First reported arxiv.org
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 3 reports wiz.io
Red Agent Exploits Snowflake Vuln Created by Copilot Autofix
Wiz's autonomous AI-powered "Red Agent" discovered and exploited a script injection vulnerability in Snowflake's snowflakedb/snowflake-connector-net GitHub Actions workflow, where opening a GitHub issue with a crafted title allowed an unauthenticated user to run arbitrary commands in the runner and exfiltrate Jira credentials. The flaw was inadvertently introduced days earlier by GitHub Copilot Autofix, which stripped a sanitized input pattern in favor of direct string interpolation; Snowflake patched it the same day it was reported (June 23, 2026) via its HackerOne program and rotated the exposed token. Details →First reported forcepoint.com
MCP Security: Data Exposure Risks and Controls [2026]
Forcepoint's blog argues that MCP security discussions overlook data exposure risks, noting that a single compromised MCP server can expose every credentialed system it connects to (Salesforce, M365, Slack, code repos, finance DBs). It cites 30+ CVEs filed against MCP servers between January and February 2026, command-injection prevalence, and the postmark-mcp package that silently added a hidden recipient to exfiltrate copies of AI-agent emails. Details →First reported securitycurated.com
Mobile AI Agent Security Flaws Enable Remote PC Hijacking
A study by security researchers found that popular open-source mobile AI agent frameworks — AppAgent, AppAgentX, and Mobile-Agent-v3 — are susceptible to nearly all tested attack vectors, including command injection and visual deception. Because the agents treat text and images read from a smartphone screen as direct commands without validating source or intent, a malicious app can trick the agent into performing unintended actions, and since agents often run on a host PC controlling the phone, attackers can gain full control of the victim's computer. Details →First reported feedly.com
CVE-2026-30623 - Exploits & Severity
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable. Details →First reported · updated · 2 reports arxiv.org
(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
Researchers from Simon Fraser University, CUHK, Shandong University, and QAX's Xingtu Lab (arXiv:2607.00333) demonstrated seven concrete attacks against five open-source mobile AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA—exploiting new attack surfaces in VLM-driven mobile agents. A malicious Android app with no special permissions can inject subliminal, human-invisible on-screen text that the agent's vision model reads, hijacking agent actions and chaining to arbitrary command execution on the host PC driving the agent. Each framework fell to at least six of the seven attacks; the authors report no evidence of the techniques being used outside a controlled setting and no CVEs are assigned. Details →First reported arxiv.org
FlowGuard: From Signals to Evidence for MCP Security Detection
FlowGuard is an evidence-grounded MCP security detection system that verifies execution-related risks (like command injection and file system access) through runtime evidence rather than suspicious semantic signals alone, and detects semantic risks in tool metadata and returned content. Evaluated on a 1,880-case executable benchmark across five vulnerability categories, it achieves F1 scores of 0.879 and 0.942 on Command Injection and File System Access, reduces latency up to 2.23x versus existing dynamic scanners, and reported 523 findings across 326 real-world servers. Details →First reported arxiv.org
A Security Analysis of the OpenClaw AI Agent Framework
Researchers detailed three now-patched high-severity flaws (GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, GHSA-575v-8hfq-m3mc; CVE-2026-46817, CVE-2026-55200) in the OpenClaw personal AI assistant framework that compose into a complete unauthenticated remote code execution path — from an LLM tool call triggered via a WhatsApp message to command execution on the host. The chain abuses OS command injection and an incomplete disallowed-input filter in the exec allowlist, whose closed-world lexical parsing is defeated by shell line continuation, busybox multiplexing, and GNU option abbreviation; a companion arXiv analysis taxonomizes 470 advisories and shows a malicious plugin skill bypassing the exec pipeline entirely. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector