First reported nvidia.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 8 reports enklypesalt.com
Document-borne AI worms can self-propagate through Copilot for Word | Hacker News
Researchers at enklypesalt.com demonstrated a document-borne, self-replicating prompt-injection worm that spreads through Microsoft Copilot for Word: a malicious Word document contains a hidden self-propagating prompt that, when processed by Copilot, forces the assistant to embed the same payload into other documents it drafts or edits, enabling zero-click chain propagation and data exfiltration. The write-up notes that at publication no robust mitigation for the broader vulnerability class was available, and the work is associated with assigned CVEs (CVE-2026-55145, CVE-2026-50522). Details →First reported · updated · 6 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz disclosed GhostApproval, a vulnerability pattern in 6 top AI coding assistants (Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, Windsurf) where a malicious repository uses a symlink (CWE-61) disguised as an ordinary file so the agent writes attacker-controlled content — such as an SSH key into ~/.ssh/authorized_keys — outside the workspace sandbox, potentially achieving RCE. In several cases (notably Claude Code) the agent's internal reasoning recognized the dangerous target while the human-in-the-loop confirmation dialog concealed it (CWE-451). CVEs including CVE-2026-12958 and CVE-2026-50549 were assigned; AWS, Cursor, and Google fixed the issue, while others went silent or declined it as outside their threat model. Details →First reported · updated · 4 reports tenetsecurity.ai
Fake Bug Report Hijacks AI Coding Agents at Scale
Tenet Security demonstrated at DEF CON 34 an "agentjacking" attack where an attacker POSTs a crafted error event containing markdown-formatted malicious instructions to a publicly exposed Sentry DSN ingest endpoint; when a developer asks an MCP-connected coding agent (Cursor, Claude Code) to debug, the agent retrieves the injected event, treats it as authoritative remediation, and executes commands that pull a malicious npm package and exfiltrate AWS, GitHub, npm, Kubernetes and CI/CD credentials. Controlled testing across 100+ organizations succeeded 85 percent of the time; no CVE was assigned, and Sentry deployed only a payload-string filter. Tenet also released agent-jackstop, drop-in hardening configs (egress allowlist, command approval, credential-read blocking) for Cursor and Claude Code. Details →First reported · updated · 10 reports noma.security
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos
Researchers at Noma Security disclosed GitLost, a technique in which an attacker opens an ordinary-looking issue on a public repository to trigger indirect prompt injection against GitHub Agentic Workflows. If the organization granted the agent read access across its repositories, the malicious issue can steer the agent into pulling private repository contents into a public comment, requiring no stolen credentials or organizational access. Details →First reported · updated · 3 reports zenity.io
ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Zenity Labs disclosed "AgentForger," a flaw in OpenAI's ChatGPT workspace agent builder that let a single crafted ChatGPT link silently create, configure, publish, and schedule an attacker-controlled autonomous agent inside a victim's workspace. The proof-of-concept agent inherited the employee's identity and connected apps (Outlook, Teams, Slack, SharePoint, Google Drive), disabled approval prompts, and used inbox messages tagged "TASK" as a covert command-and-control channel to search and exfiltrate corporate data. Details →First reported medium.com
A Fake Bug Report Made an AI Agent Steal a Live AWS Key. It’s Called Agentjacking & There’s No Patch | by @pramodchandrayan | Predict
A Medium write-up describes "agentjacking," an indirect prompt-injection technique in which a fake Sentry bug report contains hidden instructions that AI coding agents (Claude Code, Cursor, Codex) execute when a developer asks them to triage errors, leading to exfiltration of a live AWS secret key. It cites a security firm's demonstration reporting 2,388 exposed organizations and an 85% success rate with no malware or user clicks, and argues that instructing an agent to "ignore untrusted content" does not prevent the attack. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector