The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported · updated · 2 reports island.io

AgentBaiting: How Fake AI Skills Deliver Malware at Scale

The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.
In the wild

supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github

Read the full dispatchQuery the index
Severity
0.78

The wire · latest

CLASS
AllThreatsNewsResearchAnalysisTools
TAGS
indirect-prompt-injectiontool-abusesupply-chaindata-exfiltration
More filters
TYPE
incidentresearchadvisoryanalysis
STATUS
In the wildPoCDisclosedPatched
Filteringcontext-poisoning ×Clear all

First reported · updated · 2 reports asset-group.github.io

We put the exploit in a picture. Your AI code reviewer never opens it.

Researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrated 'Ghostcommit,' an attack that hides malicious prompt-injection instructions inside a PNG image so AI code reviewers (CodeRabbit, Cursor Bugbot) never see them. A benign-looking AGENTS.md convention file points to build-spec.png, whose rendered text instructs a coding agent to read the repo's .env byte-by-byte and emit the secrets as an integer tuple; the payload sits dormant until an unrelated agent session triggers exfiltration. A proof-of-concept is published on GitHub and the findings were disclosed to affected vendors.
PoCresearchprompt-injectionindirect-prompt-injectiondata-exfiltrationsupply-chaincontext-poisoningai-agentsllmcoding-agentcode-reviewcoderabbitcursor-bugbot
Details →

First reported adversa.ai

Solving GitHub’s Secure Code game with an AI red teaming agent

Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust.
researchprompt-injectionindirect-prompt-injectiontool-abusecontext-poisoningconfused-deputyai-agentsmcpllm
Details →
See the API docs to pull all 357 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI ThreatsAI Security ResearchAgentic AI Security ToolsPrompt InjectionTool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

  • GET /api/items?tags=&minSeverity=&itemType=
  • GET /api/search?q= — keyword
  • GET /api/semantic?q= — vector
Preview semantic search