Threat Library

Trigger.dev, a platform used to build and deploy AI agents and workflows, had a critical authorization flaw where the deployment lookup did not verify that a deployment belonged to the caller's own project. Any authenticated user with a valid API key for one project could reference another project's deployment ID and hijack it by linking an attacker-controlled background worker, altering its deployment state. This allows cross-tenant compromise of AI agent deployments, potentially letting an attacker inject their own worker code into a victim's production agent pipeline.

Trigger.dev, a platform for managing AI agent workflows, fails to check Google's email_verified flag during OAuth login, allowing an attacker to create a Google account with an email matching an existing victim's account and take it over. Because Trigger.dev orchestrates AI agent deployments, compromising an account gives an attacker control over that user's agents, workflows, secrets, and API keys. This is a classic identity-spoofing/authentication flaw rather than a novel agentic attack, but it has serious downstream impact on agent supply-chain trust.

A vulnerability in Trigger.dev, a platform for orchestrating managed AI agents and workflows, allows any authenticated tenant to pollute Object.prototype in the shared webapp process via a metadata update API. This corrupts database queries and metrics across all tenants and can break worker authentication or crash the process, resulting in a cross-tenant denial-of-service condition. The issue is fixed in version 4.5.6.

An MCP server component (mcp-rdf-explorer 1.0.0) contains a server-side request forgery vulnerability in its explore_url tool function, allowing a remote attacker to make the server issue arbitrary HTTP requests by manipulating the url argument. A public exploit exists and the vendor has not responded to disclosure, leaving the issue unpatched.

The auth-fetch-mcp server, which lets AI assistants fetch authenticated web content, has a flawed SSRF blocklist that fails to catch IPv4-mapped IPv6 loopback addresses in their hex-normalized form. An attacker who can influence the URL passed to the fetch tool (directly or via prompt injection) can reach internal loopback services that the security control was explicitly designed to block. This is exploitable out-of-the-box with no special configuration.

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

Flowise versions before 3.1.3 have a flawed regex-based code validator in the CSV and Airtable Agent nodes that fails to block dangerous pandas functions such as pd.read_json(). Attackers can use prompt injection to smuggle malicious Python code through these nodes without authentication, leading to arbitrary code execution, internal SSRF, and data exfiltration. Because the vulnerable prediction API requires no authentication, this is a low-effort, high-impact attack path against any exposed Flowise instance.

Flowise before version 3.1.3 has a critical vulnerability in its Airtable Agent node where crafted chatflow prompts can bypass a Python code validator blocklist and execute arbitrary code in an unsandboxed pyodide environment. Since this requires no authentication and grants full host OS access, an attacker can achieve remote code execution simply by sending malicious input to a public-facing chatflow.

This is a blog post by Simon Willison describing a personal side project, alchemy-utils, an early-stage alpha library built with the help of Codex/GPT-5.6 to provide a database-agnostic version of sqlite-utils via SQLAlchemy. There is no evidence of prompt injection, tool poisoning, malicious code, or any agent security threat in this content; it is purely a project announcement.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

Researchers disclosed a flaw in how OpenAI, Anthropic, and Google encode and carry hidden chain-of-thought reasoning between API calls, allowing encrypted reasoning objects from one session to be replayed into another session. This cross-session replay allowed weaker models to decode or expose internal reasoning content from stronger models, including sensitive data such as API keys and passwords captured in session logs.

A coordinated campaign involving 737 free VPN and proxy Chrome extensions, published across at least 40 developer accounts, has been found intercepting browser traffic and routing it through attacker-controlled proxy infrastructure. The campaign primarily targets Russian-speaking users attempting to bypass service blocks, with 274 extensions identified as impersonating 66 legitimate brands, and has amassed over 75,000 installs.

The North Korea-linked Lazarus Group exploited a zero-day vulnerability in Microsoft Windows to gain SYSTEM-level privileges and deploy a previously unseen backdoor. The campaign, part of the long-running Operation Dream Job cyber espionage effort, targeted defense and aerospace organizations in France, Germany, Brazil, and India. The vulnerability has since been patched by Microsoft.

Attackers are actively exploiting a critical vulnerability in Adobe Commerce and Magento platforms that allows hijacking of customer accounts. The flaw is being targeted in the wild shortly after disclosure, putting online retailers and their customer data at risk of unauthorized access and fraud.

A newly identified Android malware campaign pairs a novel NFC relay tool called WindRelay with the established SpyNote RAT to capture and relay victims' live credit card data to attackers in real time. The combo also facilitates taking out fraudulent loans using stolen victim information, indicating a financially motivated criminal operation targeting mobile banking users.

A campaign dubbed 'City-Forum' is using custom tooling to systematically harvest data exposed to anonymous/unauthenticated users through misconfigured Salesforce Experience Cloud sites and ServiceNow customer portals. The attackers exploit overly permissive guest-user access controls rather than a software vulnerability, allowing bulk extraction of sensitive records without authentication.

A critical flaw (CVE-2026-73268, CVSS 9.9) in the cluster-curator-controller component of multicluster engine (MCE) allows tenants with limited ClusterCurator permissions to inject arbitrary Job specifications that execute with the controller's elevated privileges. Successful exploitation enables arbitrary code execution, privilege escalation, and access to cluster-wide secrets, posing severe risk to multi-tenant Kubernetes/OpenShift environments.

A critical flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a low-privileged namespace-admin tenant to abuse a highly privileged ServiceAccount via Subscription Custom Resources. This confused-deputy attack enables deployment of arbitrary cluster-scoped resources, leading to full privilege escalation and potential arbitrary code execution across the entire managed cluster.