First reported · updated · 4 reports edgelabs.ai
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported substack.com
Kinetic Prompt Injections & Sleeper Agents
Eito Miyamura and collaborators demonstrated a prompt-injection attack against Gemini Robotics 2.0 VLA models in a MUJOCO simulation, using a hijacked TV screen showing a fake 'SYSTEM UPDATE' to plant a conditional sleeper-agent skill on a robot dog. The skill lay dormant until a trigger object (a pineapple) appeared, at which point the robot executed hidden malicious instructions to attack a child, showing that robotics models follow injected commands like early LLMs. Details →First reported · updated · 7 reports varonis.com
CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower
Varonis Threat Labs disclosed CoSnitch (CVE-2026-24301), a critical one-click vulnerability chain in Microsoft Copilot Personal that combines the ?q= URL parameter with an undocumented autorun=1 parameter to auto-execute an attacker-supplied prompt on page load, then queries connected apps (Gmail, Drive, Calendar, OneDrive) and exfiltrates data via encoded URLs, plus indirect prompt injection through web summarization that poisons persistent memory. Researchers used a 'meta-hacking' technique, repeatedly asking Copilot why an attack wouldn't work until the assistant disclosed its own disabled parameters and session conditions. Microsoft shipped patches on August 18, 2026; Varonis reports no evidence of in-the-wild exploitation. Details →First reported · updated · 2 reports arxiv.org
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Researchers at Penn State introduce FARMA (Forged Amplifying Rationale Memory Attack), which poisons an LLM agent's remembered reasoning traces rather than its factual knowledge, using evasive language to bypass keyword filters and self-referential reinforcement to defeat consensus-based defenses, achieving up to 100% attack success including against A-MemGuard. They also propose SENTINEL, a layered defense whose Reasoning Guard structurally analyzes memory entries for forgery, reducing attack success to as low as 0% with no false positives across 326 benign traces. Details →First reported forkast.news
Memory Poisoning: AI Security Threat Explained | Forkast Learn
Forkast's glossary entry defines memory poisoning, an attack against LLM-based AI agents in which adversaries inject malicious or false data into an agent's persistent long-term memory layer (vector databases, semantic indexes, grounding caches, or stored conversation histories). The entry explains its temporal decoupling and persistent blast radius, cites OWASP's ASI06 classification, and describes common vectors such as poisoned PDFs, web pages, and support tickets leveraging indirect prompt injection. Details →First reported · updated · 4 reports cyera.com
Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning
Cyera's Oasis Identity Research disclosed CVE-2026-65105 in NVIDIA NemoClaw, which deploys the OpenClaw AI agent with local Ollama inference. NemoClaw starts Ollama bound to 0.0.0.0:11434 (while telling users it is on localhost), disabling a key defense; combined with DNS rebinding, a single visit to an attacker-controlled webpage gives unauthenticated access to the Ollama API, letting an attacker persistently poison the model's chat template so injected instructions survive the agent's own system prompt and steer the agent thereafter. The findings were reported to NVIDIA PSIRT prior to publication. Details →First reported mindgard.ai
Bypassing ChatGPT Image Safeguards Through Memory Manipulation
Mindgard research demonstrates bypassing ChatGPT's image-generation safeguards through manipulation of custom memory and system/instruction context, inducing policy-inconsistent output including sexualized images of fictitious and real people. The techniques exploit the bio tool, model set context, and image routing/filtering pipeline without accessing model weights, and were disclosed to OpenAI prior to publication. Details →First reported truefoundry.com
LLM Agent Security: Runtime and Control Planes
A TrueFoundry blog post frames LLM agent security as a systems problem, discussing how untrusted content can redirect agent control flow, misuse tool privileges, corrupt persistent state, and leak data, and arguing for runtime and control-plane defenses. The piece draws on a linked arXiv survey ('Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation') that synthesizes 247 papers, while also promoting the vendor's TrueForge agent harness. Details →First reported arxiv.org
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
InjecMEM, described in a paper by researchers from Shanghai Jiao Tong University and Ant Group, is a memory-injection attack that plants hidden instructions in an LLM agent's persistent memory with a single interaction and no read/edit access to the memory store. Using a retriever-agnostic anchor plus a gradient-optimized adversarial command, it steers later responses on a target topic, achieving up to 35.4% retrieval success and 76.6% attack success on MemoryOS while leaving non-target queries unaffected; code is published on GitHub. Details →First reported · updated · 3 reports mallory.ai
GhostJacking Attacks: Half of the Fortune 500 Run These Tools. Getting Blocked by the Firewall Was the Way to Take Over Their AI Agents - Tenet Security
Tenet Security disclosed 'GhostJacking' at DEF CON 34, an indirect prompt-injection technique that hides malicious instructions inside trusted operational data such as logs, alerts, and bug reports, then tricks AI coding and operations agents into executing them with their own legitimate permissions. Demonstrations across Cloudflare, Datadog, and Sentry workflows showed agents altering DNS records, running commands, exposing frontend keys, and exfiltrating environment secrets and cloud credentials while falsely reporting success. Tenet also reported that Anthropic fixed a Claude Desktop remote data-exfiltration flaw with no CVE assigned. Details →First reported · updated · 2 reports acalvio.com
AI Agent Security Risks: What Happens When Agents Are Manipulated
Acalvio's write-up synthesizes OWASP's agentic AI security guidance (the AI Agent Security Cheat Sheet, Top 10 for LLM Applications, and Top 10 for Agentic Applications 2026), mapping risks like prompt injection (LLM01), excessive agency, and trust-chain abuse to detection requirements, and argues deception (decoy APIs, deceptive credentials, honeytokens) adds a runtime detection layer. It frames the challenge using the disclosed GTG-1002 AI-orchestrated espionage campaign, in which a Chinese state-sponsored group manipulated Anthropic's Claude Code to execute an autonomous intrusion at machine speed. Details →First reported arxiv.org
MAPLE-Guard: Memory-Aware Link EnforcementAgainst Memory-Link Poisoning in Multi-Agent Systems
MAPLE-Guard is a defense presented in an arXiv paper against memory-link poisoning in LLM-based multi-agent systems, where a single poisoned memory write can be retrieved, promoted into shared memory, and reused by agents that never saw the original attack. The guard places gates at write, retrieval, promotion, and cross-agent reuse, reportedly lowering attack success rate from 38.2% to 0.9% on LongMemEval and 34.7% to 0.2% on AppWorld, with code released on GitHub. Details →First reported beam.ai
When AI Agent Memory Becomes a Liability
An analysis piece from beam.ai argues that persistent memory in AI agents is a design liability, cataloging four failure modes: error compounding, context degradation, security exposure via memory poisoning, and compliance risk. The article notes that a maliciously poisoned memory entry planted once can fire weeks later across users, expanding the blast radius from a single request to an agent's entire workflow history, and cites controlled-benchmark research on how irrelevant context degrades LLM reasoning. Details →First reported · updated · 5 reports nhimg.org
AI Agent Memory Poisoning: Persistent Agent Attacks
An explainer on agent memory poisoning describes how a single adversarial write into an LLM agent's persistent memory store is retrieved and executed across future sessions, unlike a prompt injection that dies when the turn ends. It draws on red-team research (AgentPoison, which backdoors memory/RAG knowledge bases, and MINJA, which injects malicious records via query-only interaction) and recommends architectural defenses: authorising writes outside the model, provenance stamping, trust-weighted retrieval, and quarantining new writes. Details →First reported aclanthology.org
BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks
BlindGuard is a research paper (ACL 2026) proposing an unsupervised defense for LLM-based multi-agent systems (MAS) against the 'propagation vulnerability,' where malicious agents distort collective decision-making through inter-agent interactions. The authors argue existing supervised detection methods are impractical because they rely on labeled malicious agents, and present a method that safeguards MAS under unknown attacks without such labels. Details →First reported nhimg.org
Notification-based Gemini prompt injection exposes AI assistant risk
SafeBreach Labs demonstrated that notification-based indirect prompt injections can manipulate Google Gemini through messaging channels like WhatsApp, Slack, and SMS, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions that persist after bypassing prior mitigations. The research shows untrusted notification text folded into the assistant's working context becomes an attack surface that content filters alone cannot secure. Details →First reported arxiv.org
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
The arXiv paper "Hidden in Memory: Sleeper Memory Poisoning in LLM Agents" (2605.15338), explained in a companion Medium write-up, demonstrates a delayed attack in which adversarial content in a document, webpage, or repository causes a stateful LLM assistant to store a fabricated memory about the user that re-emerges across future sessions. Across tested assistants, poisoned memories were written up to 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6, and among successful retrievals they steered attacker-intended agentic actions in 60–89% of evaluations; the authors release code on GitHub. Details →First reported arxiv.org
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
Researchers at Worcester Polytechnic Institute presented AcMAS, an activation-based framework for detecting stealthy malicious behaviors in LLM-based multi-agent systems (MAS), at ICML 2026 (arXiv:2607.06807). AcMAS analyzes internal reasoning states in the activation space of local agents to detect compromised agents without relying on explicit interaction graphs, reporting large F1 improvements over graph-based baselines in both synchronous (0.94 vs 0.72) and asynchronous (0.93 vs 0.38) settings, and can help restore compromised agents rather than isolating them. Details →First reported substack.com
Coding Agent Security: Lessons from Claude Code, Cowork, Codex, and Copilot in the Wild
Ken Huang's survey "Coding Agent Security" reviews documented 2025-2026 incidents involving AI coding agents (Claude Code, Cowork, Codex, Copilot, Amazon Q), including agents that deleted databases, leaked credentials, and merged malicious code after indirect prompt injection via GitHub Issues, source-code comments, or MCP tool results. The piece maps a four-stage risk chain (untrusted text enters context, model can't separate instruction from data, model issues a tool call, tool call has real-world effect) and argues policy enforcement must live at the action boundary. Supporting evidence includes embracethered's Amazon Q Developer VS Code extension RCE via prompt injection abusing the readonly-classified find -exec flag. Details →First reported medium.com
Indirect prompt injection: what LLM bounty triagers actually reward | InfoSec-Writes Up
An InfoSec-Writes Up article by Muhammad Haider Tallal explains why bug bounty triagers at Google, OpenAI, and Mozilla's Odin frequently close direct prompt injection and jailbreaks as informational while paying for indirect injection chains that produce real account or data impact. It cites a case where a malicious task planted in a Jira ticket silently wiped a victim's Gemini memory and earned a $15,000 payout. Details →First reported theregister.com
OpenAI ditches Recall-style screenshot surveillance for friendly keylogging
OpenAI's new opt-in 'Computer History' feature for the ChatGPT macOS desktop app captures user interaction events (clicks, typing, keyboard shortcuts, app switches) via macOS accessibility APIs, turning them into text summaries and local memory files to build ChatGPT memories. The Register notes the files are stored unencrypted locally for up to 48 hours, are accessible to other programs running as the same user, and increase the user's exposure to prompt injection. Details →First reported github.com
GitHub - OWASP/www-project-agent-memory-guard: OWASP Foundation web repository
OWASP Agent Memory Guard is an open-source project repository providing tooling to detect and block memory-injection and memory-poisoning attacks against AI agents, shipping a CLI scanner, API server, ML-based detection, additional detectors, a GitHub Action, and an attack-then-block demo runnable via Codespaces. Details →First reported intigriti.com
RAG and ruin: why your existing controls may miss AI poisoning attacks
An Intigriti blog post titled "RAG and ruin: why your existing controls may miss AI poisoning attacks" discusses how retrieval-augmented generation (RAG) systems can be compromised through data/knowledge-base poisoning, and argues that traditional security controls fail to detect such AI-specific poisoning attacks. Details →First reported theregister.com
Prompt injection isn't the bug, AI agent frameworks are
Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across major AI agent frameworks (LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK), arguing that the real risk is how frameworks handle prompt injection rather than injection itself. Their findings include classic flaw classes—insecure deserialization, SSRF, path traversal, use-after-free—such as a critical checkpoint deserialization bug in Microsoft Agent Framework that allowed remote code execution via poisoned agent state; Microsoft paid a $10,000 bounty and fixed it. Details →First reported · updated · 2 reports arthur.ai
One Poisoned Agent Infects the Whole Chain | Ravoid
An explainer on how prompt injection propagates across multi-agent LLM systems, showing that a payload buried in a retrieved document, tool result, subagent output, or shared memory becomes trusted input to downstream agents and rides the chain past a single front-door guardrail. The piece argues every inter-agent handoff must be treated as a trust boundary and references the 'Prompt Infection' research on self-replicating LLM-to-LLM injection. Details →First reported arxiv.org
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
The paper 'Forensic Trajectory Signatures for Agent Memory Poisoning Detection' by Jun Wen Leong identifies a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email. A rule and Random Forest classifier over trajectory features achieve high AUC (up to 0.99) across 9 models, but a preregistered follow-up (N=4,360, 13 models) reveals benign memory-grounded sends produce the same signature, causing high false positives; the recall_before_send pattern is an attack precondition rather than a maliciousness predicate, requiring recipient-metadata gating to restore separation. Details →First reported arxiv.org
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
Researchers introduce GhostWriter, a memory-poisoning attack against tool-using personal LLM agents with long-term memory, operating in an injection phase (a hidden payload sent to the agent) and an activation phase (the poisoned memory being retrieved). The paper reports near-universal ~98% injection and ~60% activation rates against state-of-the-art agents, and proposes a defense, Agentic Memory Sentry (AM-Sentry), using a memory-saving policy and a memory-retrieval screen to reduce success while preserving utility. Details →First reported aicerts.ai
New MCP Benchmark Highlights Server Drift Dangers
An MCP Benchmark study scanned 10,831 Model Context Protocol servers and linked poor tool-description quality ("description smells" like missing return fields, wrong parameter semantics, and duplicate tool names) to measurably higher exploitation rates, with servers rated 'poor' tripling successful-attack probability. The research characterizes 'MCP drift' — unreviewed post-deployment changes to tool descriptions, parameters, or capabilities — as a live supply-chain threat, sometimes via benign onboarding followed by malicious rewrites weeks later, and notes simple 27-line mitigations eliminated high-severity findings in lab tests. Details →First reported github.com
GitHub - prompt-security/clawsec: A complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations, automated audits, and skill integrity verification. All from one installable suite.
clawsec, published by prompt-security on GitHub, is an installable security skill suite for AI coding agents (referred to as OpenClaw, Hermes, PicoClaw and NanoClaw) that provides drift detection, live security recommendations, automated audits, and skill integrity verification for agent configuration files such as SOUL.md. The repository includes automated NVD/GHSA advisory syncing and packaged, npx-installable skills for hardening agent setups. Details →First reported arxiv.org
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
A paper by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber formalizes 'self-state attacks,' in which a self-hosted AI agent is compromised by corruption of its own memory and configuration files via legitimate OS system calls. The authors characterize a four-axis attack space rendered as a 23-cell matrix with 43 concrete file operations, evaluate a layered OS-level defense against injected activity traces, and find that four attack cells (concentrated on memory-file writes) remain structurally indistinguishable at the OS level. Details →First reported aws.com
Memory Poisoning Attack in AI Agents - Attack vectors and defenses on AWS | AWS Builder Center
An AWS Builder Center article titled "Memory Poisoning Attack in AI Agents" discusses attack vectors and defenses for memory poisoning against AI agents on AWS. The retrievable page body contains only cookie-consent boilerplate, so the substantive technical content could not be analyzed. Details →First reported arxiv.org
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
"Bad Memory" is a research paper studying prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace, evaluating Anthropic Claude Code and OpenAI Codex across four models. The authors find that while it is hard to make an agent overwrite its own memory files using untrusted external content, payloads already planted in persistent memory files can successfully compromise current and future sessions, with attack success and persistence varying by system, model, and adversarial goal. Details →First reported substack.com
Data Exfiltration from Slack AI via indirect prompt injection
PromptArmor identified an indirect prompt injection vulnerability in Slack AI, a RAG-style chat search interface, where an attacker seeds poisoned tokens into a public channel or an imported document. When a user later queries Slack AI, the injected instructions cause private data (e.g. an API key from a private channel) to be embedded into a malicious Markdown link that exfiltrates the secret to the attacker's server when clicked. Details →First reported aclanthology.org
Data Exfiltration via Backdoored Tool Use
Researchers present Back-Reveal, a data exfiltration attack that embeds semantic triggers into fine-tuned tool-use LLM agents; when triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and covertly transmits it to an attacker-controlled server disguised as legitimate retrieval/search API requests. The paper shows multi-turn interaction amplifies leakage, as attacker-controlled retrieval responses steer subsequent agent behavior to induce cumulative disclosure, and evaluates defenses like NeMo Guardrails and LLM Guard as targets. Details →First reported icml.cc
ICML Poster An Empirical Study of Memory Poisoning Defenses for LLM Agents
An ICML 2026 poster titled "An Empirical Study of Memory Poisoning Defenses for LLM Agents" presents research evaluating defenses against memory poisoning attacks on LLM agents, with an associated code artifact (AMemGuard on GitHub). Details →First reported detect.fyi
Detection Engineering in the Era of Semantic Malware
A detection-engineering analysis examines "semantic malware" / "promptware" — malware delivered through prompt injection rather than binaries — using Origin's Brainworm PoC (a poisoned CLAUDE.md file that hijacks AI coding assistants into registering with a C2 server over RabbitMQ) and the Ben-Gurion/Tel Aviv/Harvard/Toronto "Promptware Kill Chain" arXiv paper as anchors. The kill chain formalizes seven stages (initial access via prompt injection, jailbreaking, reconnaissance, memory/retrieval poisoning, command-and-control, lateral movement, actions on objective) across 36 documented incidents, and the piece discusses how defenders can detect such trust-boundary failures. Details →First reported agentsafelabs.com
Prompt Injection Is Not a Chatbot Problem: How the Attack Surface Changes When Your LLM Has Tools
An explainer arguing that chatbot-era prompt injection defenses (input filtering, output monitoring, instruction hierarchy, adversarial training) fail against agentic systems because injection enters through tools, retrieved documents, memory, API responses, and inter-agent instructions rather than the user message. It frames the issue as a system-architecture and trust-boundary problem rather than a model-tuning one. Details →First reported freyzo.github.io
deep-xpia - multi-hop cross-prompt injection benchmark
deep-xpia is a benchmark of multi-hop cross-prompt injection (DXPIA) across delegated agent boundaries, with 300 live-measured cases and 8 attack patterns showing 69% land undefended and 12% even with all defenses. It highlights registry injection at tool-discovery (DXPIA-008) entering upstream of all 5 stacked defenses and maps patterns to documented Copilot incidents like EchoLeak. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector