First reported checkpoint.com
Lead dispatch
First reported · updated · 2 reports island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github
Severity
0.78
The wire · latest
First reported openai.com
Continuously hardening ChatGPT Atlas against prompt injection attacks
OpenAI describes how it hardens ChatGPT Atlas's browser agent-mode against prompt injection, using reinforcement-learning-powered automated red teaming to discover novel attack strategies internally before they appear in the wild. The post details a recent security update that shipped a newly adversarially trained model and strengthened safeguards after internal red teaming uncovered a new class of prompt-injection attacks, and outlines a rapid response loop for continuously finding and patching agent exploits. Details →First reported · updated · 4 reports zscaler.com
Indirect Prompt Injection Targets AI Agents | ThreatLabz
Zscaler ThreatLabz observed two in-the-wild campaigns using indirect prompt injection (IPI) embedded in malicious websites to manipulate web-browsing AI agents. One campaign uses SEO poisoning around a fake Python library (requests-secure-v2) with hidden prompts and schema-markup instructions telling agents to make a cryptocurrency payment to a hardcoded wallet to obtain an API key; the other typosquats the DeFi tracker DeBank, embedding prompts convincing agents the fraudulent site is legitimate. In testing an autonomous payment-capable agent across 26 LLMs, four (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) were tricked into paying and two miscategorized the fake DeBank as trusted. Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported nhimg.org
AI browser guardrail bypass exposes a new data theft path
LayerX Security describes a "BioShocking" attack that games an AI browser into violating its guardrails by establishing a false reality, enabling data theft, code copying, and system command execution. The attack exploits the browser-mediated trust boundary, using indirect or staged instructions embedded in webpage context that pass prompt filters yet still steer the model into malicious enterprise actions inside an authenticated session. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported arxiv.org
MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks
MUZZLE is an automated agentic red-teaming framework, presented in a USENIX Security 2026 paper by researchers from Northeastern University and Mozilla, for evaluating the security of LLM-based web agents against indirect prompt injection attacks embedded in untrusted web content. Muzzle uses agent trajectories to identify high-salience injection surfaces and adaptively generates context-aware malicious instructions, discovering 44 new attacks across 4 web applications, including 3 cross-application prompt injection attacks and an agent-tailored phishing scenario. Details →First reported falshaw.de
Prompt Injection Is a Confused-Deputy Problem We Already Solved
Nick Falshaw argues that indirect prompt injection against AI agents is a classic confused-deputy problem — a trusted agent with real authority tricked into misusing it by attacker-supplied content it cannot distinguish from legitimate instructions — and that it cannot be fixed by making models smarter, only contained with network-security-style boundaries. The piece draws on a 2026 study (arXiv:2605.17634) finding direct prompt injection succeeded over 79% of the time against browser agents and Simon Willison's 'lethal trifecta' framing. Details →First reported nhimg.org
AI agents in the browser: what it means for IAM controls
An NHIMG editorial based on Surf Security content argues that AI agents which browse, log in, and act across SaaS and admin portals create machine-speed risk when they run in unmanaged browsers, leaving excessive permissions, persistent credentials, and limited auditability. It recommends treating the browser as an enforcement boundary and separating credential handling from agent logic to govern where agents may execute. Details →First reported arxiv.org
Prismata: Confining Cross-Site Prompt Injection in Web Agents
Prismata is a research defense for autonomous web agents that confines cross-site prompt injection by enforcing contextual least privilege, using dynamic trust derivation to produce permission labels for page content and mechanical confinement to redact content and restrict agent capabilities. The authors report it substantially reduces attack success across recent published web-agent attacks, including adaptive variants, while preserving benign task utility and requiring no developer annotations. Details →First reported huntress.com
New BioShocking attack manipulates AI browser into data theft
A new prompt injection attack dubbed 'BioShocking' reportedly tricks AI-powered browsers into treating risky real-world actions as part of a fictional scenario, bypassing safety guardrails and enabling data theft. Details →First reported thehackernews.com
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
LayerX disclosed a technique called BioShocking that convinces AI browsers they are playing a game, tricking them into copying a user's credentials and sending them to an attacker. Six AI browsers and assistants were affected, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. Details →First reported embracethered.com
Computer-Use and TOCTOU: What You Click Is Not What You Get!
The author reproduces a previously disclosed TOCTOU race-condition vulnerability against ChatGPT Operator, a computer-use AI agent, demonstrating that what the agent clicks is not what the user expects. A video demo of the attack was presented at the Real-world AI security conference. Details →First reported tabstack.ai
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed an exploit chain called AutoJack that hijacks an AI browsing agent to achieve host code execution. By steering the agent to load an attacker's web page, the page's JavaScript reaches a privileged local service and spawns a process on the host with no credentials or further user interaction. Details →First reported github.com
GitHub - pixiebrix/agent-browser-shield: Browser extension with 35+ rules for keeping your AI agent safe while browsing
A GitHub repository for 'agent-browser-shield,' a browser extension by pixiebrix offering 35+ rules aimed at keeping AI agents safe while browsing. It is a defensive tool addressing risks to browser-based AI agents rather than a report of a specific threat. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector