First reported forkast.news
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported hardshell.ai
AI Data Security Guides
Hardshell's AI Data Security Guides is an index of reference material on how enterprise AI systems leak data at the retrieval layer, covering secure RAG, data poisoning, training data leakage, and AI data pipeline security. Each guide maps failure modes to controls and standards (NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, MITRE ATLAS) and links deeper dives, checklists, and a RAG leakage self-test. Details →First reported offensai.com
A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
OFFENSAI and TUCN researchers analyzed Amazon S3 Vectors, AWS's native vector store for RAG pipelines, and demonstrated that its metadata is completely unvalidated on write, letting anyone with s3vectors:PutVectors forge chunk text, spoof citation URLs, rank-flood indexes, or overwrite legitimate chunks. In testing, a single planted vector drove a clinical RAG assistant to recommend a dangerous drug dose while citing an authentic PDF, and a poisoned chunk led to command execution in a tool-enabled agent's sandbox, with CloudTrail unable to reconstruct what changed. Details →First reported · updated · 4 reports medium.com
RAG Security Guide: Prevent Enterprise AI Data Leakage
The bdemerson.com guide "RAG Security: Where Retrieval Pipelines Fail" walks through five failure classes in retrieval-augmented generation deployments: poisoned corpora, indirect prompt injection carried in retrieved documents, permission leakage across the index, embedding inversion that reconstructs text from stored vectors, and weak tenant isolation in vector stores. It frames the retrieval pipeline (ingestion, embedding, storage, retrieval, generation) as the real attack surface and offers defensive evaluation habits, referencing research such as the arXiv paper "Pirates of the RAG" on black-box knowledge-base leakage. Details →First reported arxiv.org
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
The paper "Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection" presents RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization. Experiments on CIC-UNSW-NB15 show recovery under knowledge poisoning and reduced label-flip success under prompt injection when using multi-document retrieval. Details →First reported bcs.org
How AI is reshaping threats and the steps needed to reduce risk
An opinion piece by Katerina Tasiopoulou (CEO of Threatscene) published by BCS argues that AI is reshaping the cyber threat landscape by expanding the attack surface to include foundation models, training/inference data, prompts, AI APIs, vector databases and automated workflows. The article discusses shadow AI, third-party AI supply-chain dependency and the economic asymmetry between cheap attacker tooling and costly defensive investment, recommending centrally governed, monitored AI security. Details →First reported youtube.com
How LLMs Get Hacked: Top 10 Enterprise AI Attacks and Defenses #aisecurity #cybersecurity
A TedShark Labs YouTube video walks through the top 10 enterprise LLM attack classes — including direct and indirect prompt injection, sensitive information disclosure, supply chain risks (HuggingFace, SBOMs), RAG data/model poisoning, improper output handling (XSS/SSRF), excessive agency, system prompt leakage, embedding weaknesses, hallucination, and unbounded consumption — and recommends defenses like AI gateways, DLP filters, and zero trust controls. Details →First reported · updated · 2 reports acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse. Details →First reported intigriti.com
RAG and ruin: why your existing controls may miss AI poisoning attacks
An Intigriti blog post titled "RAG and ruin: why your existing controls may miss AI poisoning attacks" discusses how retrieval-augmented generation (RAG) systems can be compromised through data/knowledge-base poisoning, and argues that traditional security controls fail to detect such AI-specific poisoning attacks. Details →First reported firetail.ai
LLM08: Vector & Embedding Weaknesses - FireTail blog posts
FireTail's blog explains OWASP LLM08: Vector and Embedding Weaknesses, covering risks such as unauthorized access, cross-context information leaks, embedding inversion attacks, data poisoning, and behavior alteration in RAG systems that use vector databases. The post lists mitigation techniques including access control, data validation, source authentication, and monitoring. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector