Skip to content

The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported yesterday island.io

AgentBaiting: How Fake AI Skills Deliver Malware at Scale

Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.

supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot

Read the full dispatch Query the index

0.75

The wire · latest

CLASS

All Threats News Research Analysis Tools

TAGS

indirect-prompt-injection tool-abuse supply-chain data-exfiltration

More filters

TYPE

incident research advisory analysis

STATUS

In the wild PoC Disclosed Patched

Filtering

First reported 2d ago nx.dev

S1ngularity - What Happened, How We Responded, What We Learned

Nx's postmortem details the S1ngularity incident of August 26, 2025, in which attackers exploited a GitHub Actions injection vulnerability to steal an NPM publishing token and push malicious versions of several Nx packages. The malware ran a post-install script that scanned systems for sensitive data, notably attempting to abuse locally installed AI CLI tools like Claude and Gemini, and exfiltrated results to public GitHub repositories via the GitHub CLI.

First reported 17 Jul infosecwriteups.com

Google fixing Android lock screen bug that lets Gemini send SMS without a PIN

Google is fixing an Android 16 lock screen bypass in which Gemini, accessible from the lock screen, can be tricked into sending SMS and WhatsApp messages without a PIN. Pressing Gemini's "Continue" prompt simultaneously with its "Add attachment" button lets an attacker with physical access dispatch messages and re-enable Gemini's access to previously disconnected apps, all while the device stays locked.

First reported 16 Jul github.com

GitHub - geno2009/Evil-Gemini-v1: Evil Gemini v1 - Jailbreaked Gemini 2.5 Flash

A GitHub repository named 'Evil-Gemini-v1' by user geno2009 is published as a jailbreak of Google's Gemini 2.5 Flash model, framed as an 'Evil Gemini' variant that removes the model's safety restrictions. The available page content shows only GitHub navigation boilerplate, with no detailed technical mechanism, README, or evaluation exposed.

See the API docs to pull all 342 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI Threats AI Security Research Agentic AI Security Tools Prompt Injection Tool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

GET /feed.xml — RSS 2.0, every item
GET /api/items — read-only

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

GET /api/items?tags=&minSeverity=&itemType=
GET /api/search?q= — keyword
GET /api/semantic?q= — vector

Preview semantic search