First reported youtube.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports youtube.com
What is 'SlopSquatting'? - YouTube
Tanya Janca (SheHacksPurple) explains 'slopsquatting,' a software supply-chain attack in which an AI coding assistant hallucinates a non-existent package name, and a malicious actor then registers that name and fills it with harmful code so developers unwittingly download it. The one-minute video defines the concept and warns developers against blindly trusting AI-generated package recommendations. Details →First reported · updated · 2 reports screetsec.com
Maland | Another Cursor 0-day Enabling Arbitrary Code Execution Beyond Git.exe
Cursor 3.0.0 patches CVE-2026-48124, a class of sandbox-to-host code execution weaknesses affecting AI coding agents including Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity, where files written by a sandboxed agent are later consumed and executed by trusted host tooling (extensions, task runners, Git integrations, Docker). Related research by Mindgard and others details a Windows binary-planting flaw where opening a repository auto-executes a malicious git.exe planted at the repo root, yielding zero-click arbitrary code execution with no prompt injection or model in the loop. Details →First reported · updated · 6 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz disclosed GhostApproval, a vulnerability pattern in 6 top AI coding assistants (Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, Windsurf) where a malicious repository uses a symlink (CWE-61) disguised as an ordinary file so the agent writes attacker-controlled content — such as an SSH key into ~/.ssh/authorized_keys — outside the workspace sandbox, potentially achieving RCE. In several cases (notably Claude Code) the agent's internal reasoning recognized the dangerous target while the human-in-the-loop confirmation dialog concealed it (CWE-451). CVEs including CVE-2026-12958 and CVE-2026-50549 were assigned; AWS, Cursor, and Google fixed the issue, while others went silent or declined it as outside their threat model. Details →First reported tech-insider.org
AI-Generated Code Security Stalls at 56% Pass Rate [2026] – Tech Insider Ireland
Coverage of Veracode's 2026 GenAI Code Security Report finds that across more than 100 tracked large language models the average security pass rate for generated code sits at 56%, meaning roughly 44% of AI code-generation tasks introduce a known, exploitable vulnerability when no explicit security instruction is given. The report notes AI now writes close to half of all committed code, and the pass rate has barely moved from 55% in the prior snapshot. Details →First reported knostic.ai
CodeRelay: 12 VS Code Extensions Disguised as Developer Tools
Knostic reports a coordinated campaign it dubbed "CodeRelay," involving 13 malicious VSIX packages across 12 VS Code extensions disguised as compilers, code runners, and "timeline" tools. Based on static analysis, the extensions are written to relay a developer's chat text, pasted code, and prior conversation history to one of three external LLM endpoints using embedded API keys, with ten hiding the logic in a compressed runtime-decoded payload and five using Unicode homoglyphs or invisible characters to disguise their names. Details →First reported nvidia.com
How to Self-Host a Validated AI Coding Assistant with NVIDIA NeMo Guardrails
An NVIDIA developer blog tutorial walks through self-hosting a validated AI coding assistant using StarCoder2-7B NIM with NVIDIA NeMo Guardrails, adding a policy layer that refuses requests for human-only files, a CI stage that catches hallucinated package dependencies before review, commit-level traceability, and a metrics loop to measure AI-assisted defect rates. Details →First reported aol.com
HalluSquatting AI attack could hijack your computer
HalluSquatting is a technique detailed by researchers from Tel Aviv University, Technion, and Intuit in which attackers exploit AI coding assistants and browsing agents that hallucinate software repository names. By repeatedly prompting models to locate popular projects, attackers discover consistently invented (fake) repo/package names, register them, and plant malicious instructions so an AI agent that retrieves and runs the files can deliver malware, steal data, or recruit the device into a botnet. Details →First reported darkreading.com
Choose Wisely: AI-Generated Coding Risk Varies, A Lot
Secure Code Warrior, in collaboration with RMIT University, released its AI Trust Index, a study evaluating 1,760 complete codebases generated by 16 frontier LLMs from vendors including OpenAI, Anthropic, and Google. The research found AI-generated code introduces roughly 15 vulnerabilities per codebase on average, with actual risk depending more on the development framework pairing than on the model chosen. Details →First reported darkreading.com
AI-Generated Workflows Are a Silent Security Disaster
An opinion/commentary piece arguing that AI coding assistants used to generate Microsoft 365 automation (e.g., Power Automate workflows) create unreviewed permissions and data flows, citing an incident where an AI-generated workflow copied sensitive HR documents into a broadly accessible Teams channel. The piece frames this as a governance and oversight gap rather than presenting a specific reproducible exploit. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector