First reported jetico.com
Lead dispatch
First reported · updated · 2 reports island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github
Severity
0.78
The wire · latest
First reported · updated · 2 reports kodemsecurity.com
LLM Security Testing: OWASP Top 10 Guide 2026
Openlayer's guide summarizes the 2025 OWASP Top 10 for LLM applications, explaining why LLM systems need dedicated security testing and detailing risk categories such as prompt injection, excessive agency, system prompt leakage, poisoned vector stores, unbounded consumption, and vector/embedding weaknesses. It argues that static code analysis and CVE scanning miss inference-time attacks and that agentic systems require session-level testing, while mapping OWASP results to EU AI Act obligations and promoting Openlayer's coverage. Details →First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported · updated · 6 reports thehackernews.com
Identity Lifecycle Management Wasn't Built for AI Agents
The Hacker News guide argues that traditional identity lifecycle management (IGA) tools were architected for human employees with HR records, managers, and departure dates—assumptions that break down for autonomous AI agents acting as non-human principals. The piece outlines where the human-centric governance model develops structural blind spots and what extending it to AI agents actually requires. Details →First reported thehackernews.com
AI Agents Act Like Employees With Root Access—Here's How to Regain Control
A Hacker News sponsored article argues that enterprise AI agents and LLM copilots behave like junior employees with root access and no oversight, creating new identity edges and risk unless identity and device posture are enforced. The piece frames an identity-first, zero-trust approach to securing native and third-party AI deployments. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported theregister.com
Infosec professionals sour on automated pentesting tools
A Register report on Cobalt's 2026 State of Pentesting survey (450 respondents) finds support for fully automated pentesting collapsing from 29% to 9%, largely because automated scanners miss AI-specific flaws like prompt injection and excessive agency that require creative, multi-turn adversarial testing. Cobalt also reports 32% of vulnerabilities in AI/LLM environments are high or critical severity, versus 12% in traditional environments. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector