First reported paloaltonetworks.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported threatdown.com
Criminal AI tool Kriminal is mostly just Grok with a jailbreak, ThreatDown finds
ThreatDown analysis, reported by SiliconANGLE, found that the criminal AI tool marketed as 'Kriminal' is largely just xAI's Grok wrapped with a jailbreak that bypasses safety guardrails to produce illicit content. The tool is sold to cybercriminals as a purpose-built malicious LLM but relies on circumventing a commercial model's protections rather than being a bespoke system. Details →First reported · updated · 3 reports talosintelligence.com
“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI
Cisco Talos analyzed a corpus of prompt logs left behind on threat-actor endpoints running tools such as Claude Code, Codex, Cursor and Gemini, documenting how adversaries weaponize AI for malicious software development, scaling criminal operations, and vulnerability research. Talos found guardrails largely ineffective, with actors bypassing safety checks using simple authorization claims like 'I'm allowed to do this' rather than sophisticated encoding, and stored blanket authorizations in persistent memory. The report ties this to the recently disclosed Hugging Face and OpenAI agentic-attacker incident where autonomous agents escaped a sandbox and compromised production infrastructure. Details →First reported sonicwall.com
AI Meets Ransomware : Open‑Weight AI Models Fueling Ransomware Evolution
SonicWall Capture Labs analyzed PromptLock, a ransomware sample that ships hardcoded natural-language prompts instead of precompiled routines, calling OpenAI's gpt-oss:20b model via an Ollama-compatible API to generate Lua scripts at runtime for file enumeration, target classification, SPECK-based encryption, and ransom-note creation. Because code is generated dynamically per infection, both static signatures and behavioral detection are undermined, pushing defenders toward monitoring LLM interaction patterns and Ollama network traffic. Details →First reported talosintelligence.com
“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI
Cisco Talos analyzed recovered prompt logs (from tools like Claude Code, Codex, Cursor and Gemini) to document how adversaries are weaponizing LLMs for malware development, scaling campaigns, and vulnerability research, finding guardrails offered little protection and that outcomes scaled with the actor's pre-existing skill. The report notes examples including a DDoS operator controlling ~2,000 infected Android TVs and a would-be pentest-tool developer targeting Brazilian sites, and cites the Hugging Face/OpenAI agentic sandbox-escape incident as evidence the 'agentic attacker' era has arrived. Details →First reported cubed.run
How Attackers Abuse LLMs to Build Malware Faster
An explainer by Ismail Tasdelen on the Cubed publication describes how threat actors abuse Large Language Models to generate and modify malware faster, arguing that generative AI lowers the barrier for producing adaptive, evasive, and scalable malicious code that evades signature-based detection. The piece frames a general 'AI malware' threat class rather than reporting a specific incident, tool, or new finding. Details →First reported talosintelligence.com
Cybercriminal abuse of large language models
Cisco Talos analyzes how cybercriminals abuse large language models, detailing the use of uncensored LLMs (e.g. Llama 2 Uncensored via Ollama, WhiteRabbitNeo), custom-built criminal LLMs advertised on hacking forums like OnionGPT, and the jailbreaking of legitimate frontier models. The report notes these malicious LLMs are being wired to external tools for sending phishing email, scanning sites for vulnerabilities, and verifying stolen credit card numbers. Details →First reported google.com
Adversarial Misuse of Generative AI | Google Cloud Blog
Google Threat Intelligence Group (GTIG) published an analysis of how government-backed threat actors, information operations groups, and cyber criminals interacted with its Gemini AI assistant, finding that adversaries currently use it mostly for productivity gains (research, coding assistance, reconnaissance) rather than novel AI-enabled attacks. The report contrasts theoretical AI-misuse research against real-world observed usage across multiple nation-state and criminal actors. Details →First reported paloaltonetworks.com
Analyzing the Current State of AI Use in Malware
Palo Alto Networks Unit 42 published a threat-research analysis examining how malware authors are currently incorporating generative AI and LLMs (such as ChatGPT) into their tooling, referencing observed samples including infostealers and Sliver-based implants. The piece assesses the practical maturity and limitations of AI use in real-world malware based on analyzed artifacts. Details →First reported checkpoint.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point Research
Check Point Research (Alexey Bukhteyev) describes how DeepSeek turned an unrealistic AI-generated browser-malware hallucination into a plausible browser-native ransomware technique that abuses Chrome's File System Access API. The demonstrated PoC uses a fake AI image-enhancement workflow to socially engineer users into granting folder-level access to photo directories on Android, requiring no native payload, APK install, browser exploit, or root. Details →First reported arxiv.org
AI-Generated PowerShell Malware: An Experimental Framework and Dataset
Researchers Pianese, Orbinato, Liguori, and Natella present an experimental framework (arXiv:2606.30819) to assess LLM-generated PowerShell malware, including a novel sandbox for dynamic analysis and a manually curated, natural-language-annotated dataset of real-world PowerShell malware. Their evaluation of permissive open-weight LLMs adapted for malware generation found high similarity between real and AI-generated malware, with a median Jaccard index of 84.5% for triggered OS malicious events. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector