First reported checkpoint.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports splunk.com
SVD-2026-0808 | Splunk Vulnerability Disclosure
Splunk advisory SVD-2026-0808 discloses multiple vulnerabilities in Splunk apps including a critical (CVSS 9.1) remote code execution via untrusted-data deserialization (CVE-2026-76404) in the Splunk MCP Server app, plus several flaws in the Splunk AI Toolkit such as RCE in the Model Loading REST API (CVE-2026-76395), improper privilege management on agent run history (CVE-2026-76391), and missing authorization in container/connection management (CVE-2026-76394). Fixed versions are available for each affected app and add-on. Details →First reported · updated · 3 reports medium.com
AI Supply Chain Security in CI/CD Pipelines, a 2026 Playbook
"AI Supply Chain Security in CI/CD Pipelines, a 2026 Playbook" is an analysis piece synthesizing real AI model supply-chain threats, including JFrog's February 2024 discovery of 100+ malicious Hugging Face models exploiting Python pickle deserialization for remote code execution, later PickleScan zero-days that let attackers bypass detection, and malicious Jinja templates hidden in safetensors metadata. The playbook frames how defenders should govern trustworthy AI/model pipelines from data to deployment. Details →First reported barhum.ai
The Hidden Risks of Downloading and Running Open-Source LLMs Locally: Model Formats, Supply-Chain Attacks, and EDR Blind Spots
A Barhum.ai report maps the security attack surface of running open-source LLMs locally, arguing model files are executable artifacts: Python pickle formats (.pt/.pth/.bin) permit arbitrary code execution by design, PickleScan has been bypassed by zero-day vulnerabilities, and inference engines like Ollama have accumulated multiple critical CVEs. It notes CVE-2025-32434 (CVSS 9.3) showed torch.load() with weights_only=True was still exploitable, and highlights that EDR tools are architecturally blind to model-layer threats. Details →First reported · updated · 2 reports paloaltonetworks.com
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
Palo Alto Unit 42 (Ori Hadad) disclosed CVE-2026-0257, a flaw in Google's Vertex AI Python SDK (python-aiplatform) where model uploads relied on an attacker-predictable Google Cloud Storage bucket, enabling 'bucket squatting.' An attacker could pre-register the expected bucket and substitute a malicious pickle/joblib model artifact, achieving cross-tenant remote code execution when the poisoned model was deserialized. Google fixed the issue in SDK releases v1.148.0/v1.148.1. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector