First reported openai.com
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported pillar.security
The Week of Sandbox Escapes
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged. Details →First reported · updated · 3 reports catonetworks.com
DuneSlide: Two Critical RCE vulnerabilities
Cato AI Labs disclosed two critical vulnerabilities in Cursor IDE, dubbed DuneSlide (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8), that allow zero-click prompt injection to escape the editor's command sandbox and achieve remote code execution. CVE-2026-50548 abuses the run_terminal_cmd tool's working_directory parameter to add attacker-chosen folders to the allowed-write list, letting an attacker overwrite the cursorsandbox binary or shell startup files and turn sandboxed commands into full system compromise. Cursor patched both in version 3.0, released April 2; earlier 2.x builds remain exposed. Details →First reported arxiv.org
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →First reported github.com
GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI
Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution. Details →First reported howtoharden.com
Cursor Hardening Guide
The Cursor Hardening Guide from howtoharden.com compiles defensive controls for the Cursor AI code editor, covering AI privacy settings, MCP server security, agent sandboxing, API key management, rules-file integrity, and extension supply-chain risk. It draws on 2025-2026 CVE analysis (including CurXecute RCE via MCP prompt injection CVE-2025-54135, MCPoison persistent compromise CVE-2025-54136, and sandbox/file-overwrite bugs) and ships runnable config packs mapped to OWASP LLM/Agentic Top 10, NIST AI RMF, and MITRE ATLAS. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector