First reported youtube.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 2 reports screetsec.com
Maland | Another Cursor 0-day Enabling Arbitrary Code Execution Beyond Git.exe
Cursor 3.0.0 patches CVE-2026-48124, a class of sandbox-to-host code execution weaknesses affecting AI coding agents including Cursor, OpenAI Codex CLI, Google Gemini CLI, and Antigravity, where files written by a sandboxed agent are later consumed and executed by trusted host tooling (extensions, task runners, Git integrations, Docker). Related research by Mindgard and others details a Windows binary-planting flaw where opening a repository auto-executes a malicious git.exe planted at the repo root, yielding zero-click arbitrary code execution with no prompt injection or model in the loop. Details →First reported · updated · 3 reports pillar.security
ChainDrop: When Opening a Repository Becomes Execution
Researchers (Novee Security and Pillar Security's "ChainDrop") disclosed critical flaws in the GitHub Actions-based coding agents shipped by Anthropic (Claude Code), Google (Gemini CLI) and OpenAI (Codex), where a single zero-privilege input such as a GitHub issue or opening a repository triggers indirect prompt injection leading to remote code execution on the vendor's own runner, exfiltration of live API keys and GITHUB_TOKEN, persistent agent hijacking, and downstream supply-chain compromise (Gemini CLI rated CVSS 10.0). Multiple CVEs (e.g. CVE-2026-54316, CVE-2026-12537, CVE-2026-50522) and vendor security advisories were issued, but the report warns thousands of public repos running default configs remain exposed. Details →First reported · updated · 2 reports pillar.security
The Week of Sandbox Escapes
Pillar Security researchers (Eilon Cohen, Dan Lisichkin, Ariel Fogel) published 'The Week of Sandbox Escapes,' demonstrating seven ways to break out of the sandboxes in four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — without attacking the sandbox directly. A prompt injection planted in a README, issue, dependency, or diff drives the sandboxed agent to write workspace files (e.g. a .claude hook config, a virtualenv interpreter, or Git fsmonitor metadata) that trusted tools running outside the sandbox later execute, achieving host command execution; one Cursor issue is tracked as CVE-2026-48124 and fixed in v3.0.0. Details →First reported · updated · 2 reports stepsecurity.io
Miasma Supply Chain Attack: Azure Hit, 73 Repos Down, 37 PyPI Wheels
The Miasma supply-chain worm campaign expanded to poison Microsoft's Azure/durabletask GitHub repository with config files that execute a credential-harvesting payload the moment a developer opens the repo in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code, triggering GitHub to disable 73 Microsoft repositories including Azure/functions-action. Two days later the Hades variant dropped 37 malicious PyPI wheels across 19 packages using Python .pth startup hooks to run a Bun-powered credential stealer on every interpreter launch, with Socket tracking 448 affected artifacts across npm and PyPI. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector