Threat Library

Hardware wallet maker Trezor disclosed that 67,000 U.S. customers had personal data exposed in a breach at its shipping partner ShipMonk, despite the data reportedly having been deleted. Exposed information includes names, emails, phone numbers, shipping addresses, and order numbers spanning November 2019 to August 2021. Trezor confirmed the breach does not compromise the security of its hardware wallets or private keys.

Threat actors are embedding invisible Unicode characters within phishing emails to conceal malicious lures and evade email security filters, a technique known as ASCII smuggling. This allows attackers to bypass keyword-based and pattern-matching detection systems while presenting deceptive content to human victims or automated parsers.

Rowboat versions through 0.9.1 let authenticated users register arbitrary MCP server and webhook URLs without validating the destination, enabling server-side request forgery. An attacker can abuse this to reach internal-only services or cloud instance metadata endpoints, potentially exposing credentials or internal network topology. This is a classic insecure agent-tool-configuration flaw rather than a novel agentic attack technique.

The postgres-mcp-server (versions before 1.1.7) has an incomplete SQL input validation blocklist that can be bypassed with crafted SQL, allowing data modification even when the tool is configured for read-only access. This lets a user of the MCP server escape its intended safety boundary and perform writes it should have blocked.

Researchers have catalogued 39 distinct methods that undermine passkey-based authentication without breaking FIDO2 cryptography itself, instead targeting weak points like enrollment, recovery flows, synced credential stores, and user-facing prompts. These attacks exploit implementation and process gaps across platforms rather than cryptographic flaws, meaning organizations relying on passkeys as a phishing-proof control may still be exposed to account takeover.

CISA and the G7 Cyber Security Working Group have jointly issued a call to action urging governments and organizations to begin transitioning to post-quantum cryptography (PQC) in order to protect sensitive data, authentication systems, and critical infrastructure from future quantum computing threats. This is a strategic/policy advisory rather than an active exploit, emphasizing awareness, national strategy development, R&D, public-private partnerships, and procurement integration.

An authenticated user of IBM MQ Console can submit oversized or computationally expensive requests to the AI Agent feature, tying up LLM agent workers for extended periods. Sending multiple such requests concurrently exhausts the worker pool, degrading or fully blocking the AI Agent feature for all other users. This is a classic denial-of-service issue rather than a model-manipulation or data-exfiltration threat.

Microsoft identified a high-volume phishing campaign that embeds invisible Unicode tag characters within financial lure words (e.g., 'funding') to evade traditional email security filters. The technique splits keywords at the character level so pattern-matching and keyword-based detection engines fail to flag the malicious content, while the text still renders normally to human recipients.

This roundup aggregates multiple ongoing threat campaigns including CEO/executive impersonation phishing kits, a mass compromise affecting roughly 5,000 Dropbox accounts, and OAuth consent-phishing traps that trick users into granting malicious apps access via legitimate-looking 'Allow' prompts. The common thread is abuse of trust in normal workflows—IT calls, shared files, and trusted apps—rather than technical exploitation, making these attacks highly effective and hard to detect through traditional security controls.

France's data protection authority (CNIL) fined Hôpital privé de la Loire €500,000 for failing to adequately protect the personal data of 727,000 patients and their relatives. The breach exposed sensitive health-related information, highlighting inadequate security controls and non-compliance with GDPR data protection obligations.

A local privilege escalation vulnerability exists in the OPC UA LocalDiscoveryServer (LDS) installer prior to version 1.04.420, allowing an attacker with local keyboard/display access during installation to hijack a high-privilege console window and execute arbitrary commands. Exploitation requires local access and user interaction, limiting remote attack potential, but could lead to full system compromise on affected industrial control hosts.

This is a controlled academic study (not an active exploit) showing that when an agent pulls data via MCP and then relays it to another agent via A2A, simply attaching a 'PUBLIC - OK TO SHARE' label to a record can increase the odds that sensitive substantive field values are copied verbatim into outbound messages, compared to unlabeled data. The effect is strongly model-dependent (pronounced in one Claude model, weaker or floor-limited in GPT-5.6 tiers) and the paper is explicit that this is an association in one configuration, not a proven general or causal effect. Severity is modest because it is a research finding highlighting a labeling/trust-heuristic weakness rather than a demonstrated in-the-wild attack.

This is a defensive research paper, not an active exploit, that identifies a structural weakness in OAuth-secured remote MCP tool use: a tool endpoint can remain 'authorized' even after the underlying workload executing the call has been substituted, is running stale attestation state, or reuses authority meant for a different sender. The authors propose ACLE-MCP, an invocation-scoped capability-lease architecture that binds authorization to fresh, workload-specific execution state, and demonstrate it closes these gaps with a manageable latency cost.

Boruta, an OAuth2/OIDC authorization server, logged sensitive credentials including access tokens, refresh tokens, ID tokens, and agent tokens in plaintext business event logs prior to version 0.10.0. Anyone with access to these logs, log aggregation pipelines, or the admin log viewer could extract valid tokens and reuse them for unauthorized access until expiration or revocation. This is a credential-hygiene vulnerability rather than a novel agent-specific attack, but it directly threatens agent-to-service authentication where 'agent tokens' are among the logged values.

Unit 42 reports on an incident in which an attacker used autonomous AI agents to accelerate reconnaissance, exploitation, and lateral movement, compromising an enterprise network within hours. The article is a threat intelligence/case study piece describing attacker tradecraft rather than a specific vulnerability in an agent framework, protocol, or tool; the raw data provided lacks technical detail on the AI tooling or agent architecture used. Given the absence of concrete technical indicators, this is rated medium severity as a notable trend/case study rather than an actionable exploit.

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

This is a research paper describing SIR, a red-teaming methodology that automatically discovers and refines indirect prompt injection attacks against computer-use agents (CUAs) like Claude Opus and Gemini. It demonstrates that adaptive, self-improving attack composition significantly increases attack success rates over static hand-written injections, revealing that current CUA safety benchmarks likely underestimate real-world risk. No active exploit or in-the-wild campaign is described; this is disclosed academic security research intended to improve defenses.

The sdcb 'chats' application (up to v1.12.0) contains a server-side request forgery (SSRF) vulnerability in its MCP-related fetch-tools endpoint, allowing a remote attacker to make the server issue arbitrary HTTP requests. A public exploit exists and the vendor has not responded to disclosure, so this remains unpatched. Severity is moderate given the network-based attack vector but no confirmed data exfiltration or code execution in the description.

North Korean threat actors are expanding their long-running fraudulent IT worker employment scheme into new sectors, including healthcare and sales/marketing roles. This insider threat operation uses stolen or fabricated identities to secure remote employment, generating revenue for the DPRK regime while creating potential access and data exposure risks for employers.

Microsoft Exchange Online experienced a widespread service disruption causing authentication failures, email delays, and delivery failures for customers. This is an availability incident rather than a malicious attack, but it can disrupt business email operations and any downstream services relying on Exchange authentication or mail flow.