Threat Library

This is a blog post by Simon Willison describing Bun 1.4's new Bun.WebView feature and a prototype JSON API for browser automation built with Claude Code. It is purely informational and does not describe any vulnerability, exploit, or attack against AI agents, agent frameworks, or protocols.

LangChain's SitemapLoader fails to apply its restrict_to_same_domain protection to nested sitemap references, only filtering leaf URLs. An attacker who can influence an ingested sitemap can point a nested <sitemap> element at internal or loopback addresses, causing the agent's backend to fetch and return that internal content to the caller. This is a server-side request forgery that defeats a documented security control and can leak internal network data.

Lightdash's scheduled delivery feature lets a user-supplied webhook URL be posted to directly by the GoogleChat and MicrosoftTeams clients without applying the existing SSRF protection used for MCP server URLs. This allows an authenticated user to force the server to make requests to internal, loopback, or cloud metadata endpoints and infer reachability from logged error responses. It is a classic SSRF issue in a webhook delivery path rather than an attack on agent reasoning or an AI-specific exploit, though it touches the same URL-validation utility used to secure MCP server connections.

LangBot, an LLM-based IM bot platform, allows any authenticated user to configure a STDIO MCP server, which the backend uses to launch an arbitrary subprocess with server-level privileges. This means a low-privileged account holder can achieve full remote code execution on the LangBot host, leading to data disclosure, tampering, and service disruption. No fix is currently available, making this a high-priority, actively exploitable weakness.

Neo.mjs's file-system MCP server contains a command injection flaw where two exposed tools build shell commands from unsanitized file paths. An AI agent that is tricked or manipulated into calling these tools with a malicious path can trigger arbitrary OS command execution on the host running the MCP server. This is a serious vulnerability because it turns a routine agent tool call into full system compromise.

This is a research writeup, not an attack. It describes an AI coding agent (Claude in Claude Code for web) that, upon discovering its container lacked nested virtualization support needed to run the smolvm sandbox, autonomously pivoted to using a GitHub Actions runner (which exposes /dev/kvm) to complete its testing task. There is no described exploitation, prompt injection, or security vulnerability here — it is an example of agentic problem-solving and infrastructure workaround behavior.

This entry describes Redakto, a defensive open-source tool for redacting or pseudonymizing PII from text before it is sent to an LLM, exposed via a web app, REST API, and MCP hooks. It is a privacy-enhancing research contribution, not an attack, vulnerability, or exploit. No threat to AI agents or agent infrastructure is described.

This is a defensive research paper, not an active threat, describing a post-training method to reduce 'excess-authority' errors where tool-using LLM agents perform actions beyond what a task requires. The work proposes an auditing and reward framework to teach models task-conditioned least privilege in terminal and MCP environments, reporting significant reduction in excess-authority events. There is no vulnerability disclosure, exploit, or attack technique here; severity is low as it documents mitigation research rather than a genuine threat.

The 'AI Agent by SiteGround' WordPress plugin fails to verify the upload_files capability on a media upload endpoint tied to its AI/Gutenberg block editor features, allowing low-privileged Contributor-level accounts to upload arbitrary images to the media library despite normally lacking that permission. This is a classic broken access control flaw in a plugin's admin-ajax/REST handler rather than an attack on the AI model or agent reasoning itself, and requires authenticated access at Contributor level or above.

SilkParasite is a newly identified cyber espionage operation targeting government bodies in Central Asia, first observed in late 2025. The campaign leverages seven distinct RAT families, five of which are previously undocumented, indicating a well-resourced threat actor with custom malware development capabilities.

OpenAI temporarily paused reinforcement learning (RL) training of its newest frontier models for two weeks to strengthen internal defenses and expand monitoring, citing growing risks as model capability increases. The move appears preventive, referencing a prior 'Hugging Face-like incident' as a cautionary precedent rather than disclosing an active breach or exploit.

Researchers demonstrated a remote Spectre-class microarchitectural side-channel attack against Cloudflare Workers that allows a malicious Worker to leak secret data, including JSON Web Tokens, from a co-located victim Worker in production at up to 12 bits per second. This represents a 360x throughput improvement over a 2021 proof-of-concept and confirms that multi-tenant serverless/edge compute platforms remain vulnerable to cross-tenant speculative execution leakage despite existing mitigations.

Sakura Internet, a major Japanese cloud and data center provider, disclosed unauthorized access to its sales management system, exposing contract and membership data for up to 1.36 million accounts. The breach affects a company that provides hosting and cloud infrastructure to numerous business customers, raising downstream exposure concerns.

A suspected ransomware affiliate is impersonating a legitimate data recovery firm called 'Ransom Busters,' contacting victims prior to public disclosure of breaches and offering fraudulent decryption keys and data deletion services for payment. This represents a secondary extortion layer that exploits victim desperation and confusion during active incident response, potentially resulting in double payment with no guarantee of data recovery or deletion.

OpenAI confirmed a major outage affecting ChatGPT, with users unable to log in, sign up, or access previous conversations. The incident appears to be a service availability failure rather than a security breach or exploitation of a vulnerability.

NSA, CISA, FBI, DOE, and EPA have issued a joint advisory warning of active threat actor targeting of Internet-exposed Siemens S7 Series PLCs (S7-200 through S7-1500) across U.S. critical infrastructure sectors. Threat actors are using AI-assisted development to rapidly generate exploitation scripts—built on the open-source snap7/python-snap7 library—that masquerade as legitimate OT monitoring tools to gain read/write access via the S7comm protocol, likely as reconnaissance and pre-positioning for future disruptive operations.

CISA has added CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability in MLflow, to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. Federal agencies are required under BOD 26-04 to remediate this vulnerability on a prioritized basis, and CISA urges all organizations to do the same given active in-the-wild attacks.

A critical, easily exploitable vulnerability exists in Oracle Web Services Manager (Web Services Security component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise the product, gaining unauthorized creation, deletion, modification, and full read access to all data accessible to Oracle Web Services Manager.

A critical unauthenticated remote vulnerability affects Oracle Identity Manager's Legacy UI component within Oracle Fusion Middleware, allowing full compromise via simple HTTP requests. With a CVSS score of 9.8, this flaw requires no authentication or user interaction, making it highly attractive for mass exploitation once technical details or proof-of-concept code emerge. Organizations running affected versions face risk of complete identity infrastructure takeover, including provisioning, credential, and access control data.

A critical vulnerability (CVE-2026-60720, CVSS 9.9) affects the OIM Legacy UI component of Oracle Identity Manager within Oracle Fusion Middleware, allowing a low-privileged attacker with network HTTP access to fully compromise the system. Due to a scope change, successful exploitation can impact other connected products beyond Oracle Identity Manager itself, making this a high-priority patching target for any organization running affected versions.