First reported · updated · 6 reports thehackernews.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported microsoft.com
AI agent shared responsibility model - Microsoft Azure | Microsoft Learn
Microsoft's Azure documentation presents an "AI agent shared responsibility model" that describes how autonomous agents differ from request/response LLMs—acting autonomously via tools and APIs, holding persistent memory, carrying distinct identities, and composing with other agents—and maps the resulting governance responsibilities. It flags top agentic risks such as prompt injection that drives actions, excessive agency, and confused-deputy scenarios across SaaS and self-hosted deployment models. Details →First reported · updated · 2 reports aaif.io
The Anatomy of MCP Authorization: How the Hardened Flow Actually Runs - Agentic AI Foundation (AAIF)
An explainer from the Agentic AI Foundation walks through the MCP authorization flow under the 2026-07-28 spec revision, framed as a security-hardening pass that codifies fixes for audience confusion and confused-deputy failures. It maps the OAuth 2.1 roles (MCP client, MCP server as resource server, authorization server, and resource owner) and traces a cold-start token flow step by step against the hardened spec requirements. Details →First reported daily.dev
Otto Support - The Confused Deputy
Bishop Fox's otto-support CTF demonstrates confused deputy attacks against AI agents, where an agent reads attacker-controlled content (a poisoned support ticket, email, or calendar invite) and executes hidden instructions using its own legitimate privileges. The write-up reproduces the scenario via IDOR-based ticket poisoning and metadata service abuse to escalate into a support-agent role, referencing real-world cases like EchoLeak, ConfusedPilot, and Copilot calendar exploits, and proposes mitigations such as data/instruction separation, per-task tool registration, least privilege, human-in-the-loop, and egress controls. Details →First reported · updated · 2 reports medium.com
Don’t Let Your Agent Mess Up Your Database | by MCP Toolbox for Databases | Google Cloud - Community
MCP Toolbox for Databases (github.com/googleapis/genai-toolbox), a Google-published MCP server, introduces URL Parameter Binding, a feature that lets developers hardcode sensitive connection parameters into the URL so they remain outside the LLM's reach, mitigating confused-deputy attacks where an agent could be manipulated into unauthorized database actions. Details →First reported arxiv.org
From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications
A research paper by Spiros Tsigkopoulos and Christoforos Ntantogian introduces "LLM-mediated web attacks," a class where attacker-controlled input is transformed by an LLM-integrated application and then reaches traditional web-app sinks, systematized as LLM2X variants (LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2CSRF, LLM2XXE, LLM2SSRF). The authors implement TicketOracle, a Flask-based LLM-integrated app, to evaluate LLM2SSRF across five scenarios and seven LLMs, finding substantial model-specific variation in susceptibility. Details →First reported · updated · 3 reports manifold.security
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
Manifold Security disclosed a confused-deputy flaw in Microsoft's official Azure DevOps MCP server where a tool returning pull request descriptions lacked the prompt-injection guardrail applied to other tools, letting a hidden PR comment inject instructions into a reviewer's AI coding agent. The agent then acts with the user's own permissions, reaching projects the attacker cannot access and quietly exfiltrating what it finds; Microsoft addressed it in a fix (v2.8.0). Details →First reported · updated · 2 reports nhimg.org
Who is accountable when an AI agent triggers code execution through a trusted tool?
An NHIMG editorial FAQ argues that accountability for an AI agent triggering code execution through a trusted tool sits with the teams that defined the tool's trust boundary, approval model, and runtime policy, not just whoever deployed it. It frames agentic risk as a governance and identity problem, offering a checklist for evaluating execution paths (identity presented, static vs context-aware access, credential lifetime, file/process write capability, and approval scope) and references OWASP Agentic Top 10, NIST AI RMF, and the CSA MAESTRO framework. Details →First reported · updated · 2 reports modelcontextprotocol.io
Security Best Practices
The official Model Context Protocol security best practices document catalogs attack vectors and mitigations for MCP implementations, including the confused deputy problem in MCP proxy servers that connect to third-party APIs via OAuth. It describes how static client IDs, dynamic client registration, and consent cookies can be combined to obtain authorization codes without user consent, and references OAuth 2.0 and SSRF prevention guidance. Details →First reported cyberfortify.co
MCP & AI Agent Security Testing
CyberFortify's explainer on MCP and AI agent security testing lays out the agentic attack surface: excessive agency, prompt injection that reaches tool calls, tool/MCP-server poisoning, confused-deputy abuse, credential exposure, and lack of human-in-the-loop. The piece recommends least-privilege tools, authorization enforced inside each tool, human approval for high-impact actions, and vetted MCP servers, mapping the risks to the OWASP LLM Top 10. Details →First reported owasp.org
MCP Security - OWASP Cheat Sheet Series
The OWASP MCP Security Cheat Sheet catalogs the attack surface introduced by Anthropic's Model Context Protocol, which lets LLM agents dynamically invoke external tools. It enumerates key risk classes—tool poisoning, rug pull attacks, tool shadowing/cross-origin escalation, confused deputy, data exfiltration via legitimate channels, over-scoped tokens, supply chain attacks, message tampering/replay, and sandbox escapes—alongside best practices such as least privilege and scoped per-server credentials. Details →First reported · updated · 2 reports arxiv.org
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime). Details →First reported · updated · 4 reports sentia.community
The Confused Deputy with a Chat Window: Why AI Agents Are Exposing the Security Checks Enterprises Never Wrote – The Sentia AI Community
An explainer from the Sentia AI Community argues that autonomous, write-enabled LLM agents connected to production APIs re-introduce the classic 'confused deputy' problem: because an agent's interface is natural language, it lacks a native, cryptographic way to verify who authorized a given instruction, so untrusted input can drive privileged actions. The piece frames this as a structural gap in enterprise security models built around implicit human judgment and static perimeter API controls. Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →First reported falshaw.de
Prompt Injection Is a Confused-Deputy Problem We Already Solved
Nick Falshaw argues that indirect prompt injection against AI agents is a classic confused-deputy problem — a trusted agent with real authority tricked into misusing it by attacker-supplied content it cannot distinguish from legitimate instructions — and that it cannot be fixed by making models smarter, only contained with network-security-style boundaries. The piece draws on a 2026 study (arXiv:2605.17634) finding direct prompt injection succeeded over 79% of the time against browser agents and Simon Willison's 'lethal trifecta' framing. Details →First reported stackoverflow.blog
AI agents are a confused deputy with the keys to your kingdom
A Stack Overflow analysis frames LLM agents as inherent 'confused deputies' that wield real privileges on behalf of less-privileged requesters, using a described Meta AI support-assistant account-takeover to illustrate how agents carry out permitted operations without verifying who is authorized. It argues agents cannot reliably separate instructions from data, making indirect prompt injection via ingested content the dominant class of agent attack. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector