First reported embracethered.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported google.com
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
Researchers from Tel Aviv University, Technion, and Intuit disclosed 'HalluSquatting' (adversarial hallucination squatting), a technique that exploits the predictable tendency of LLMs to hallucinate resource identifiers (repos, skills, URLs) in tool calls. By preemptively registering the hallucinated resources, attackers can achieve scalable, untargeted remote tool execution and remote code execution across popular agentic LLM applications without any direct injection channel, potentially building agentic botnets. Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported nist.gov
NVD - CVE-2026-30741
CVE-2026-30741 is a remote code execution vulnerability in OpenClaw Agent Platform v2026.2.6 that allows attackers to execute arbitrary code via a request-side prompt injection attack. CISA-ADP rated it CVSS 3.1 base 9.8 (Critical), classified as CWE-94 code injection, with public exploit references including a GitHub PoC repository. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported · updated · 2 reports redhat.com
CVE-2026-42271 - Red Hat Customer Portal
CVE-2026-42271 is an Important-severity (CVSS 8.8) flaw in LiteLLM, an AI gateway/proxy for LLM APIs, where two MCP-server preview endpoints accepted full server configurations including command-execution parameters without adequate role checks. An authenticated user with even low-privilege internal-user keys could send a crafted configuration to achieve arbitrary OS command execution on the proxy host; Red Hat notes known public exploits and the CVE is tracked in CISA's KEV catalog, with fixes shipped in LiteLLM v1.83.7-stable and Red Hat OpenShift AI / Ansible Automation Platform errata. Details →First reported · updated · 3 reports theregister.com
Red teamers turned Claude Desktop into a double agent to do their evil bidding
Oasis Security disclosed "PromptFiction," a vulnerability in Anthropic's Claude Desktop where a single click on a trusted-looking claude:// URL silently submitted attacker-controlled prompts to the assistant with no user confirmation. Chained with the earlier "Claudy Day" trio of flaws, it could enable silent exfiltration of prior conversations and — when Anthropic's official Filesystem MCP server is installed — file read/write, persistence, and remote code execution. Anthropic has fixed the flaw. Details →First reported · updated · 2 reports adversa.ai
The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
Adversa AI researcher Rony Utevsky details a Cursor IDE vulnerability (dubbed DeepJack) where a crafted `cursor://` deeplink installs an attacker-controlled MCP server that runs arbitrary, unsandboxed commands under the victim's account after one click and one confirmation. The install dialog renders the command in a single-line field so a malicious tail is pushed off-screen, and double-URL encoding disguises the `mcp/install` URI as a routine `pr-review` link. Cursor acknowledged the root cause but closed the reports as duplicates, and build 3.9.8 reportedly remains vulnerable. Details →First reported · updated · 3 reports catonetworks.com
DuneSlide: Two Critical RCE vulnerabilities
Cato AI Labs disclosed two critical vulnerabilities in Cursor IDE, dubbed DuneSlide (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8), that allow zero-click prompt injection to escape the editor's command sandbox and achieve remote code execution. CVE-2026-50548 abuses the run_terminal_cmd tool's working_directory parameter to add attacker-chosen folders to the allowed-write list, letting an attacker overwrite the cursorsandbox binary or shell startup files and turn sandboxed commands into full system compromise. Cursor patched both in version 3.0, released April 2; earlier 2.x builds remain exposed. Details →First reported ainowinstitute.org
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
The AI Now Institute published an exploit brief and PoC (GitHub: Boyan-MILANOV/friendly-fire-ai-agent-exploit) demonstrating remote code execution against Anthropic's Claude Code CLI (auto-mode) and OpenAI's Codex CLI (auto-review) when these defensive coding agents are used to assess third-party or open-source libraries. The attack embeds prompt injections across a library's source code to hijack the AI agent, requiring no hooks, skills, plugins, MCP servers, or config files as an injection vector. Details →First reported 0din.ai
Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents
Mozilla 0DIN researchers Andre Hall and Miller Engelbrecht demonstrated a proof-of-concept attack where a clean GitHub repository with no malicious code uses indirect prompt injection to trick AI coding agents like Anthropic's Claude Code into chaining routine actions that grant an attacker shell command access and persistence. The malicious payload never appears in the repository; instead it is pulled at runtime from DNS after the agent blindly trusts the repo, evading scanners and human review. Details →First reported arxiv.org
A Security Analysis of the OpenClaw AI Agent Framework
Researchers detailed three now-patched high-severity flaws (GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, GHSA-575v-8hfq-m3mc; CVE-2026-46817, CVE-2026-55200) in the OpenClaw personal AI assistant framework that compose into a complete unauthenticated remote code execution path — from an LLM tool call triggered via a WhatsApp message to command execution on the host. The chain abuses OS command injection and an incomplete disallowed-input filter in the exec allowlist, whose closed-world lexical parsing is defeated by shell line continuation, busybox multiplexing, and GNU option abbreviation; a companion arXiv analysis taxonomizes 470 advisories and shows a malicious plugin skill bypassing the exec pipeline entirely. Details →First reported trendmicro.com
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Threat actors are actively exploiting CVE-2026-33017 (CVSS 9.3), an unauthenticated remote code execution flaw in Langflow, an AI application/agent workflow builder, to deploy a Monero cryptocurrency miner on exposed endpoints. Details →First reported microsoft.com
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release. Details →First reported thehackernews.com
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed an exploit chain called AutoJack that hijacks an AI browsing agent to achieve host code execution. By steering the agent to load an attacker's web page, the page's JavaScript reaches a privileged local service and spawns a process on the host with no credentials or further user interaction. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector