First reported · updated · 3 reports theregister.com
Lead dispatch
First reported · updated · 2 reports island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github
Severity
0.78
The wire · latest
First reported arxiv.org
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
"Bad Memory" is a research paper studying prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace, evaluating Anthropic Claude Code and OpenAI Codex across four models. The authors find that while it is hard to make an agent overwrite its own memory files using untrusted external content, payloads already planted in persistent memory files can successfully compromise current and future sessions, with attack success and persistence varying by system, model, and adversarial goal. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →First reported mitiga.io
MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain
Mitiga Labs research details a man-in-the-middle attack chain against Claude Code in which a user-level post-install hook rewrites MCP server endpoints in ~/.claude.json to route MCP traffic through attacker-controlled infrastructure and steal OAuth tokens for connected SaaS (Jira, Confluence, GitHub, etc.). Because provider-side audit logs still show valid OAuth traffic from Anthropic's trusted egress range, the malicious activity blends in as legitimate user actions, and token rotation fails to break the chain while the hook keeps reseeding the config. Details →First reported · updated · 2 reports stepsecurity.io
Miasma Supply Chain Attack: Azure Hit, 73 Repos Down, 37 PyPI Wheels
The Miasma supply-chain worm campaign expanded to poison Microsoft's Azure/durabletask GitHub repository with config files that execute a credential-harvesting payload the moment a developer opens the repo in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code, triggering GitHub to disable 73 Microsoft repositories including Azure/functions-action. Two days later the Hades variant dropped 37 malicious PyPI wheels across 19 packages using Python .pth startup hooks to run a Bun-powered credential stealer on every interpreter launch, with Socket tracking 448 affected artifacts across npm and PyPI. Details →First reported github.com
GitHub - davidmatousek/tachi: Threat modeling and AI-reasoning vulnerability detection harness for Claude Code — STRIDE + AI + MAESTRO
Tachi is an open-source GitHub project by davidmatousek providing a threat-modeling and AI-reasoning vulnerability detection harness for Claude Code, combining STRIDE, AI-specific, and MAESTRO threat frameworks. The repo references OWASP Top 10 for LLM and Agentic Applications and is actively developed with numerous releases. Details →First reported ainowinstitute.org
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
The AI Now Institute published an exploit brief and PoC (GitHub: Boyan-MILANOV/friendly-fire-ai-agent-exploit) demonstrating remote code execution against Anthropic's Claude Code CLI (auto-mode) and OpenAI's Codex CLI (auto-review) when these defensive coding agents are used to assess third-party or open-source libraries. The attack embeds prompt injections across a library's source code to hijack the AI agent, requiring no hooks, skills, plugins, MCP servers, or config files as an injection vector. Details →First reported 0din.ai
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review. Details →First reported openaca.dev
Your Agent Risk Isn't in One Plugin. It's in the Composition.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure. Details →First reported originhq.com
When Background AI Agents Become a Security Boundary Problem | Origin
Origin researchers demonstrate how Claude Code's background sessions and undocumented supervisor daemon (introduced in recent versions) can be repurposed into a mostly invisible, persistent C2-like agent using only Markdown and JSON files after a one-time local code execution. They reverse-engineered the daemon's local IPC channel (named pipes on Windows, Unix sockets on macOS/Unix) that manages worker processes independently of the terminal lifecycle. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector