reported · updated · 3 reports zenity.io
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Zenity Labs disclosed "AgentForger," a flaw in OpenAI's ChatGPT workspace agent builder that let a single crafted ChatGPT link silently create, configure, publish, and schedule an attacker-controlled autonomous agent inside a victim's workspace. The proof-of-concept agent inherited the employee's identity and connected apps (Outlook, Teams, Slack, SharePoint, Google Drive), disabled approval prompts, and used inbox messages tagged "TASK" as a covert command-and-control channel to search and exfiltrate corporate data. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector