Threat Library

Johnson Controls TL280 camera devices running firmware versions below 5.63 contain a vulnerability involving use of a broken or risky cryptographic algorithm, tracked as CVE-2026-27871, which stems from hardcoded credentials embedded in the firmware. Successful exploitation could allow an attacker to access sensitive information on the device, though the attack requires high complexity and privileges. Johnson Controls has released firmware 5.63 to remediate the issue and recommends network segmentation and credential rotation as mitigations.

A heap out-of-bounds write vulnerability (CVE-2026-17264) affects Medixant RadiAnt DICOM Viewer versions 2025.2 and earlier, triggered by opening a maliciously crafted DICOM file with malformed JPEG-compressed pixel data. Successful exploitation could crash the application or potentially allow remote code execution, though built-in exploit mitigations (CFG, DEP, ASLR) reduce practical exploitability. No known public exploitation has been reported to date.

Flowise's OpenAI Assistants integration fails to verify workspace ownership when looking up credentials by UUID, letting any authenticated user access credentials, assistant metadata, and file/vector store data belonging to other workspaces. Attackers can also upload files into victim workspaces, enabling both data theft and data poisoning across tenant boundaries. This is a critical multi-tenant isolation failure in an agent orchestration platform.

CVE-2026-53984 is a critical unauthenticated vulnerability in Ground Station software prior to version 0.6.0, allowing any network peer to destroy or tamper with the entire SQLite database via an exposed Socket.IO event handler. Attackers can wipe operational data or inject fabricated orbital-source URLs to redirect the ground station to attacker-controlled servers, enabling data manipulation and potential downstream compromise.

IBM Langflow, an open-source visual builder for AI agent workflows, has a flaw in its ensure_fernet_key() function that produces weak cryptographic keys used to encrypt sensitive data such as credentials and secrets. This weakens the confidentiality guarantees of stored secrets, potentially allowing an attacker to decrypt or brute-force protected data if they gain access to the encrypted material. This is a genuine framework-level security issue affecting confidentiality of agent configuration/secrets rather than a direct agent-behavior exploit.

IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic Mersenne Twister PRNG to derive Fernet encryption keys from short user secrets, making key generation deterministic and predictable. An attacker who can predict or brute-force the seed can regenerate the encryption key and decrypt stored API keys and authentication tokens used by the agent platform.

CVE-2026-66321 is a type confusion vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized remote attacker to execute arbitrary code, typically via a malicious or compromised web page. Exploitation requires a victim to interact with attacker-controlled content, but successful attacks can lead to full code execution within the browser context.

This is an academic research paper proposing a defensive detection system against indirect prompt injection, not an active exploit or newly discovered vulnerability. The authors present a context/query-aware classifier that segments text into benign and malicious sentences, hardened via adversarial training against evasion attempts. Since this describes a defense mechanism rather than a threat, severity is assessed as low from a threat-intelligence perspective.

This is an academic benchmark paper, not an active exploit, that studies whether smart-home multimodal AI agents can distinguish genuine user commands from ambient content like TV audio, on-screen text, or overheard conversation that resembles a command. The researchers find that single-model detectors over-trigger while MLLM agents over-refuse, and propose that layered routing/sensor fusion is needed; no working attack or vulnerable deployed system is disclosed.

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api versions up to 1.11.9, specifically in the dynamic client registration handling code. A remote attacker can exploit this flaw to make the MCP server issue unauthorized requests to internal or arbitrary network destinations. The issue is fixed in version 1.11.10.

A reported command injection flaw in the ssh_exec function of the ssh-mcp-server project involves unsanitized host/username parameters, but exploitation requires local access and the maintainer disputes it represents a real security boundary violation. Since the tool is explicitly designed as a trusted local component granting the calling agent shell-level execution capability, this does not constitute a meaningful privilege escalation. Severity is assessed as low given the disputed status, local-only attack vector, and lack of a genuine trust boundary crossing.

A vulnerability in Amazon Strands Agents Tools allows an authenticated user to manipulate the LLM into calling memory-management tools with a forged namespace parameter, letting them read, modify, or delete another tenant's stored memories. This is an insecure direct object reference (IDOR) bug affecting the mongodb_memory, elasticsearch_memory, and mem0_memory tool integrations before version 0.8.3. It poses a serious confidentiality and integrity risk in any multi-tenant deployment of these agent tools.

This is an academic measurement study analyzing how MCP server registry descriptions change over time, not an active exploit or vulnerability disclosure. The paper argues that ranking servers by past drift for re-auditing is an ineffective way to keep security audits current, since most description changes come from new server arrivals rather than previously observed servers. The practical takeaway is a scanner-hygiene recommendation (hash-based revalidation plus periodic full sweeps), not a runtime trust or security flaw in MCP itself.

This item is a defensive research paper, not a threat or active exploit. It proposes 'AgentAntibody', a system that helps LLM agents learn from past prompt injection encounters to better distinguish legitimate task completion from injected malicious actions over time. Since this describes a mitigation approach rather than a vulnerability or attack technique, it does not represent a genuine security threat.

This is a research paper (not an active exploit) demonstrating that proprietary 'skills' offered by AI agent platforms can have their hidden functionality functionally cloned purely through legitimate use, without ever disclosing the underlying files. The method, SkillClone, builds an interface hypothesis from public documentation, probes the skill with structured benign queries, and iteratively synthesizes and repairs a replica using differential validation against real outputs. This shows that file-disclosure defenses are insufficient to protect proprietary agent logic, since functional secrecy can be broken through cumulative, non-malicious-looking interactions.

This is academic research demonstrating that LLM search agents can be manipulated by coordinating malicious content across multiple search results rather than relying on a single poisoned page. The 'Authority-Chain Hijack' technique creates a fake corroborating evidence trail across sources the agent cross-checks, achieving high attack success rates in controlled benchmarks (up to 71.4%/95.0% ASR with automated strategy refinement). No live exploit or in-the-wild activity is reported; this is a demonstrated vulnerability class with clear real-world implications for any agent trusting retrieved web content.

Researchers demonstrate LoginTrap, an indirect prompt injection technique that manipulates LLM-based web agents into believing login is a necessary step to complete a task, redirecting them to attacker-controlled login pages. This exploits the authentication boundary of web agents to potentially exfiltrate user credentials, achieving an 86% average success rate across multiple LLM backbones and agent architectures. This is a research disclosure, not an observed active exploit, but it demonstrates a credible and highly effective attack surface.

This is a research paper describing PIMiner, an academic agentic red-teaming system that automatically discovers and transfers prompt injection strategies against LLM agents like Gemini, GPT-5.1, and Claude. It is a defensive/evaluative research tool rather than an active in-the-wild exploit, but it demonstrates high attack success rates (up to 86.7%) with very few queries, meaning its techniques could be repurposed by attackers to efficiently craft prompt injections against production agents. Severity is moderate because it is disclosed research intended to improve defenses, not an observed live attack campaign.

Poison Claude is an underground service advertising discounted, illegitimate access to Anthropic's Claude models (including Opus 4.8/4.7/4.6 and Sonnet 4.6), likely by reselling stolen or abused API credentials/accounts. The operator sits in the middle of every session, meaning all customer prompts, outputs, and potentially embedded secrets pass through an untrusted third party. This represents a significant confidentiality and data-exfiltration risk for any individual or organization using the service, including those integrating it into automated or agentic workflows.

OpenAI disrupted a Cambodia-based scam network operating out of Poipet that used coordinated ChatGPT accounts to generate content for investment fraud, romance scams, illegal gambling promotion, and law enforcement impersonation schemes. The operation leveraged generative AI to scale social engineering content creation and craft convincing fraudulent communications targeting victims across multiple scam categories. OpenAI banned the associated accounts as part of its abuse enforcement efforts.