The Wire.AI Security News and Incident Tracker

Lead dispatch

First reported · updated · 3 reports embracethered.com

AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection

Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.
Patched

indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide

Read the full dispatchQuery the index
Severity
0.85

The wire · latest

CLASS
AllThreatsNewsResearchAnalysisTools
TAGS
indirect-prompt-injectiontool-abusesupply-chaindata-exfiltration
More filters
TYPE
incidentresearchadvisoryanalysis
STATUS
In the wildPoCDisclosedPatched
Filteringide ×Clear all

First reported · updated · 5 reports mindgard.ai

Amazon Kiro: AI Is Breaking Vulnerability Disclosure Processes

Mindgard disclosed a prompt-injection vulnerability in Amazon Kiro, an AI-powered agentic IDE, that lets attacker-controlled repository content coerce the Kiro agent into reading local sensitive data, modifying a workspace URL, and triggering an outbound request that exfiltrates the secret. The flaw was reproduced in Kiro IDE 0.7.45 on Windows in both trusted and untrusted workspaces via Kiro Powers (MCP configs and POWER.md steering files); exploitation requires the user open a malicious workspace file and message the agent, and is assessed as low difficulty.
Patchedprompt-injectiondata-exfiltrationindirect-prompt-injectiontool-abuseai-agentsllmmcpidecopilot
Details →

First reported · updated · 2 reports pillar.security

The Week of Sandbox Escapes

Pillar Security researchers (Eilon Cohen, Dan Lisichkin, Ariel Fogel) published 'The Week of Sandbox Escapes,' demonstrating seven ways to break out of the sandboxes in four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — without attacking the sandbox directly. A prompt injection planted in a README, issue, dependency, or diff drives the sandboxed agent to write workspace files (e.g. a .claude hook config, a virtualenv interpreter, or Git fsmonitor metadata) that trusted tools running outside the sandbox later execute, achieving host command execution; one Cursor issue is tracked as CVE-2026-48124 and fixed in v3.0.0.
researchprompt-injectionsandbox-escapetool-abusecode-executionai-agentsllmcursorcodexgemini-cliantigravityide
Details →
See the API docs to pull all 954 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Agentic AI ThreatsAI Security ResearchAgentic AI Security ToolsPrompt InjectionTool Abuse

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

  • GET /api/items?tags=&minSeverity=&itemType=
  • GET /api/search?q= — keyword
  • GET /api/semantic?q= — vector
Preview semantic search