First reported youtube.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported arxiv.org
Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems
Researchers at Tampere University present Trustworthy RAG, an Evaluation Agent middleware that detects knowledge poisoning and misinformation in Retrieval-Augmented Generation systems by combining Natural Language Inference factual verification, a five-signal poison detector, and a Trust Index scoring formula. On TruthfulQA with Llama 3.3 70B the agent reaches 91% accuracy and 100% recall on instruction injection, though subtle in-place entity swaps remain hard to detect; the authors release the approach, an attack generator, and experimental artifacts at github.com/GPT-Laboratory/TrustworthyRAG. Details →First reported hardshell.ai
AI Data Security Guides
Hardshell's AI Data Security Guides is an index of reference material on how enterprise AI systems leak data at the retrieval layer, covering secure RAG, data poisoning, training data leakage, and AI data pipeline security. Each guide maps failure modes to controls and standards (NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, MITRE ATLAS) and links deeper dives, checklists, and a RAG leakage self-test. Details →First reported · updated · 2 reports aclanthology.org
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks
MM-PoisonRAG is a research paper presenting local and global knowledge poisoning attacks that disrupt multimodal retrieval-augmented generation (RAG) in multimodal large language models (MLLMs). The work demonstrates how MLLMs' reliance on retrieval exposes them to poisoned knowledge injected into the retrieval corpus, manipulating generated outputs. Details →First reported · updated · 3 reports youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP - YouTube
An explainer on AI data poisoning describes how attackers corrupt the data a model learns from, fine-tunes on, or retrieves — including training data, alignment data, and RAG knowledge bases — so a poisoned model behaves as the attacker intends while passing ordinary validation. It distinguishes data poisoning from prompt injection, jailbreaking, evasion, and model poisoning, and notes research (e.g. Carlini et al.'s web-scale poisoning work) showing under 1% poisoned data can measurably change behavior, recommending provenance, access control, monitoring, and rollback as layered defenses. Details →First reported utimaco.com
Data Poisoning: Protect AI from Manipulated Data
A Utimaco blog post discusses data and model poisoning as integrity attacks against RAG and training pipelines, citing OWASP's classification of manipulation of pre-training, fine-tuning, and embedding data. The piece argues for verifying data integrity before inference using cryptographic digital signatures and HSM-protected signing keys, framed around Utimaco's General Purpose HSM offering. Details →First reported arxiv.org
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
The paper "Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection" presents RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization. Experiments on CIC-UNSW-NB15 show recovery under knowledge poisoning and reduced label-flip success under prompt injection when using multi-document retrieval. Details →First reported · updated · 5 reports paloaltonetworks.com
What Is Data Poisoning? [Examples & Prevention]
Palo Alto Networks' Cyberpedia entry explains data poisoning against AI/ML systems: how attackers corrupt training data to manipulate model behavior, the different attack types, where poisoning occurs in the pipeline, its distinction from prompt injection, and defensive measures. The page is an evergreen reference/glossary entry rather than a report of a specific incident or new finding. Details →First reported youtube.com
How LLMs Get Hacked: Top 10 Enterprise AI Attacks and Defenses #aisecurity #cybersecurity
A TedShark Labs YouTube video walks through the top 10 enterprise LLM attack classes — including direct and indirect prompt injection, sensitive information disclosure, supply chain risks (HuggingFace, SBOMs), RAG data/model poisoning, improper output handling (XSS/SSRF), excessive agency, system prompt leakage, embedding weaknesses, hallucination, and unbounded consumption — and recommends defenses like AI gateways, DLP filters, and zero trust controls. Details →First reported · updated · 2 reports acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse. Details →First reported arxiv.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
Researchers from University of Technology Sydney and collaborators present D-SCAN (Document-level Signal Collapse Analysis), a lightweight framework that detects RAG poisoning attacks by monitoring an internal signature they call 'Attention Collapse'—where a generator's attention entropy decreases and concentrates on injected adversarial documents. The paper shows that output-side signals like perplexity fail because poisoned outputs can exhibit lower perplexity (false confidence), and that D-SCAN can detect attacks even when they do not alter the final answer, with code released on GitHub. Details →First reported oracle.com
Securing AI agents through platform controls and shared responsibility | cloud-infrastructure
Oracle's blog post discusses securing AI agents in enterprise SaaS workflows through platform controls and a shared-responsibility model, describing how agents that retrieve data, call tools, and trigger business processes must be governed. It references emerging AI-security standards (ISO/IEC 42001, ISO/IEC FDIS 27090, CEN/CENELEC) and a converging threat taxonomy including data poisoning, evasion, model inversion, model extraction, prompt injection, and agent/tool abuse. Details →First reported arxiv.org
When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG
Researchers present TabooRAG, a blocking attack against Retrieval-Augmented Generation systems that exploits what they call 'alignment homogeneity'—shared refusal criteria across safety-aligned LLMs—to craft poisoned documents that cause models to refuse benign queries. Rather than injecting instructions, TabooRAG builds query-relevant risk context in a surrogate environment and transfers it to unknown target systems, achieving state-of-the-art attack success across nine LLMs and three datasets with a 67.3% relative gain over baselines even after prompt-injection filtering. Details →First reported icml.cc
ICML Poster Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
"Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors," an ICML 2026 poster by Yen-Shan Chen and colleagues, presents a RAG data-poisoning technique that uses transferable attention-steering "attractors" to manipulate retrieval-augmented generation systems. The abstract is truncated, but the work is framed as a scalable, transferable poisoning attack against RAG pipelines. Details →First reported intigriti.com
RAG and ruin: why your existing controls may miss AI poisoning attacks
An Intigriti blog post titled "RAG and ruin: why your existing controls may miss AI poisoning attacks" discusses how retrieval-augmented generation (RAG) systems can be compromised through data/knowledge-base poisoning, and argues that traditional security controls fail to detect such AI-specific poisoning attacks. Details →First reported · updated · 9 reports kodemsecurity.com
OWASP Top 10 LLM & Gen AI Vulnerabilities in 2026
Bright Defense publishes an explainer walking through the OWASP Top 10 LLM and generative-AI vulnerabilities (prompt injection, sensitive information disclosure, supply chain risks, data/model poisoning, improper output handling, excessive agency, system prompt leakage, vector/embedding weaknesses, misinformation, and unbounded resource consumption), giving each category a description, sample attack scenario, and mitigation guidance. The piece is reference material synthesizing the OWASP framework rather than reporting a specific incident or presenting new findings. Details →First reported jfrog.com
SQLite Critical CVEs or LLM Slop? - JFrog Security Research
JFrog security researchers found that a batch of six critical- and high-rated SQLite CVEs (plus 50+ others covering libraw and ESP32-audioI2S) published by a new GitHub repo 'programmervuln/cveadvisory-' were bogus and appear to be LLM-generated 'slop'; the advisories cited non-existent functions and unrelated source lines, and their proof-of-concept payloads triggered no crashes when tested under AddressSanitizer. The fake reports nonetheless flowed into NVD with CISA enrichment before MITRE rejected the repo, exposing weaknesses in a CVE pipeline that operates largely on the honor system while NIST's NVD backlog exceeds 27,000 records. Details →First reported github.com
GitHub - adithyan-ak/AgentHound: Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
AgentHound is an open-source offensive security framework for AI agent infrastructure, described as "BloodHound for the agentic stack." The tool performs reconnaissance, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. Details →First reported arxiv.org
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
A paper by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber formalizes 'self-state attacks,' in which a self-hosted AI agent is compromised by corruption of its own memory and configuration files via legitimate OS system calls. The authors characterize a four-axis attack space rendered as a 23-cell matrix with 43 concrete file operations, evaluate a layered OS-level defense against injected activity traces, and find that four attack cells (concentrated on memory-file writes) remain structurally indistinguishable at the OS level. Details →First reported firetail.ai
LLM08: Vector & Embedding Weaknesses - FireTail blog posts
FireTail's blog explains OWASP LLM08: Vector and Embedding Weaknesses, covering risks such as unauthorized access, cross-context information leaks, embedding inversion attacks, data poisoning, and behavior alteration in RAG systems that use vector databases. The post lists mitigation techniques including access control, data validation, source authentication, and monitoring. Details →First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results. Details →First reported dailyjus.com
Prompt Injection: Are Invisible Instructions the Next AI Risk in Disputes? – Daily Jus by Jus Mundi
Legal analysts at Greenberg Traurig examine prompt injection as an emerging AI risk in legal disputes, describing how hidden instructions embedded in documents can manipulate AI tools that ingest them into producing skewed or incomplete outputs. The piece contrasts this with AI hallucinations and notes a court has already dealt with the issue. Details →First reported aicerts.ai
Undetectable AI Model Backdoors Imperil Neural Security
AI CERTs News synthesizes cryptography research on undetectable AI model backdoors, citing Goldwasser et al. (FOCS 2022) on computationally undetectable injections, NeurIPS 2024 work on obfuscated releases, and Sparse Backdoor constructions reducible to Sparse PCA. It argues that outsourced training, checkpoint marketplaces, and prebuilt adapters let attackers embed triggers that survive static scans, and cites benchmark claims of near-100% trigger activation in tool-using language models. Details →First reported arxiv.org
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
A research paper by Gulshan Saleem and colleagues presents a three-layer middleware framework to defend RAG-based chatbots against both direct and indirect prompt injection, combining input screening, a provenance-based instruction hierarchy during context assembly, and output auditing. Evaluated on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B, the framework reduced Attack Success Rate from 71.4% to 11.3% while maintaining a 4.8% false positive rate and 61.2 ms median latency overhead. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector