First reported · updated · 13 reports openai.com
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported thenewstack.io
Microsoft built a prompt injection detector. Then it caught a phishing campaign instead.
The New Stack reports that Microsoft built a prompt injection detector aimed at AI pipelines and, in the course of hunting for Unicode/ASCII smuggling attacks, the tooling surfaced a phishing campaign instead. The piece discusses how invisible Unicode/ASCII smuggling can be used to hide malicious instructions inside text fed to LLM-based AI pipelines. Details →First reported · updated · 5 reports kili-technology.com
What Is AI Red Teaming? The 2026 Guide - Mindgard
Mindgard's 2026 guide explains what AI red teaming is, how it differs from traditional penetration testing, and the frameworks it is built on — including MITRE ATLAS, the OWASP Top 10 for LLM Applications, and Microsoft's open-source PyRIT toolkit. It describes structured adversarial testing of models, AI agents, and surrounding systems using multi-turn attack strategies such as Crescendo, TAP, and Skeleton Key. Details →First reported youtube.com
Morris II: The First AI Worm?
A Zyber YouTube video explains Morris II, a controlled research demonstration by Stav Cohen, Ron Bitton, and Ben Nassi showing how self-replicating adversarial prompts can create a worm-like chain reaction across connected generative-AI applications such as AI-powered email assistants. The video frames it as a security experiment revealing a possible future risk, not an active outbreak, and points to the arXiv paper and IBM overview as sources. Details →First reported · updated · 4 reports edgelabs.ai
AI Agent Security Risks: Mitigation for Enterprises
Sweet Security's "AI Agent Security Risks" guide is an enterprise-focused explainer describing how AI agent workflows can be attacked and how to mitigate them, covering prompt injection via untrusted context, poisoned documents and memory, over-broad credentials, action logging, and human approval for high-impact actions. The reference page synthesizes mitigation guidance and cites external frameworks (OWASP LLM Top 10, NIST, MITRE ATLAS) and research such as the AgentPoison memory/knowledge-base poisoning paper. Details →First reported · updated · 7 reports sprinklenet.com
RAG Prompt Injection: Risks, Examples & Defenses — Everyday on AI
An explainer on RAG prompt injection describes how attackers weaponize the retrieval layer of enterprise RAG pipelines rather than the LLM prompt box, walking through injection vectors such as retrieval query manipulation and cross-vector database poisoning, plus a mitigation framework. It references OWASP's RAG-specific additions to the LLM Top 10 and academic work on indirect prompt injection (IPI), including arXiv research showing a single poisoned email could coerce GPT-4o into exfiltrating SSH keys in a multi-agent workflow. Details →First reported medium.com
What I Learned Reversing Embeddings for OWASP’s GenAI Red Team Lab Subtitle: A merged pull request, a threat model that had to change, and an attack that only sort of worked
A contributor's write-up describes reverse-engineering the embeddings used in the RAG pipeline of OWASP's GenAI Red Team Lab (Issue #29), implementing an embedding inversion attack against vector databases as part of a merged pull request. The author recounts revising the threat model and reports that the attack 'only sort of worked' against the deliberately vulnerable sandbox. Details →First reported codesecai.com
Zero-Click Prompt Injection: AI Web Browsing Exploits (2026)
A guide on codesecai.com explains "zero-click prompt injection" against AI web-browsing agents, where adversaries embed invisible instructions in public HTML/CSS/Markdown (zero-opacity text, micro-fonts, comments, image pingbacks) that headless browser extractors ingest. It describes how injected Markdown image tags trigger outbound requests that silently exfiltrate user chat history to attacker-controlled servers on platforms like Perplexity, ChatGPT Search, and Microsoft Copilot. Details →First reported forkast.news
Memory Poisoning: AI Security Threat Explained | Forkast Learn
Forkast's glossary entry defines memory poisoning, an attack against LLM-based AI agents in which adversaries inject malicious or false data into an agent's persistent long-term memory layer (vector databases, semantic indexes, grounding caches, or stored conversation histories). The entry explains its temporal decoupling and persistent blast radius, cites OWASP's ASI06 classification, and describes common vectors such as poisoned PDFs, web pages, and support tickets leveraging indirect prompt injection. Details →First reported · updated · 9 reports nhimg.org
Prevent Prompt Injection Attacks: 12 Steps [2026]
"Prevent Prompt Injection Attacks: 12 Steps [2026]" is a defensive explainer that walks through best-practice mitigations against direct and indirect prompt injection in LLM- and agent-based applications, drawing on guidance such as semantic intent classification, output controls, and least-privilege prompting. The piece aggregates reference material from sources including OWASP, Palo Alto Networks, and vendor writeups rather than presenting a new attack or finding. Details →First reported · updated · 3 reports thehackernews.com
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated remote code execution flaw in Langflow's custom component code validator, to run arbitrary Python as root and harvest credentials from AI application servers. VulnCheck honeypots observed hundreds of attempts (rising from 50 to 360) querying environment variables like LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, and reading /root/.cache/langflow/secret_key, with traffic primarily from Russia. Details →First reported humansecurity.com
AI Crawler, Agent, and Bot Guide: How to Identify AI Traffic Patterns
HUMAN Security's explainer distinguishes categories of AI-driven web traffic—scrapers and crawlers that feed LLMs (e.g. GPTBot, ClaudeBot), RAG retrieval bots, AI browsers, and full agentic systems that plan and act across multiple steps. The piece argues these classes behave differently and that lumping them together leads security teams toward blunt, ineffective controls. Details →First reported arxiv.org
AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents
A SureBright explainer on "agent hijacking" (agentjacking) describes how attackers can plant malicious instructions in ecommerce content — such as customer reviews — that an AI shopping agent reads during normal product research, steering it to phishing sites or leaking session data. The piece grounds its claims in the AgentVigil research (arXiv:2505.05849), a black-box fuzzing framework that automatically discovers indirect prompt injection vulnerabilities in LLM agents and demonstrated 70-71% attack success against agents built on o3-mini and GPT-4o. Details →First reported arxiv.org
Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems
Researchers at Tampere University present Trustworthy RAG, an Evaluation Agent middleware that detects knowledge poisoning and misinformation in Retrieval-Augmented Generation systems by combining Natural Language Inference factual verification, a five-signal poison detector, and a Trust Index scoring formula. On TruthfulQA with Llama 3.3 70B the agent reaches 91% accuracy and 100% recall on instruction injection, though subtle in-place entity swaps remain hard to detect; the authors release the approach, an attack generator, and experimental artifacts at github.com/GPT-Laboratory/TrustworthyRAG. Details →First reported grasp.study
Grasp - Building a Sandwich Defense
Grasp's lesson "Building a Sandwich Defense" is an educational walkthrough teaching how to defend LLM applications against indirect prompt injection, where malicious instructions are hidden in documents, webpages, or emails an agent retrieves. It introduces the "sandwich" prompt-engineering technique to isolate untrusted content and a moderation-endpoint architecture that inspects data flowing into and out of the model. Details →First reported hardshell.ai
AI Data Security Guides
Hardshell's AI Data Security Guides is an index of reference material on how enterprise AI systems leak data at the retrieval layer, covering secure RAG, data poisoning, training data leakage, and AI data pipeline security. Each guide maps failure modes to controls and standards (NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, MITRE ATLAS) and links deeper dives, checklists, and a RAG leakage self-test. Details →First reported arxiv.org
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
InjecMEM, described in a paper by researchers from Shanghai Jiao Tong University and Ant Group, is a memory-injection attack that plants hidden instructions in an LLM agent's persistent memory with a single interaction and no read/edit access to the memory store. Using a retriever-agnostic anchor plus a gradient-optimized adversarial command, it steers later responses on a target topic, achieving up to 35.4% retrieval success and 76.6% attack success on MemoryOS while leaving non-target queries unaffected; code is published on GitHub. Details →First reported google.com
Best practices for securing agent interactions with Model Context Protocol | AlloyDB for PostgreSQL | Google Cloud Documentation
Google Cloud documentation lays out best practices for securing AI agent interactions with AlloyDB for PostgreSQL over the Model Context Protocol (MCP), covering least-privilege access, database-native granular controls, treating data and user inputs as untrusted, preventing unauthorized tool chaining, limiting access in multi-tenant databases, and enabling Model Armor safety thresholds plus auditing. Details →First reported · updated · 2 reports escape.tech
LLM security testing: how to pentest LLMs and MCP servers
Escape.tech publishes a methodology for pentesting LLM applications and MCP servers, mapping attacks to the OWASP Top 10 for LLM Applications 2025 (prompt injection, improper output handling, excessive agency, system-prompt leakage) and demonstrating them against a self-built vulnerable FastMCP lab. The guide explains why LLM testing breaks the web-app playbook — no parser boundary, non-deterministic interpreter, no sanitization line — and notes MCP tool descriptions and tool responses both reach the model as trusted injection channels, referencing tool poisoning and rug-pull attacks. Details →First reported · updated · 22 reports medium.com
Prompt Injection: How to Protect AI Agents and LLM Apps
An educational guide, "Prompt Injection: How to Protect AI Agents and LLM Apps," explains the instruction-vs-data trust problem underlying direct and indirect prompt injection and lays out a layered defense model (least privilege, tool access controls, approvals for consequential actions, structured tool arguments, validation, sandboxing, monitoring, and adversarial evals). The piece synthesizes framing from OWASP LLM Top 10 (LLM01), OpenAI, and Anthropic, using examples such as malicious instructions hidden in emails, webpages, RAG chunks, and MCP resources. Details →First reported · updated · 21 reports everydayonai.com
Prompt Injection Hacking: Emerging Trade Secret, Employment, and Litigation Risks
An article from Search Engine Land explains how prompt injection has evolved to threaten brands and AI workflows, citing examples such as Permiso's 'ChatGPhish' where malicious payloads embedded in ordinary webpages coerce AI assistants (ChatGPT, Perplexity) into rendering spoofed account alerts and malicious QR codes inside the chat interface, bypassing URL blocklists. It surveys additional vectors including LLM referral hijacking via semantic embedding, weaponized multimodal inputs (podcasts, video, voice agents), rogue AI customer-support agents, and supply-chain risk from unvetted AI vendors. Details →First reported snyk.io
Why Your AI Application Is Exposed Snyk
Snyk's blog explains how modern AI applications remain exploitable through 'chained risk' where prompt templates, RAG, tool calls, and MCP endpoints combine to bridge untrusted prompts to backend execution sinks, even when individual scanners report no isolated vulnerabilities. The piece argues that DAST, AI penetration testing, and AI red teaming address three distinct lenses, and that no single tool covers cross-layer behavioral emergence. Details →First reported huggingface.co
patronus-studio/wolf-defender-prompt-injection
Wolf Defender is a multilingual ModernBERT-based (mmBERT-base) binary classifier published on Hugging Face by Patronus that detects prompt injections and jailbreak-style instructions before untrusted content reaches an LLM. The v2 release provides a 2,048-token context window, ONNX deployment variants, and benchmark results showing improved specificity on hard-benign inputs, and is intended as a local guardrail layer for AI agents, chatbots, and retrieval pipelines. Details →First reported · updated · 2 reports netwrix.com
AI Jailbreak Explained: Techniques, Risks, Examples & Prevention
Netwrix's cybersecurity glossary entry on AI jailbreaking defines the practice of bypassing safety guardrails built into AI models and catalogs common techniques including direct prompt injection, role-playing attacks, indirect prompt injection via external content, gradual context manipulation, and infrastructure-level tampering. The entry frames jailbreaking as a growing enterprise security, compliance, and governance concern and recommends combining AI safeguards with monitoring and oversight. Details →First reported escape.tech
AI vs AI: How Cascade exploited an AI agent in production
Escape's AI pentesting engine, Cascade, bypassed a production AI agent's prompt-injection guardrail on its second attempt by reframing the same request as an innocuous research/documentation query, causing the agent to disclose its full system prompt, tool list, tool-calling rules, output formatting, and session identifiers. The bypass relied on social-engineering-style pretexting rather than a technical exploit, with Cascade autonomously rewording its payload after reading the initial refusal. Details →First reported · updated · 8 reports enklypesalt.com
Document-borne AI worms can self-propagate through Copilot for Word | Hacker News
Researchers at enklypesalt.com demonstrated a document-borne, self-replicating prompt-injection worm that spreads through Microsoft Copilot for Word: a malicious Word document contains a hidden self-propagating prompt that, when processed by Copilot, forces the assistant to embed the same payload into other documents it drafts or edits, enabling zero-click chain propagation and data exfiltration. The write-up notes that at publication no robust mitigation for the broader vulnerability class was available, and the work is associated with assigned CVEs (CVE-2026-55145, CVE-2026-50522). Details →First reported · updated · 2 reports aclanthology.org
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks
MM-PoisonRAG is a research paper presenting local and global knowledge poisoning attacks that disrupt multimodal retrieval-augmented generation (RAG) in multimodal large language models (MLLMs). The work demonstrates how MLLMs' reliance on retrieval exposes them to poisoned knowledge injected into the retrieval corpus, manipulating generated outputs. Details →First reported neural-industries.ai
The AI Security Checklist
The AI Security Checklist from Neural Industries distills twelve practical controls for shipping LLM and agent systems, citing work by Steve Wilson, Andrej Karpathy, Simon Willison, and Nicholas Carlini and mapping them to the OWASP LLM Top 10, NIST AI RMF, Google SAIF, and MITRE ATLAS. Controls cover treating model output as untrusted, engineering against prompt injection, breaking the 'lethal trifecta', least-privilege for agents/tools, human approval for high-impact actions, securing the RAG layer, hardening the model/data supply chain, and continuous red-teaming. Details →First reported arxiv.org
MAPLE-Guard: Memory-Aware Link EnforcementAgainst Memory-Link Poisoning in Multi-Agent Systems
MAPLE-Guard is a defense presented in an arXiv paper against memory-link poisoning in LLM-based multi-agent systems, where a single poisoned memory write can be retrieved, promoted into shared memory, and reused by agents that never saw the original attack. The guard places gates at write, retrieval, promotion, and cross-agent reuse, reportedly lowering attack success rate from 38.2% to 0.9% on LongMemEval and 34.7% to 0.2% on AppWorld, with code released on GitHub. Details →First reported · updated · 5 reports nhimg.org
AI Agent Memory Poisoning: Persistent Agent Attacks
An explainer on agent memory poisoning describes how a single adversarial write into an LLM agent's persistent memory store is retrieved and executed across future sessions, unlike a prompt injection that dies when the turn ends. It draws on red-team research (AgentPoison, which backdoors memory/RAG knowledge bases, and MINJA, which injects malicious records via query-only interaction) and recommends architectural defenses: authorising writes outside the model, provenance stamping, trust-weighted retrieval, and quarantining new writes. Details →First reported · updated · 10 reports giskard.ai
What Is Generative AI Security? Complete Guide
A Mindgard guide explains generative AI guardrails — the input, output, and agent-level controls that screen prompts, retrieved data, and tool actions to keep LLM systems within safe boundaries. The guide notes that guardrails can give a false sense of safety, citing Mindgard's peer-reviewed research (arXiv:2504.11168) that bypassed six leading guardrail systems, including Microsoft Azure Prompt Shield and Meta Prompt Guard, with up to 100% evasion success. Details →First reported techupdate24.com
Stop Hijacked AI Agents: AWS Bedrock AgentCore User Context
An AWS-based guidance article describes how Amazon Bedrock AgentCore can prevent hijacked AI agents from leaking unauthorized data by moving authorization out of the agent's code into the infrastructure layer, using JWT validation via Cognito, scoped DynamoDB credentials via AssumeRoleWithWebIdentity, department metadata filters for Knowledge Bases, and RFC 8693 On-Behalf-Of token exchange for Salesforce. The approach ensures that even a fully prompt-injected agent remains cryptographically constrained to the requesting user's permissions. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
An ICML 2026 workshop paper by Hyunseok Paeng, "The Injection Paradox," reports a reproducible failure mode in RAG-based LLM recommendation where prompt injections embedded in retrieved documents backfire, suppressing the injected brand below baseline in safety-trained Claude models (Claude Opus 4.6 dropped the target brand from a 54% baseline to zero top-2 recommendations). The suppression propagates to unmodified documents of the same brand, while GPT models showed the opposite effect, raising a reverse-attack scenario where an adversary poisons a competitor's documents to suppress that competitor's brand. Details →First reported · updated · 4 reports salt.security
Agentic AI Security - Best Practices for Enterprise Teams | Fidelis Security
An explainer on securing agentic AI in the enterprise outlines risks unique to autonomous agents, including unrestricted API/tool access, indirect prompt injection and workflow hijacking via RAG pipelines, data exfiltration, privilege escalation, and supply-chain attacks through misconfigured Model Context Protocol (MCP) servers, alongside best-practice mitigations. Details →First reported howtoharden.com
LangChain Hardening Guide
The LangChain Hardening Guide on howtoharden.com is a defensive reference covering security hardening for LangChain, LangSmith, and LangGraph, including SSO/RBAC, SDK CVE patching (CVE-2026-25528 SSRF, CVE-2026-25750 token leak), prompt-injection defense mapped to OWASP LLM Top 10, tracing redaction, sandboxing untrusted code, and agent tool least-privilege. The guide is tiered (L1-L3) and links companion code packs of hardening scripts on GitHub. Details →First reported · updated · 3 reports youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP - YouTube
An explainer on AI data poisoning describes how attackers corrupt the data a model learns from, fine-tunes on, or retrieves — including training data, alignment data, and RAG knowledge bases — so a poisoned model behaves as the attacker intends while passing ordinary validation. It distinguishes data poisoning from prompt injection, jailbreaking, evasion, and model poisoning, and notes research (e.g. Carlini et al.'s web-scale poisoning work) showing under 1% poisoned data can measurably change behavior, recommending provenance, access control, monitoring, and rollback as layered defenses. Details →First reported arxiv.org
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
The arXiv paper "Hidden in Memory: Sleeper Memory Poisoning in LLM Agents" (2605.15338), explained in a companion Medium write-up, demonstrates a delayed attack in which adversarial content in a document, webpage, or repository causes a stateful LLM assistant to store a fabricated memory about the user that re-emerges across future sessions. Across tested assistants, poisoned memories were written up to 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6, and among successful retrievals they steered attacker-intended agentic actions in 60–89% of evaluations; the authors release code on GitHub. Details →First reported utimaco.com
Data Poisoning: Protect AI from Manipulated Data
A Utimaco blog post discusses data and model poisoning as integrity attacks against RAG and training pipelines, citing OWASP's classification of manipulation of pre-training, fine-tuning, and embedding data. The piece argues for verifying data integrity before inference using cryptographic digital signatures and HSM-protected signing keys, framed around Utimaco's General Purpose HSM offering. Details →First reported cockroachlabs.com
Multi-Tenant AI Agent Data Isolation | CockroachDB
A CockroachDB vendor blog by Quentin Packard argues that data isolation for multi-tenant AI agents must be enforced at the database layer via row-level security (RLS) and geo-partitioning rather than in application code. The piece walks through schema design, RLS isolation policies, tenant-context pipelines, and agent tool implementations, noting AI agents widen the blast radius of a leaked or forgotten query filter and that RLS does not protect against every failure mode. Details →First reported cyberdefensemagazine.com
The Zero Trust Architecture For AI Agents On Google Cloud
An article by a Google author on Cyber Defense Magazine outlines a Zero Trust architecture for securing AI agent workloads on Google Cloud, describing the agentic threat landscape (prompt injection, insecure tool use/excessive agency, RAG data exfiltration and poisoning, denial-of-wallet) and defensive pillars such as credentialless Workload Identity, IAM Conditions, and Cloud Armor edge defenses against prompt injection. Details →First reported offensai.com
A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
OFFENSAI and TUCN researchers analyzed Amazon S3 Vectors, AWS's native vector store for RAG pipelines, and demonstrated that its metadata is completely unvalidated on write, letting anyone with s3vectors:PutVectors forge chunk text, spoof citation URLs, rank-flood indexes, or overwrite legitimate chunks. In testing, a single planted vector drove a clinical RAG assistant to recommend a dangerous drug dose while citing an authentic PDF, and a poisoned chunk led to command execution in a tool-enabled agent's sandbox, with CloudTrail unable to reconstruct what changed. Details →First reported · updated · 4 reports medium.com
RAG Security Guide: Prevent Enterprise AI Data Leakage
The bdemerson.com guide "RAG Security: Where Retrieval Pipelines Fail" walks through five failure classes in retrieval-augmented generation deployments: poisoned corpora, indirect prompt injection carried in retrieved documents, permission leakage across the index, embedding inversion that reconstructs text from stored vectors, and weak tenant isolation in vector stores. It frames the retrieval pipeline (ingestion, embedding, storage, retrieval, generation) as the real attack surface and offers defensive evaluation habits, referencing research such as the arXiv paper "Pirates of the RAG" on black-box knowledge-base leakage. Details →First reported arxiv.org
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
The paper "Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection" presents RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization. Experiments on CIC-UNSW-NB15 show recovery under knowledge poisoning and reduced label-flip success under prompt injection when using multi-document retrieval. Details →First reported · updated · 13 reports senthex.com
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
Analysis piece on securing agentic AI systems, synthesizing prompt injection attack patterns, Simon Willison's 'lethal trifecta' (private data, untrusted content, external communication), the EchoLeak zero-click exploit (CVE-2025-32711) against Microsoft 365 Copilot, and A2A protocol risks, arguing for defense-in-depth moving from per-action checks to trajectory-level assurance. Draws on OWASP LLM Top 10, arXiv research, and vendor threat writeups to map defenses for LLM- and agent-based applications. Details →First reported northflank.com
How to isolate AI agents that have access to company data | Blog
A Northflank blog post explains how to isolate AI agents that have access to company data, covering isolation boundaries across identity, retrieval path, tools, runtime, memory, network, and credentials. The guide frames indirect prompt injection in emails, documents, or repositories as a trigger for cross-system incidents and recommends short-lived task-scoped credentials, deterministic policy layers, and sandboxed execution, while promoting Northflank's microVM sandboxes and BYOC deployment. Details →First reported bcs.org
How AI is reshaping threats and the steps needed to reduce risk
An opinion piece by Katerina Tasiopoulou (CEO of Threatscene) published by BCS argues that AI is reshaping the cyber threat landscape by expanding the attack surface to include foundation models, training/inference data, prompts, AI APIs, vector databases and automated workflows. The article discusses shadow AI, third-party AI supply-chain dependency and the economic asymmetry between cheap attacker tooling and costly defensive investment, recommending centrally governed, monitored AI security. Details →First reported · updated · 5 reports paloaltonetworks.com
What Is Data Poisoning? [Examples & Prevention]
Palo Alto Networks' Cyberpedia entry explains data poisoning against AI/ML systems: how attackers corrupt training data to manipulate model behavior, the different attack types, where poisoning occurs in the pipeline, its distinction from prompt injection, and defensive measures. The page is an evergreen reference/glossary entry rather than a report of a specific incident or new finding. Details →First reported youtube.com
How LLMs Get Hacked: Top 10 Enterprise AI Attacks and Defenses #aisecurity #cybersecurity
A TedShark Labs YouTube video walks through the top 10 enterprise LLM attack classes — including direct and indirect prompt injection, sensitive information disclosure, supply chain risks (HuggingFace, SBOMs), RAG data/model poisoning, improper output handling (XSS/SSRF), excessive agency, system prompt leakage, embedding weaknesses, hallucination, and unbounded consumption — and recommends defenses like AI gateways, DLP filters, and zero trust controls. Details →First reported · updated · 2 reports acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse. Details →First reported arxiv.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
Researchers from University of Technology Sydney and collaborators present D-SCAN (Document-level Signal Collapse Analysis), a lightweight framework that detects RAG poisoning attacks by monitoring an internal signature they call 'Attention Collapse'—where a generator's attention entropy decreases and concentrates on injected adversarial documents. The paper shows that output-side signals like perplexity fail because poisoned outputs can exhibit lower perplexity (false confidence), and that D-SCAN can detect attacks even when they do not alter the final answer, with code released on GitHub. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector