First reported arxiv.org
Lead dispatch
First reported · updated · 2 reports island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github
Severity
0.78
The wire · latest
First reported youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP
A recorded EC-Council CyberTalks webinar by Salesforce Product Security Principal Jason Ross covers data poisoning attacks against machine learning and agentic AI systems, walking through the ML lifecycle attack surface, AI supply-chain risks (including Hugging Face attacks and sleeper-agent backdoors), RAG embedding-database poisoning, cascading poisoning, and MCP exploitation examples such as GitHub and WhatsApp MCP abuse. The session also outlines mitigation strategies including secure data sourcing, validation, monitoring, and governance frameworks. Details →First reported medium.com
Security as Code: AI Agent Security — Poisoned Weights and the Supply Chain You Can’t Scan (Part 3 of 3) | by Vitaliy Zhhuta | Jul, 2026
Part 3 of a 'Security as Code' series by Vitaliy Zhhuta examines AI model supply-chain risk, using an illustrative scenario in which a deleted Hugging Face namespace is re-registered by an attacker and a poisoned 'v2.1' model with clean safetensors format passes CI while carrying a behavioral backdoor. The piece argues that statistical backdoors — weights trained to silently alter behavior on trigger phrases — cannot be detected by malware scanners and have no CVE. Details →First reported aclanthology.org
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks
MM-PoisonRAG is a research paper presenting local and global knowledge poisoning attacks against multimodal retrieval-augmented generation (RAG) systems used by multimodal large language models (MLLMs). The work shows how injecting poisoned entries into the retrieval knowledge base can manipulate MLLM outputs, exploiting RAG's reliance on retrieved external content. Details →First reported firetail.ai
LLM08: Vector & Embedding Weaknesses - FireTail blog posts
FireTail's blog explains OWASP LLM08: Vector and Embedding Weaknesses, covering risks such as unauthorized access, cross-context information leaks, embedding inversion attacks, data poisoning, and behavior alteration in RAG systems that use vector databases. The post lists mitigation techniques including access control, data validation, source authentication, and monitoring. Details →First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results. Details →First reported dailyjus.com
Prompt Injection: Are Invisible Instructions the Next AI Risk in Disputes? – Daily Jus by Jus Mundi
Legal analysts at Greenberg Traurig examine prompt injection as an emerging AI risk in legal disputes, describing how hidden instructions embedded in documents can manipulate AI tools that ingest them into producing skewed or incomplete outputs. The piece contrasts this with AI hallucinations and notes a court has already dealt with the issue. Details →First reported aicerts.ai
Undetectable AI Model Backdoors Imperil Neural Security
AI CERTs News synthesizes cryptography research on undetectable AI model backdoors, citing Goldwasser et al. (FOCS 2022) on computationally undetectable injections, NeurIPS 2024 work on obfuscated releases, and Sparse Backdoor constructions reducible to Sparse PCA. It argues that outsourced training, checkpoint marketplaces, and prebuilt adapters let attackers embed triggers that survive static scans, and cites benchmark claims of near-100% trigger activation in tool-using language models. Details →First reported arxiv.org
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
CareAttack is a model-centric attack framework that edits the parameters of open-source dense retrievers (Qwen3-Embedding-0.6B and BGE-M3) to promote malicious passages into the top-k retrieved evidence of RAG systems, bypassing detectable corpus-manipulation approaches. Evaluated on three benchmark datasets, it uses conflict-aware retriever editing and attack-preserving anchor repair to inject malicious knowledge for batches of target prompts while preserving behavior on non-target prompts; code is published. Details →First reported acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR 2026 paper introduces D-SCAN (Document-level Signal Collapse Analysis), a lightweight detection framework that identifies RAG poisoning attacks by monitoring 'Attention Collapse' — a drop in attention entropy as the generator concentrates on injected adversarial documents. The authors show that output-side signals like perplexity fail because poisoned outputs can exhibit false confidence with even lower perplexity than benign ones, and that D-SCAN detects attacks even when they do not alter the final answer. Code is available at github.com/yingtaoren/D-Scan. Details →First reported arxiv.org
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
A research paper by Gulshan Saleem and colleagues presents a three-layer middleware framework to defend RAG-based chatbots against both direct and indirect prompt injection, combining input screening, a provenance-based instruction hierarchy during context assembly, and output auditing. Evaluated on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B, the framework reduced Attack Success Rate from 71.4% to 11.3% while maintaining a 4.8% false positive rate and 61.2 ms median latency overhead. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector