First reported arxiv.org
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported pasqualepillitteri.it
Prompt Injection via OCR: How a Facsimile Document Fools AI Identity Verification
Article analyzes how a facsimile (fake) document can pass an LLM-based identity verification (KYC) check via prompt injection through OCR, drawing on a CERT-AGID case involving INPS-themed smishing in which AI-based document verification was deployed. It connects the technique to established multimodal/visual prompt injection research (Simon Willison, OWASP LLM01). Details →First reported arxiv.org
Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack
A research paper proposes Gradient Token Masking (GTM), a defense against visual prompt injection and multimodal jailbreak attacks on large vision-language models. The method localizes a small subset of critical adversarial image tokens via a Hidden-State Gradient Norm attribution score and neutralizes them by masking, reducing attack success rates to near zero with negligible overhead; code is released on GitHub. Details →First reported arxiv.org
Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents
A research paper, "Piggybacking on Perception," demonstrates stealthy concurrent audio prompt injection attacks against multimodal LLM agents, using instruction augmentation and scenario concealment to hide malicious audio instructions inside user speech and hijack agents. The authors build AudioAgentSecurity, a benchmark of 8 scenarios and 10 attack patterns, evaluate 11 agents (including Gemini 3 Pro and GPT-4o-audio) achieving a 69.10% average attack success rate against Gemini 3 Pro, and propose a CADV defense using source separation and cross-modal consistency achieving over 90% detection. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector