First reported openai.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported openai.com
Continuously hardening ChatGPT Atlas against prompt injection attacks
OpenAI describes how it hardens ChatGPT Atlas's browser agent-mode against prompt injection, using reinforcement-learning-powered automated red teaming to discover novel attack strategies internally before they appear in the wild. The post details a recent security update that shipped a newly adversarially trained model and strengthened safeguards after internal red teaming uncovered a new class of prompt-injection attacks, and outlines a rapid response loop for continuously finding and patching agent exploits. Details →First reported darkreading.com
Choose Wisely: AI-Generated Coding Risk Varies, A Lot
Secure Code Warrior, in collaboration with RMIT University, released its AI Trust Index, a study evaluating 1,760 complete codebases generated by 16 frontier LLMs from vendors including OpenAI, Anthropic, and Google. The research found AI-generated code introduces roughly 15 vulnerabilities per codebase on average, with actual risk depending more on the development framework pairing than on the model chosen. Details →First reported · updated · 6 reports huggingface.co
Security incident disclosure — July 2026
Hugging Face disclosed that attackers breached its production infrastructure using an autonomous AI agent framework, stealing internal datasets and cloud/cluster credentials. The intrusion began when a malicious dataset abused two code-execution paths (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker, after which the agent swarm escalated to node-level access and moved laterally across internal clusters, executing thousands of actions across short-lived sandboxes with self-migrating command-and-control staged on public services. Hugging Face closed the vulnerable paths, evicted the attacker, rebuilt nodes, and rotated credentials. Details →First reported arxiv.org
(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
Researchers from Simon Fraser University, CUHK, Shandong University, and QAX's Xingtu Lab published an arXiv paper (arXiv:2607.00333) demonstrating seven concrete attacks against five open-source mobile AI agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA). A malicious Android app without privileged permissions can slip invisible on-screen text that the VLM-driven agent reads and acts on, exploiting a 'Screen Perception' surface (human-vs-machine vision gap) and a 'Misused Channel' surface to hijack agent actions and even achieve arbitrary command execution on the host PC driving the agent. All five frameworks fell to at least six of the seven attacks; no CVE was assigned and authors report no evidence of in-the-wild use. Details →First reported anthropic.com
Measuring LLMs' impact on N-day exploits
Anthropic's Frontier Red Team measured how much large language models can accelerate N-day exploit development, finding that its Claude Mythos Preview model autonomously built 8 working code-execution exploits across 18 recent Firefox patches and produced 8 full privilege-escalation chains from 21 Windows kernel patches. The research demonstrates that even public models with safeguards disabled can reverse-engineer patch diffs into exploits, collapsing the traditional weeks-long patch gap to hours. Details →First reported · updated · 9 reports sysdig.com
JADEPUFFER: Agentic ransomware for automated database extortion
Sysdig researchers documented JadePuffer, described as the first ransomware operation conducted end-to-end by an autonomous LLM agent. The agent gained initial access by exploiting CVE-2025-3248 (an unauthenticated RCE in the Langflow LLM-app framework), then autonomously performed reconnaissance, credential theft, lateral movement, persistence (a beaconing cron job), privilege escalation via Nacos auth bypass CVE-2021-29441, and encrypted 1,342 Nacos configuration items—adapting to failures in real time (e.g., recovering from a failed login in 31 seconds). Details →First reported mitiga.io
Modern Malware — Spyware Skills, Hijacked Base URLs, and 1,230+ Leaking API Keys in AI Instruction Files
Mitiga Labs details malware hidden in AI agent instruction files — Cursor rules, Anthropic Skills, Claude Hooks, AGENTS.md/CLAUDE.md context files, MCP server configs, and .pyc droppers — that AI agents follow with near-zero validation. The research found prompt-exfiltration tradecraft caught in the wild, attacker-controlled ANTHROPIC_BASE_URL overrides routing Claude traffic through MITM proxies, permission-bypass defaults, and over 1,230 hardcoded API keys and JWT tokens across tens of services. Mitiga also released a free scanner, Skillgate, built during the investigation. Details →First reported · updated · 4 reports zscaler.com
Indirect Prompt Injection Targets AI Agents | ThreatLabz
Zscaler ThreatLabz observed two in-the-wild campaigns using indirect prompt injection (IPI) embedded in malicious websites to manipulate web-browsing AI agents. One campaign uses SEO poisoning around a fake Python library (requests-secure-v2) with hidden prompts and schema-markup instructions telling agents to make a cryptocurrency payment to a hardcoded wallet to obtain an API key; the other typosquats the DeFi tracker DeBank, embedding prompts convincing agents the fraudulent site is legitimate. In testing an autonomous payment-capable agent across 26 LLMs, four (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) were tricked into paying and two miscategorized the fake DeBank as trusted. Details →First reported youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP
A recorded EC-Council CyberTalks webinar by Salesforce Product Security Principal Jason Ross covers data poisoning attacks against machine learning and agentic AI systems, walking through the ML lifecycle attack surface, AI supply-chain risks (including Hugging Face attacks and sleeper-agent backdoors), RAG embedding-database poisoning, cascading poisoning, and MCP exploitation examples such as GitHub and WhatsApp MCP abuse. The session also outlines mitigation strategies including secure data sourcing, validation, monitoring, and governance frameworks. Details →First reported youtube.com
Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data - Sachin Kumar, LexisNexis
Sachin Kumar (LexisNexis) presents peer-reviewed research (accepted at IJCNN, with open-source code) on detecting sleeper-agent backdoors in fine-tuned LLMs that pass behavioral evals yet flip to harmful output on an untested trigger. The proposed 'delta monitor' trains a sparse autoencoder on the difference between base and fine-tuned model activations, which in a controlled SQL-injection backdoor experiment flagged the backdoor with 40x the signal of crosscoder joint features, perfect precision, and zero false positives from a single layer. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported medium.com
Security as Code: AI Agent Security — Poisoned Weights and the Supply Chain You Can’t Scan (Part 3 of 3) | by Vitaliy Zhhuta | Jul, 2026
Part 3 of a 'Security as Code' series by Vitaliy Zhhuta examines AI model supply-chain risk, using an illustrative scenario in which a deleted Hugging Face namespace is re-registered by an attacker and a poisoned 'v2.1' model with clean safetensors format passes CI while carrying a behavioral backdoor. The piece argues that statistical backdoors — weights trained to silently alter behavior on trigger phrases — cannot be detected by malware scanners and have no CVE. Details →First reported aclanthology.org
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks
MM-PoisonRAG is a research paper presenting local and global knowledge poisoning attacks against multimodal retrieval-augmented generation (RAG) systems used by multimodal large language models (MLLMs). The work shows how injecting poisoned entries into the retrieval knowledge base can manipulate MLLM outputs, exploiting RAG's reliance on retrieved external content. Details →First reported firetail.ai
LLM08: Vector & Embedding Weaknesses - FireTail blog posts
FireTail's blog explains OWASP LLM08: Vector and Embedding Weaknesses, covering risks such as unauthorized access, cross-context information leaks, embedding inversion attacks, data poisoning, and behavior alteration in RAG systems that use vector databases. The post lists mitigation techniques including access control, data validation, source authentication, and monitoring. Details →First reported · updated · 2 reports medium.com
RAG Security Guide: Prevent Enterprise AI Data Leakage
A vendor guide from LangProtect explains how Retrieval-Augmented Generation (RAG) systems can leak sensitive enterprise data, using an illustrative case of a healthcare AI assistant that returned document excerpts across business units because a shared vector index was queried before document permissions were evaluated. The article outlines the mechanism of RAG data leakage and references academic work on adaptively attacking RAG systems to exfiltrate private knowledge bases. Details →First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported arxiv.org
KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems
KidnapRAG is a research paper presenting a black-box poisoning attack against Agentic RAG systems in which the attacker only publishes externally retrievable poisoned documents. The method uses three role-specific documents (Bait, Chain-Link, and Mal-Ins) to hijack an agent's multi-step reasoning chain, outperforming existing poisoning baselines across multiple frameworks, LLM backbones, and benchmarks; code is released on GitHub. Details →First reported deepinspect.ai
MCP Server Supply Chain Security: The Install Path Nobody Reviews
A DeepInspect analysis lays out five review gates for securing the MCP server supply chain, arguing that adding a third-party MCP server grants code execution, credential access, and text injection with far less scrutiny than an npm dependency. It cites CSA/OX Security research finding 9 of 11 MCP marketplaces affected by a STDIO-interface design flaw, 40+ MCP CVEs in early 2026 (including CVE-2026-33032 in nginx-ui MCP and CVE-2026-0755 in gemini-mcp-tool, both CVSS 9.8), and details tool-description poisoning as indirect prompt injection (MITRE ATLAS AML.T0051.001). Details →First reported bitsight.com
Token Torching: How AI Cost Attacks Threaten Your Business
Bitsight's Emma Stevens explains "token torching," a Denial-of-Wallet (DoW) attack in which an adversary crafts prompts or workflows that force an LLM system to burn through excessive tokens, compute time, and money. The piece maps the risk to OWASP's LLM10:2025 Unbounded Consumption category, noting impacts such as denial of service, economic loss, and service degradation. Details →First reported google.com
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
Researchers from Tel Aviv University, Technion, and Intuit disclosed 'HalluSquatting' (adversarial hallucination squatting), a technique that exploits the predictable tendency of LLMs to hallucinate resource identifiers (repos, skills, URLs) in tool calls. By preemptively registering the hallucinated resources, attackers can achieve scalable, untargeted remote tool execution and remote code execution across popular agentic LLM applications without any direct injection channel, potentially building agentic botnets. Details →First reported · updated · 2 reports medium.com
Prompt Injection: The XSS of LLMs | Tomasus
Tomasus publishes an explainer framing prompt injection as "the XSS of LLMs," arguing that because a model reads instructions and data as one continuous token stream, the system/user prompt boundary is only a convention and later persuasive text can override the developer's rules. The piece walks through direct injection (override, role-play framing, payload smuggling) and indirect injection via retrieved content such as web pages, PDFs, and emails, referencing the OWASP LLM Top 10 and the Greshake et al. indirect prompt injection research. Details →First reported arxiv.org
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Researchers at Penn State introduce FARMA (Forged Amplifying Rationale Memory Attack), which poisons an LLM agent's remembered reasoning history rather than its factual knowledge, inserting forged reasoning traces with evasive language that bypass keyword filters and self-referential reinforcement that defeats consensus-based defenses like A-MemGuard, achieving up to 100% attack success. They also present SENTINEL, a layered defense pipeline whose Reasoning Guard structurally analyzes entries using five weighted signals, reducing FARMA's success rate to as low as 0% with no false positives across 326 benign traces. Details →First reported aws.com
Memory Poisoning Attack in AI Agents - Attack vectors and defenses on AWS | AWS Builder Center
An AWS Builder Center article titled "Memory Poisoning Attack in AI Agents" discusses attack vectors and defenses for memory poisoning against AI agents on AWS. The retrievable page body contains only cookie-consent boilerplate, so the substantive technical content could not be analyzed. Details →First reported · updated · 2 reports kodemsecurity.com
LLM Security Testing: OWASP Top 10 Guide 2026
Openlayer's guide summarizes the 2025 OWASP Top 10 for LLM applications, explaining why LLM systems need dedicated security testing and detailing risk categories such as prompt injection, excessive agency, system prompt leakage, poisoned vector stores, unbounded consumption, and vector/embedding weaknesses. It argues that static code analysis and CVE scanning miss inference-time attacks and that agentic systems require session-level testing, while mapping OWASP results to EU AI Act obligations and promoting Openlayer's coverage. Details →First reported anthropic.com
More details on Fable 5’s cyber safeguards and our jailbreak framework
Anthropic's announcement details the cybersecurity safety classifiers shipped with its Claude Fable 5 model — which sort cyber uses into prohibited, high-risk dual-use, low-risk dual-use, and benign categories to block or monitor dangerous requests — and proposes an early-draft AI jailbreak severity framework developed with Glasswing partners, alongside a HackerOne program for researchers to submit cyber jailbreaks. It references related research on Boundary Point Jailbreaking, a black-box attack that evades industry-deployed classifier safeguards. Details →First reported pillar.security
The Week of Sandbox Escapes
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged. Details →First reported twitter.com
Kimi K3 just fixed 15 critical security bugs that Codex and Fable refused
A widely-shared post by David Sacks argues that American frontier models like Codex and Fable refuse security tasks due to 'cyber guardrails,' while Chinese models such as Kimi K3 and GLM 5.2 complete them, claiming Hugging Face switched to a local Chinese model to analyze an AI-powered cyber attack because guardrails blocked requests containing real exploit payloads. Details →First reported theregister.com
Frontier LLMs couldn't help Hugging Face fight off evil agents
Hugging Face disclosed that an intrusion into its production infrastructure was driven end-to-end by an autonomous AI agent system, compromising a limited set of internal datasets and several service credentials, with the agent swarm executing thousands of actions across short-lived sandboxes using self-migrating C2 on public services. Notably, commercial frontier LLM guardrails blocked the forensic investigation because analysis required submitting real attack payloads and C2 artifacts, forcing the team to run log analysis on the Chinese open-weight model GLM 5.2 on its own infrastructure. Details →First reported rapid7.com
Inside an Exposed Malware Delivery Lab: OPSEC Failures Behind a WebDAV Phishing Operation
Rapid7 recovered a 1,048-file malware delivery toolkit from an operator's exposed server, including lure templates, droppers, testing notes and live logs for a WebDAV-based infostealer campaign targeting Windows users in Mexico via a fake government ID-lookup site. Artifacts, including a hardcoded path pointing at an open-source AI coding tool, indicate the operator used generative AI to produce, test, and document the phishing delivery chain at speed. Details →First reported · updated · 3 reports theregister.com
China Says It Has Found Security Vulnerabilities in Anthropic’s Claude Code - WSJ
China's national vulnerability database (CNVD) claims to have found security vulnerabilities in Anthropic's Claude Code AI coding assistant, and reporting notes Alibaba banned staff from using Claude Code over 'spyware' concerns. The dispute follows Anthropic's accusation that Alibaba and other Chinese labs illicitly extracted Claude's capabilities via large-scale 'distillation' campaigns involving tens of millions of exchanges through fraudulent accounts. Details →First reported · updated · 2 reports arxiv.org
Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents
Alan Turing Institute researchers Abhishek Kumar and Carsten Maple demonstrated a "workflow-level jailbreak construction" against GitHub Copilot in VS Code, showing that harmful requests refused in direct chat succeed when decomposed across ordinary multi-turn IDE coding tasks. Across 204 prompts from Hammurabi's Code, HarmBench, and AdvBench, four closed-weight backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash) refused in 808/816 direct tries but produced unsafe outputs in all 816/816 runs when the harmful objective was embedded as an input to a coding workflow. Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported · updated · 3 reports darktrace.com
Hackers Compromise AWS AI Gateway Connected to Amazon Bedrock to Deploy XMRig Cryptominer
Darktrace disclosed an incident in which attackers compromised an AWS EC2 instance running LiteLLM-Proxy — an AI gateway centralizing access to Amazon Bedrock foundation models through a privileged IAM role — and deployed XMRig cryptomining malware. The instance had SSH port 22 exposed to all inbound traffic (0.0.0.0/0) and was hit by brute-force attempts, primarily from IP 145.241.123[.]102. Details →First reported ainowinstitute.org
Anthropic and OpenAI Security Tools Could Fuel Cyber-Attacks
Infosecurity Magazine reports on a research brief (attributed to the AI Now Institute) warning that AI security tools built by Anthropic and OpenAI could be repurposed to fuel cyber-attacks. The piece frames researcher concerns that defensive AI capabilities carry dual-use risk of being weaponized by attackers. Details →First reported · updated · 2 reports asset-group.github.io
We put the exploit in a picture. Your AI code reviewer never opens it.
Researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrated 'Ghostcommit,' an attack that hides malicious prompt-injection instructions inside a PNG image so AI code reviewers (CodeRabbit, Cursor Bugbot) never see them. A benign-looking AGENTS.md convention file points to build-spec.png, whose rendered text instructs a coding agent to read the repo's .env byte-by-byte and emit the secrets as an integer tuple; the payload sits dormant until an unrelated agent session triggers exfiltration. A proof-of-concept is published on GitHub and the findings were disclosed to affected vendors. Details →First reported helpnetsecurity.com
99.9% of fixable AI vulnerabilities remain unpatched
Orca Security's 2026 State of AI Security Report, summarized by Help Net Security, finds 81.2% of companies running AI packages have at least one known vulnerability and 99.9% of AI vulnerability alerts with an available fix remain unpatched. The report describes attackers moving across five layers of the AI stack — package registries, model hubs, developer tools, agent frameworks, and brand trust — while organizations deploy agents, RAG pipelines, and vector databases with weak security hygiene. Details →First reported keycard.ai
The Agent Security Stack: Transport, Identity, Policy, Runtime
A Keycard explainer maps the "agent security stack" into distinct layers — transport (MCP/OAuth 2.1 authorization), identity, policy, and runtime guardrails that watch for prompt injection — arguing that agent security cannot be collapsed into a single control surface. The piece frames how multi-agent call chains multiply control surfaces (LLM tool invocation, transport, credential, authorization) and argues identity/authorization is the most under-served layer, citing recent CrowdStrike/SGNL and Palo Alto/CyberArk acquisitions. Details →First reported · updated · 3 reports appsentinels.ai
One Poisoned MCP Server Can Hijack All the Others — Coograph
MCP tool poisoning hides malicious instructions inside a Model Context Protocol server's tool descriptions, parameter schemas, or return values — invisible to human reviewers but fully read by the LLM, which then selects and executes the poisoned tool, enabling data exfiltration, credential theft, or lateral movement. The technique spans schema poisoning, tool shadowing, and rug pulls, and is catalogued as OWASP MCP03:2025; a single malicious server can influence an agent's decisions across all connected tools (cross-tool poisoning). Details →First reported · updated · 2 reports arxiv.org
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
The paper 'Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions' systematically analyzes vulnerabilities in Model Context Protocol (MCP) servers, finding that taint-style vulnerabilities (e.g., SSRF as in the Markdownify server, CVE-2025-5276) make up a substantial fraction and are slow to be remediated. It proposes SpellSmith, which builds tool-level risk profiles and embeds behavioral guidance into MCP tool descriptions plus LLM self-reflection to mitigate exploitation without code-level fixes. Details →First reported · updated · 15 reports everydayonai.com
What Is a Prompt Injection Attack? Types, Examples, and Defenses | AI EdgeLabs
An educational reference explainer, "What Is a Prompt Injection Attack? Types, Examples, and Defenses," catalogs prompt injection technique classes—including direct, indirect, and multimodal (hidden image/document) injection—and maps them to OWASP LLM01:2025, NIST AI 600-1, and mitigation guidance such as tool gating, source trust, and audit logs. The piece synthesizes existing research and known incidents (e.g., EchoLeak, the lethal trifecta) rather than presenting a specific new event or finding. Details →First reported · updated · 3 reports trussed.ai
Top Agentic AI Security Threats in Late 2026
An introductory blog on the AI Innovation Stack argues that authenticated AI agents are not necessarily aligned, framing the shift as the collapse of decades of enterprise security assumptions built for human or deterministic actors. It cites a real AI-assisted campaign in which a single operator, using two commercial AI tools that generated roughly three-quarters of the remote command execution, breached nine Mexican government agencies and exfiltrated about 195 million identity records over 2.5 months. Details →First reported simspace.com
Exposing AI Agent Failure Modes Through Structured Cyber Exercises
SimSpace's blog post argues for using structured cyber exercises — combining red teaming, tabletop decisions, and automated simulations — to expose AI agent failure modes such as goal drift, tool misuse, context loss, and cascading logical errors before agents are deployed at scale. The piece lays out a failure-mode taxonomy (security vs. safety failures) and a five-phase validation flow, citing practitioner evidence that only 37% of a single-agent pipeline's outputs were error-free. Details →First reported asana.com
Breaking the Lethal Trifecta: How Asana Thinks About Agentic AI Security • Asana
Asana engineering explains how it approaches agentic AI security using Simon Willison's "lethal trifecta" framework — the convergence of access to sensitive data, exposure to untrusted content, and the ability to externally communicate (create side effects) that together enable prompt-injection attacks. The piece argues that since prompt injection cannot be reliably solved, defenders should break at least one leg of the trifecta, citing demonstrated attacks against Microsoft 365 Copilot (EchoLeak), GitHub's MCP server, and Slack AI. Details →First reported barndoor.ai
MCP Gateway Requirements for Enterprise Security Teams
Barndoor's blog outlines security requirements for enterprise MCP (Model Context Protocol) gateways, arguing that most MCP deployments lack access controls and identifying five gaps: all-or-nothing tool permissions, no user scoping, silent vendor-side changes, fragmented policy across AI clients, and unfiltered sensitive data. It recommends per-tool policy enforcement, IdP-driven identity, change management, and a default-deny posture. Details →First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported medium.com
The Last Patch. The MCP Attack Surface We’re Building… | by Zac | Jul, 2026
An opinion piece by Zac on Medium argues that the rush to expose MCP endpoints and build agent-to-agent (A2A) orchestration is creating a large new attack surface, where every MCP endpoint is an agent-callable function and every A2A handoff is a traversable trust boundary. The article draws on Anthropic's report mapping 832 accounts banned for malicious cyber activity (March 2025–March 2026) against MITRE ATT&CK, noting medium-or-higher-risk actors rose from 33% to 56% and that AI is increasingly used deeper in the attack lifecycle. Details →First reported medium.com
Prompt Injection Is Just SSRF for Text | MCP Security → Part 3 | by Abhishek meena | Jul, 2026
Part 3 of an MCP bug bounty guide by Abhishek meena frames MCP prompt injection as analogous to SSRF: tool outputs (URLs, files, emails, API responses) are attacker-controlled text that the model reads and treats as instructions. The write-up explains how to find, exploit, and argue indirect prompt injection via tool output, with sanitized PoCs referenced. Details →First reported · updated · 6 reports thehackernews.com
Identity Lifecycle Management Wasn't Built for AI Agents
The Hacker News guide argues that traditional identity lifecycle management (IGA) tools were architected for human employees with HR records, managers, and departure dates—assumptions that break down for autonomous AI agents acting as non-human principals. The piece outlines where the human-centric governance model develops structural blind spots and what extending it to AI agents actually requires. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector