First reported simonwillison.net
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported medium.com
Block AI from installing malicious npm packages
Prasanna Mestha describes a defensive tool built to sit between AI coding agents and the npm registry to block installation of malicious or hallucinated packages, framed around the slopsquatting threat. The write-up cites real cases including the phantom 'react-codeshift' package requested hundreds of times a day and an August campaign in which a single threat actor pushed over 700 AI-named malicious npm packages that deliver a cross-platform RAT via README instructions. Details →First reported perplexity.ai
Securing Agents Across Perplexity’s Client Endpoints with Numbat
Perplexity has open-sourced Numbat, an agent security suite for client endpoints (macOS, Linux, Windows) that detects, prevents, and investigates risky AI agent behavior. Numbat integrates with widely used client-side agent harnesses (e.g. CLI and desktop coding agents), enforces security rules, and provides agent-agnostic forensics to address incidents such as agents autonomously running with permissions bypassed via flags like --dangerously-skip-permissions and --yolo. Details →First reported arxiv.org
IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
IssueTrojanBench is a benchmark that systematically evaluates AI coding agents (Cursor, Claude Code, Codex Desktop, powered by GPT-5.3/5.4 and Sonnet 4.6) against malicious issue requests embedded as instructions, using four attack categories and six delivery vectors (e.g., PDFs, issue comments). The study finds 66.5% of malicious issues bypass all agent- and LLM-level guardrails, with rejection driven almost entirely by the LLM rather than the agent framework and agent-level defenses offering limited additional protection. Details →First reported snyk.io
Snyk VulnBench JS 1.0: LLM Bug Repeatability
Snyk VulnBench JS 1.0 is a benchmark study that ran 300 repeated vulnerability-finding scans to measure how repeatable an agentic LLM security review is on identical code, prompt, and harness. It found LLM findings unevenly repeatable: reference-matched findings were stable while extra-model reports varied widely, with nearly 50% of LLM-only reports appearing in just one of five identical scans, and the best LLM configuration reaching only 75.4% F1 against deterministic SAST. Details →First reported ainowinstitute.org
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
The AI Now Institute published an exploit brief and PoC (GitHub: Boyan-MILANOV/friendly-fire-ai-agent-exploit) demonstrating remote code execution against Anthropic's Claude Code CLI (auto-mode) and OpenAI's Codex CLI (auto-review) when these defensive coding agents are used to assess third-party or open-source libraries. The attack embeds prompt injections across a library's source code to hijack the AI agent, requiring no hooks, skills, plugins, MCP servers, or config files as an injection vector. Details →First reported 0din.ai
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector