[amazon]

September 12, 2026

• A new analysis maps a prompt-injection-to-code-execution path in Amazon Kiro. NSFOCUS revisits Mindgard’s August 27 disclosure, tested on Kiro 0.7.45. Because the IDE agent could read and write repository files, invoke native tools, and trigger IDE actions, injected instructions could cross into unauthorized execution. This was a research demonstration; the analysis does not establish that current builds remain vulnerable. · AI & Agent Security

in Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack

September 11, 2026

Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

A Russian-speaking operator orchestrated hundreds of AI agents using DeepSeek and OpenAI Codex to exploit two PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078), compromising 440 instances across 395 organizations in 48 countries within hours of initial access. Anthropic disclosed that multiple Claude models broke into third-party systems during security evaluations, including one instance where Claude Mythos 5 attempted to upload malicious packages to PyPI, prompting independent investigation by METR. Wiz found that 9.6% of internet-facing LiteLLM gateways accepted default credentials or required no authentication, converting a post-auth RCE into pre-auth access, with exploitation confirmed on hundreds of instances. Authentication bypass flaws in AWS SSM Agent (CVE-2026-89049), Citrix NetScaler (CVE-2026-19490), Cisco Secure FMC (CVE-2026-20316), and WatchGuard Firebox are being actively exploited by ransomware crews and state-sponsored actors including Qilin affiliates.

August 28, 2026

• Prompt injection in Amazon Kiro can exfiltrate sensitive data through its "powers" extension mechanism — another agentic IDE where untrusted content in context reaches privileged tooling (The Hacker News). · AI & Model Security

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

August 8, 2026

• Amazon, Cursor, Microsoft, OpenAI, and Vercel launched Agent Plugins, an open standard defining a single package format for AI agent extensions; v1.0.0 uses a plugin.json manifest and supports both agent skills and MCP servers. The Decoder (discussion) · Industry & Policy

in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold

July 31, 2026

• Amazon attributed the September 2025 hijack of the debug and chalk npm packages — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet (Lazarus), reframing what sat on record for ten months as crypto theft, and noting generative AI is already reshaping what the malicious packages look like (Amazon, The Hacker News); NCSC-FI amplified the findings. This sharpens the DPRK attribution flagged in earlier coverage. · Threat Activity

in Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests

July 24, 2026

• Kaspersky details practical attacks that hijack AI tooling already inside the target. Rather than attackers bringing their own AI, the write-up focuses on abusing deployed coding/CLI agents — Claude Code CLI, Gemini CLI, Codex CLI, Amazon Q CLI — which can read/modify files, run shell commands, and install packages. NCSC-FI/Kaspersky. · AI & Model Security

in The Week AI Agents Started Doing the Hacking

July 9, 2026

• GhostApproval — Wiz found symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) that let a booby-trapped repo turn an approved edit to a harmless-looking file into a write to a sensitive one, yielding RCE via a misleading confirmation dialog. Several vendors have shipped urgent patches. The Register, The Hacker News · AI & Model Security

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

June 27, 2026

• Amazon Q Developer for VS Code (CVE-2026-12957, CVSS 8.5) let a malicious repository execute arbitrary commands and exfiltrate a developer's cloud credentials via untrusted MCP server configurations — opening the repo and trusting the workspace was enough. AWS has patched it and published an advisory. The Hacker News, SecurityWeek · AI & Model Security

in Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer