Skip to content

The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported 21 Jul · updated 29 Aug · 3 reports embracethered.com

AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.

indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide

Read the full dispatch Query the index

0.85

The wire · latest

CLASS

All Threats News Research Analysis Tools

TAGS

indirect-prompt-injection tool-abuse supply-chain data-exfiltration

More filters

TYPE

incident research advisory analysis

STATUS

In the wild PoC Disclosed Patched

Filtering

First reported 29 Jul acm.org

Evolva: A Multi-turn Contextual Attack for Long-Reasoning LLMs | Knowledge Science, Engineering and Management

Evolva is a research jailbreak framework that formalizes multi-turn prompt attacks as a multi-stage structured process, using auxiliary LLMs to build hierarchical, progressively complex prompt sequences that inject adversarial context across dialogue rounds to bypass prompt-level safety controls on long-reasoning LLMs. The authors introduce an Attack_Robust metric and evaluate several state-of-the-art models on REDTask, a red-teaming dataset for multi-turn adversarial prompting, reporting that Evolva outperforms prior approaches.

First reported 19 Jul arxiv.org

The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection

The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results.

See the API docs to pull all 954 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI Threats AI Security Research Agentic AI Security Tools Prompt Injection Tool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

GET /feed.xml — RSS 2.0, every item
GET /api/items — read-only

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

GET /api/items?tags=&minSeverity=&itemType=
GET /api/search?q= — keyword
GET /api/semantic?q= — vector

Preview semantic search