First reported · updated · 4 reports cyera.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported · updated · 3 reports medium.com
AI Supply Chain Security in CI/CD Pipelines, a 2026 Playbook
"AI Supply Chain Security in CI/CD Pipelines, a 2026 Playbook" is an analysis piece synthesizing real AI model supply-chain threats, including JFrog's February 2024 discovery of 100+ malicious Hugging Face models exploiting Python pickle deserialization for remote code execution, later PickleScan zero-days that let attackers bypass detection, and malicious Jinja templates hidden in safetensors metadata. The playbook frames how defenders should govern trustworthy AI/model pipelines from data to deployment. Details →First reported utimaco.com
Data Poisoning: Protect AI from Manipulated Data
A Utimaco blog post discusses data and model poisoning as integrity attacks against RAG and training pipelines, citing OWASP's classification of manipulation of pre-training, fine-tuning, and embedding data. The piece argues for verifying data integrity before inference using cryptographic digital signatures and HSM-protected signing keys, framed around Utimaco's General Purpose HSM offering. Details →First reported · updated · 5 reports paloaltonetworks.com
What Is Data Poisoning? [Examples & Prevention]
Palo Alto Networks' Cyberpedia entry explains data poisoning against AI/ML systems: how attackers corrupt training data to manipulate model behavior, the different attack types, where poisoning occurs in the pipeline, its distinction from prompt injection, and defensive measures. The page is an evergreen reference/glossary entry rather than a report of a specific incident or new finding. Details →First reported · updated · 2 reports arxiv.org
Defense Against LLM Backdoors using Critical Neuron Isolation Pruning
A research paper introduces DeCNIP (Defense with Critical Neuron Isolation Pruning), a defense against backdoor attacks in large language models that identifies trigger-like behaviors through representational analysis, isolates Backdoor Critical Neurons, and selectively prunes them. Evaluated on six open-source LLMs and two datasets, it claims over 95% relative reduction in Attack Success Rate with only 0.1% neuron intervention while preserving 97% of model performance. Details →First reported · updated · 3 reports anaconda.com
AI Supply Chain Attacks: How Poisoned Models and Packages Reach Production | infosec.qa
An explainer on AI supply chain and model security describes how poisoned models, compromised open-source packages, and toolchains can reach production, and catalogs common threats to AI models including prompt injection, model extraction/inversion, and dependency risks. It references the NIST AI RMF and cites the 2025 EchoLeak zero-click Microsoft 365 Copilot data-exfiltration vulnerability as an example of injection combining with agentic actions. Details →First reported youtube.com
Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data - Sachin Kumar, LexisNexis
Sachin Kumar (LexisNexis) presents peer-reviewed research (accepted at IJCNN, with open-source code) on detecting sleeper-agent backdoors in fine-tuned LLMs that pass behavioral evals yet flip to harmful output on an untested trigger. The proposed 'delta monitor' trains a sparse autoencoder on the difference between base and fine-tuned model activations, which in a controlled SQL-injection backdoor experiment flagged the backdoor with 40x the signal of crosscoder joint features, perfect precision, and zero false positives from a single layer. Details →First reported semgrep.dev
Researcher poisons open-weight AI model for under $100
Researcher Katie Paxton-Fear of Manchester Metropolitan University and Semgrep demonstrated that she could install a reliable backdoor into an open-weight AI model in about an hour for under $100, using only ten fine-tuning examples to make the model emit remote-code-execution-vulnerable code even for novel prompts, with larger models being easier to poison. The Register also cites a related PoC by Origin's David Kaplan (originsec/lora-backdoor-poc) that creates a compromised model designed to exfiltrate data via a send_email tool call. Details →First reported morphisec.com
Prompt Injection, Model Poisoning, and AI Supply Chain Attacks Explained
A Morphisec blog post titled "Prompt Injection, Model Poisoning, and AI Supply Chain Attacks Explained" presents an educational overview of major AI/LLM security threat categories. The provided page content is largely site navigation boilerplate, with the substantive material framed as an explainer of these attack classes. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector