First reported · updated · 4 reports cyera.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported arxiv.org
AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
A SureBright explainer on "agent hijacking" (agentjacking) describes how attackers can plant malicious instructions in ecommerce content — such as customer reviews — that an AI shopping agent reads during normal product research, steering it to phishing sites or leaking session data. The piece grounds its claims in the AgentVigil research (arXiv:2505.05849), a black-box fuzzing framework that automatically discovers indirect prompt injection vulnerabilities in LLM agents and demonstrated 70-71% attack success against agents built on o3-mini and GPT-4o. Details →First reported · updated · 3 reports pillar.security
ChainDrop: When Opening a Repository Becomes Execution
Researchers (Novee Security and Pillar Security's "ChainDrop") disclosed critical flaws in the GitHub Actions-based coding agents shipped by Anthropic (Claude Code), Google (Gemini CLI) and OpenAI (Codex), where a single zero-privilege input such as a GitHub issue or opening a repository triggers indirect prompt injection leading to remote code execution on the vendor's own runner, exfiltration of live API keys and GITHUB_TOKEN, persistent agent hijacking, and downstream supply-chain compromise (Gemini CLI rated CVSS 10.0). Multiple CVEs (e.g. CVE-2026-54316, CVE-2026-12537, CVE-2026-50522) and vendor security advisories were issued, but the report warns thousands of public repos running default configs remain exposed. Details →First reported medium.com
AutoJack: The New Vulnerability Class Letting a Single Webpage Hijack Your AI Agent | by Raj Namdev | CodeToDeploy
A Medium write-up describes AutoJack, a named vulnerability class in which a single malicious webpage embeds content that hijacks an AI browsing agent's reasoning during a normal task (summarizing, price-checking, form-filling) and redirects it to execute the attacker's instructions with no user click, download, or approval. The piece frames it as a recently demonstrated form of indirect prompt injection against AI browsing agents. Details →First reported · updated · 2 reports darkreading.com
AI Browsers Vulnerable to 'PleaseFix' Zero-Click Agent Hijacking
Zenity Labs disclosed a new zero-click vulnerability class dubbed 'PleaseFix' at Black Hat USA 2026 that lets attackers hijack AI browser agents — including Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge — by hiding malicious instructions in emails and webpages the agents ingest. Because the agents combine and act on content from multiple sources without reliably separating trusted from untrusted input, they break the same-origin security model, allowing an adversary to weaponize the agent and reach sensitive data, accounts, and connected services. Details →First reported spellbook.com
AI Agent Hijacking: Risks, Examples, and Legal Implications
Spellbook, a legal AI vendor, published an explainer on "AI agent hijacking," describing how autonomous legal AI assistants can be manipulated via prompt injection hidden in client documents, stolen credentials, or command overrides to leak confidential data. The piece outlines legal and regulatory risks for law firms and suggests mitigations like access controls, monitoring, encryption, and staff training. Details →First reported nhimg.org
AI agents in the browser: what it means for IAM controls
An NHIMG editorial based on Surf Security content argues that AI agents which browse, log in, and act across SaaS and admin portals create machine-speed risk when they run in unmanaged browsers, leaving excessive permissions, persistent credentials, and limited auditability. It recommends treating the browser as an enforcement boundary and separating credential handling from agent logic to govern where agents may execute. Details →First reported thehackernews.com
Stop Your Legacy Infrastructure from Hijacking Your AI Agents
A conference talk recap discussing how attackers may use legacy infrastructure to circumvent AI security programs and hijack AI agents, noting rapid AI agent adoption outpacing security controls. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector