First reported · updated · 3 reports darkreading.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported arxiv.org
Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection
A research paper, "Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection" (arXiv:2607.24174) by Landauer et al., presents a framework for crafting adversarial log entries that inject instructions into system logs processed by LLMs in SOC workflows. Their evaluation across multiple state-of-the-art LLMs shows injected log traces containing clear indicators of compromise can be misclassified as benign, though the authors note the models' own generated explanations often reveal signs of adversarial manipulation that could be used for detection. Details →First reported openreview.net
Defending FCG-based Malware Detectors Against Metamorphic Android Variants via LLM-Powered Code Refactoring
A research paper (ACL ARR 2026 submission) introduces FCGA, a framework that uses LLMs to synthesize code augmentations for training function-call-graph-based Android malware classifiers, hardening them against LLM-rewritten metamorphic malware variants. The authors report that graph-based detectors enriched with LLM features drop over 60% in accuracy against LLM-rewrite attacks, and FCGA improves robustness by up to 8% over baselines. Details →First reported arxiv.org
ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments
ALIBI is an automated adaptive black-box attack framework that evades LLM-based vulnerability detectors by inserting adversarial source-code comments that steer detector reasoning or fabricate external tool results without changing program behavior. Evaluated against four detectors including frontier multi-agent systems, it achieves attack success rates exceeding 90% across 125 real-world null-pointer dereference vulnerabilities, reaching 100% on one system, while prompt-level defenses offer limited robustness. Details →First reported tomshardware.com
New malware campaign tricks AI scanners with fake nuclear weapon prompts — malicious code triggers safety failsafes so scanners skip the payload
A malware campaign reportedly named Hades injects text referencing biological and nuclear weapons into its code to trigger the safety failsafe mechanisms of AI-based malware scanners, causing the scanners to halt analysis before reaching the actual malicious payload. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector