Threat Library

The AWS Labs DocumentDB MCP Server before version 1.0.12 fails to properly enforce read-only mode when processing certain aggregation pipeline stages, allowing an authenticated MCP client to perform unintended write operations on the connected database. This is a logic flaw in authorization enforcement rather than a novel AI-specific attack, but it is significant because agents and LLM-driven clients often rely on the read-only flag as a safety boundary to prevent destructive actions. Exploitation requires an already-authenticated client, limiting severity, but the impact on data integrity could be substantial in agentic workflows that assume read-only guarantees.

Authenticated users of IBM Langflow OSS (versions 1.0.0 through 1.10.3) can abuse a built-in component to read arbitrary server environment variables, bypassing controls meant to disable custom components. This can expose secrets such as API keys, database credentials, or other sensitive configuration data stored in the environment.

This is an academic research paper (not an active exploit) that systematically studies how prompt injection attacks against LLM-based robotic task planners can induce unsafe actions and degrade task completion. The authors show that in multi-agent robotic systems, injected instructions can propagate from a compromised agent to others via shared prompt structures, expanding the impact beyond the initially targeted agent.

Flowise's text-to-speech generation endpoint is whitelisted to bypass authentication and fails to verify whether the referenced chatflow is public, allowing anyone who knows or guesses a chatflow UUID to invoke that chatflow's stored OpenAI or ElevenLabs credential. This lets an unauthenticated attacker generate unlimited TTS audio at the chatflow owner's expense, resulting in financial abuse and indirect credential misuse. This is a genuine broken-access-control vulnerability in an AI agent orchestration platform, not a prompt injection or model-level attack.

Flowise, a popular low-code LLM/agent orchestration platform, returns decrypted credential secrets in plaintext via its credentials API because its redaction logic only masks fields explicitly typed as 'password', missing string-typed fields that commonly hold database URLs, private keys, and API keys. Any authenticated user with 'credentials:view' permission can retrieve full secrets for connection strings, cloud service accounts, and other integrations configured in the workspace, enabling lateral movement into downstream systems the agent platform connects to.

This is an academic research paper (not an active exploit) that systematically demonstrates how prompt injection—both direct (task instructions) and indirect (via perception modules)—can manipulate LLM-based multi-agent robotic systems into unsafe or adversarial actions. The study's key contribution is showing that injected instructions can propagate from one compromised agent to others through shared prompt structures, expanding the blast radius beyond the initially targeted agent. Because it is a controlled research evaluation rather than an in-the-wild attack, real-world severity depends heavily on deployment specifics, but the findings are directly actionable for adversaries and defenders alike.

This item is a blog quote describing a practice of running a nightly cron job that instructs an AI coding agent to autonomously fetch upstream changes, rebase local modifications, verify functionality, and replace the running software version. This is not itself an attack or exploit report, but it describes a risky operational pattern: unattended, unsupervised agentic code modification and deployment. Severity is medium because the described practice creates a plausible attack surface (supply-chain and prompt-injection risk) even though no actual exploit is documented here.

Google released three Chrome updates (versions 149, 150, and 151) fixing a cumulative total of 1,442 security bugs, far exceeding the combined total of the previous 23 releases. This represents a significant spike in disclosed vulnerabilities, largely attributed to internal discovery efforts rather than active exploitation reports.

Watchfire Controller Software used in digital billboard/LED sign controllers (BC550, BC750, BC760, BC760DC) contains hard-coded, self-signed RSA private keys and X.509 certificates embedded in plaintext firmware patch binaries. Successful exploitation could allow an attacker to intercept or spoof HTTPS/TLS connections to the web management interface and deliver malicious firmware to gain full control of the controller. Watchfire has released patched firmware versions to remediate the issue.

Researchers at Bitsight identified an operation dubbed Fuyao in which cheap Android TV boxes ship with pre-installed apps that spoof device identifiers to impersonate Samsung, Huawei, Xiaomi, or Vivo smartphones, enabling large-scale ad fraud. The same devices are also weaponized to covertly route third-party traffic through owners' home broadband connections, effectively turning them into residential proxy nodes. The operation has been attributed to Zhejiang Fengwo IoT Technology Co., Ltd., a China-based manufacturer.

A wave of malicious actors have been adopting abandoned or orphaned Arch User Repository (AUR) packages and inserting malware into them, prompting Arch Linux to temporarily disable the package adoption feature. This supply-chain attack vector allows attackers to compromise trusted package names that users and automated systems may install without deep scrutiny.

A session-management flaw in MikroTik RouterOS's API allows authenticated users whose permissions have been downgraded to retain their prior access levels, since sessions are not properly invalidated after permission changes or inactivity timeouts. The advisory description also notes a more severe potential consequence: low-privilege API access could be leveraged to extract a router's WireGuard private key in plaintext, enabling full VPN impersonation and decryption of associated traffic. No public exploitation has been reported at this time.

A use-after-free vulnerability has been identified in Apache Traffic Server's intercept plugin functionality, affecting multiple major version branches from 8.0.0 through 10.1.3. The flaw could lead to denial of service or potentially further memory corruption impacts on affected proxy deployments. Patches are available in versions 9.2.15 and 10.1.4.

The gemini-bridge MCP server, which connects AI agents to Google's Gemini CLI, failed to restrict file paths passed to its consult_gemini_with_files tool in inline mode. This allowed any file on the host filesystem to be read and forwarded through the Gemini round-trip, effectively exfiltrating local file contents to an external third party (Google) via a trusted tool call. The issue is fixed in version 1.3.1.

A widespread analysis of low-cost generic Android TV streaming boxes reveals they covertly enroll users' home internet connections into residential proxy networks and simulate mobile device behavior to commit large-scale ad fraud on AI-generated websites. This scheme defrauds advertisers and online merchants while exposing consumers' networks to third-party abuse without their knowledge or consent.

This is a weekly aggregated security digest covering multiple unrelated stories, including a large batch of Chrome vulnerabilities, ongoing SonicWall device attacks, DNS hijacking incidents, and emerging AI-assisted hacking techniques. The report lacks specific technical depth on any single threat, functioning instead as a curated summary of the week's security news. Organizations should treat this as an index pointing to underlying incidents that require individual investigation rather than a single actionable threat.

South Korea's Personal Information Protection Commission fined KT Corporation KRW 53.979 billion ($39 million) for data protection violations related to a customer data breach. The incident highlights regulatory scrutiny of telecom operators' handling of subscriber personal information and inadequate security controls.

IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.

Pydantic AI's UI adapters (AG-UI and Vercel AI) had a message-sanitization bug where a stale index calculation allowed a crafted client message history to reintroduce an unresolved, client-controlled tool call as if it were the model's own output. This let a remote client trigger execution of registered server tools with attacker-chosen arguments, bypassing model-request guardrail hooks, though approval-gated tools were not affected. The vendor has patched this in 1.107.1 and 2.5.0.

Anthropic experienced a worldwide service disruption affecting Claude and its underlying API, causing requests to fail with '529 Overloaded' errors. This is an availability incident rather than a malicious attack, but it disrupts any downstream applications, agents, or tools that depend on Claude's API for inference.