First reported · updated · 2 reports arxiv.org
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported forkast.news
Memory Poisoning: AI Security Threat Explained | Forkast Learn
Forkast's glossary entry defines memory poisoning, an attack against LLM-based AI agents in which adversaries inject malicious or false data into an agent's persistent long-term memory layer (vector databases, semantic indexes, grounding caches, or stored conversation histories). The entry explains its temporal decoupling and persistent blast radius, cites OWASP's ASI06 classification, and describes common vectors such as poisoned PDFs, web pages, and support tickets leveraging indirect prompt injection. Details →First reported arxiv.org
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
InjecMEM, described in a paper by researchers from Shanghai Jiao Tong University and Ant Group, is a memory-injection attack that plants hidden instructions in an LLM agent's persistent memory with a single interaction and no read/edit access to the memory store. Using a retriever-agnostic anchor plus a gradient-optimized adversarial command, it steers later responses on a target topic, achieving up to 35.4% retrieval success and 76.6% attack success on MemoryOS while leaving non-target queries unaffected; code is published on GitHub. Details →First reported beam.ai
When AI Agent Memory Becomes a Liability
An analysis piece from beam.ai argues that persistent memory in AI agents is a design liability, cataloging four failure modes: error compounding, context degradation, security exposure via memory poisoning, and compliance risk. The article notes that a maliciously poisoned memory entry planted once can fire weeks later across users, expanding the blast radius from a single request to an agent's entire workflow history, and cites controlled-benchmark research on how irrelevant context degrades LLM reasoning. Details →First reported · updated · 5 reports nhimg.org
AI Agent Memory Poisoning: Persistent Agent Attacks
An explainer on agent memory poisoning describes how a single adversarial write into an LLM agent's persistent memory store is retrieved and executed across future sessions, unlike a prompt injection that dies when the turn ends. It draws on red-team research (AgentPoison, which backdoors memory/RAG knowledge bases, and MINJA, which injects malicious records via query-only interaction) and recommends architectural defenses: authorising writes outside the model, provenance stamping, trust-weighted retrieval, and quarantining new writes. Details →First reported · updated · 3 reports youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP - YouTube
An explainer on AI data poisoning describes how attackers corrupt the data a model learns from, fine-tunes on, or retrieves — including training data, alignment data, and RAG knowledge bases — so a poisoned model behaves as the attacker intends while passing ordinary validation. It distinguishes data poisoning from prompt injection, jailbreaking, evasion, and model poisoning, and notes research (e.g. Carlini et al.'s web-scale poisoning work) showing under 1% poisoned data can measurably change behavior, recommending provenance, access control, monitoring, and rollback as layered defenses. Details →First reported arxiv.org
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
The arXiv paper "Hidden in Memory: Sleeper Memory Poisoning in LLM Agents" (2605.15338), explained in a companion Medium write-up, demonstrates a delayed attack in which adversarial content in a document, webpage, or repository causes a stateful LLM assistant to store a fabricated memory about the user that re-emerges across future sessions. Across tested assistants, poisoned memories were written up to 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6, and among successful retrievals they steered attacker-intended agentic actions in 60–89% of evaluations; the authors release code on GitHub. Details →First reported github.com
GitHub - OWASP/www-project-agent-memory-guard: OWASP Foundation web repository
OWASP Agent Memory Guard is an open-source project repository providing tooling to detect and block memory-injection and memory-poisoning attacks against AI agents, shipping a CLI scanner, API server, ML-based detection, additional detectors, a GitHub Action, and an attack-then-block demo runnable via Codespaces. Details →First reported scworld.com
Agentic anarchy: Why using AI browsers just isn't worth the risk | news | SC Media
At Black Hat 2026, Zenity researchers Michael Bargury and Stav Cohen demonstrated prompt-injection ('persuasion') attacks against AI browsers including Perplexity Comet, Microsoft Edge with Copilot, Chrome with Gemini, the Anthropic Claude extension, and OpenAI's Atlas. Injections embedded in calendar invites, emails, and social posts led agents to take over a PC in seconds, steal 1Password credentials and recovery keys, send phishing email, exfiltrate files, delete AWS instances, and expose private GitHub repos; Perplexity has since fixed the local-file flaw. Details →First reported arxiv.org
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
The paper 'Forensic Trajectory Signatures for Agent Memory Poisoning Detection' by Jun Wen Leong identifies a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email. A rule and Random Forest classifier over trajectory features achieve high AUC (up to 0.99) across 9 models, but a preregistered follow-up (N=4,360, 13 models) reveals benign memory-grounded sends produce the same signature, causing high false positives; the recall_before_send pattern is an attack precondition rather than a maliciousness predicate, requiring recipient-metadata gating to restore separation. Details →First reported arxiv.org
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
Researchers introduce GhostWriter, a memory-poisoning attack against tool-using personal LLM agents with long-term memory, operating in an injection phase (a hidden payload sent to the agent) and an activation phase (the poisoned memory being retrieved). The paper reports near-universal ~98% injection and ~60% activation rates against state-of-the-art agents, and proposes a defense, Agentic Memory Sentry (AM-Sentry), using a memory-saving policy and a memory-retrieval screen to reduce success while preserving utility. Details →First reported arxiv.org
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
A paper by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber formalizes 'self-state attacks,' in which a self-hosted AI agent is compromised by corruption of its own memory and configuration files via legitimate OS system calls. The authors characterize a four-axis attack space rendered as a 23-cell matrix with 43 concrete file operations, evaluate a layered OS-level defense against injected activity traces, and find that four attack cells (concentrated on memory-file writes) remain structurally indistinguishable at the OS level. Details →First reported aws.com
Memory Poisoning Attack in AI Agents - Attack vectors and defenses on AWS | AWS Builder Center
An AWS Builder Center article titled "Memory Poisoning Attack in AI Agents" discusses attack vectors and defenses for memory poisoning against AI agents on AWS. The retrievable page body contains only cookie-consent boilerplate, so the substantive technical content could not be analyzed. Details →First reported arxiv.org
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
"Bad Memory" is a research paper studying prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace, evaluating Anthropic Claude Code and OpenAI Codex across four models. The authors find that while it is hard to make an agent overwrite its own memory files using untrusted external content, payloads already planted in persistent memory files can successfully compromise current and future sessions, with attack success and persistence varying by system, model, and adversarial goal. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa's AI Red Teaming Agent was pointed at GitHub's open-source Secure Code Game 'ProdBot' challenge (Season 4, agentic AI track), an intentionally vulnerable teaching target where the flag lives in ../password.txt outside the agent's sandbox. The agent autonomously cleared the first three levels (Sandbox, Web, MCP) at 100/100 in a 57-second run, relying not on jailbreak vocabulary but on 'context seeding' — fabricating a plausible prior workflow in which authentication had already occurred. The write-up frames each added agent capability (sandbox, web, MCP, skills/memory, multi-agent) as a new attack surface enabling prompt injection, indirect injection, poisoned tool chains, over-scoped skills, and confused-deputy trust. Details →First reported icml.cc
ICML Poster An Empirical Study of Memory Poisoning Defenses for LLM Agents
An ICML 2026 poster titled "An Empirical Study of Memory Poisoning Defenses for LLM Agents" presents research evaluating defenses against memory poisoning attacks on LLM agents, with an associated code artifact (AMemGuard on GitHub). Details →First reported koreshield.ai
Reproducing an Indirect Prompt Injection Against a RAG Pipeline
A Koreshield write-up reproduces an indirect prompt injection against a RAG customer-support pipeline, where a poisoned knowledge-base document (doc-002) contains a bracketed fake 'system note' instructing the model to dump all retrieved documents and exfiltrate internal tokens with an 'EXFIL::' marker while hiding the action. The author provides runnable code, a public GitHub harness (UncleTeslim/prompt-injection-repro), and real model logs demonstrating the attack against a local Llama3-8B model. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector