First reported cybermagazine.com
Lead dispatch
First reported · updated · 2 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers disclosed a vulnerability in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file (indirect prompt injection) can make Kiro rewrite its own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine without any approval prompt. Because Kiro can write to these files without user consent, the human-in-the-loop approval boundary is bypassed entirely. Amazon issued CVE-2026-10591 and the flaw is now fixed.indirect-prompt-injection · tool-abuse · remote-code-execution · supply-chain
ai-agents · mcp · llm · coding-agent · ide
Severity
0.85
The wire · latest
First reported arxiv.org
Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications
The paper 'Here Comes The AI Worm' by Cohen, Bitton, and Nassi demonstrates Morris-II, a zero-click self-replicating adversarial prompt that triggers cascading indirect prompt injections across RAG-based GenAI applications such as email assistants, forcing each to exfiltrate confidential data and poison the RAG of additional applications. The authors evaluate propagation across context sizes, embedding algorithms, and hop counts, and introduce a guardrail called Virtual Donkey achieving a 1.0 true-positive rate at a 0.015 false-positive rate. Details →First reported · updated · 2 reports enklypesalt.com
Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents
Researcher Håkon Måløy disclosed a technique (tracked as CVE-2026-50522) in which hidden instructions embedded in a Word document make Microsoft 365 Copilot rewrite report figures and copy the same instructions into the newly generated file, which then re-triggers the behavior in a subsequent Copilot drafting session — a self-replicating indirect prompt injection. Microsoft confirmed the behavior and deployed two mitigations (blocking the original prompt wording and upgrading to GPT-5.5), but Måløy reports the attack class still reproduced on GPT-5.6 and remained exploitable at publication on July 28, 144 days after his report. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector