Threat Library

Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.

The official MCP Ruby SDK fails to expire sessions in its StreamableHTTPTransport, allowing an attacker to repeatedly send initialize requests and accumulate ServerSession objects indefinitely. This can exhaust server memory and cause a denial of service against any MCP server built on this SDK. The issue is fixed in version 0.23.0.

The official MCP Ruby SDK (versions prior to 0.23.0) contains a denial-of-service vulnerability where its stdio transport reads input without a byte limit. A malicious peer (client or server) connected over stdio can send data without a newline terminator to exhaust the host process's memory, crashing or degrading the MCP server or client. This is a straightforward availability issue, not a code-execution or data-exfiltration flaw, and is fixed in 0.23.0.

Tengu is a newly identified Mirai-derived Linux botnet that abuses hardware watchdog timers to force device reboots when its main process is killed, allowing persistence mechanisms to relaunch it. It spreads via Telnet credential brute-forcing and supports 25 DDoS attack methods, posing a risk to internet-facing Linux and IoT devices with weak credentials.

Anthropic reports that its Claude Mythos Preview model assisted researchers in deriving a full key-recovery attack against the post-quantum signature scheme HAWK-256 and a substantially faster attack against 7-round AES-128. This is a research disclosure demonstrating AI-accelerated cryptanalysis rather than an active exploit, but it signals growing capability for AI-assisted discovery of cryptographic weaknesses that could erode confidence in specific PQC candidates and reduced-round symmetric ciphers.

This is an academic research paper proposing a defensive runtime-verification framework, not a live exploit or observed attack. It identifies a real class of risk: LLM-controlled robot swarms can be manipulated via indirect prompt injection to split a prohibited task across multiple platforms so that no single per-platform guardrail detects the violation. The paper's contribution is a detection/assurance system, not new attack tooling, so this should be tracked as a defensive research reference rather than an active threat.

This is a research paper (not an active exploit) describing an LLM-based agent that automates cloud intrusion investigation using decoy infrastructure. The authors themselves identify, but explicitly do not mitigate in their prototype, a genuine indirect prompt injection risk: attacker-controlled fields in cloud logs (like object keys and user-agent strings) are fed verbatim into agent prompts, creating a log-to-prompt injection channel. Since this is a disclosed, unpatched design gap in a research prototype rather than a live attack, severity is medium.

This is an academic research paper (not an active exploit) demonstrating that LLMs used in Security Operations Centers to interpret system logs can be manipulated via injected text within the logs themselves, causing malicious log entries to be misclassified as benign. The researchers also propose a mitigation: analyzing the LLM's generated explanations for signs of adversarial manipulation. Since this is disclosed research with defensive countermeasures included, it represents a real but currently theoretical/lab-demonstrated risk rather than an in-the-wild threat.

The alibabacloud-rds-openapi-mcp-server binds its MCP endpoint to all network interfaces by default, allowing any network-adjacent attacker to reach and invoke its exposed tools without proper access restriction. This is a configuration/deployment flaw rather than a novel exploit technique, but it can let unauthorized parties trigger RDS-related MCP tools if the server is reachable. Severity is moderate given the CVSS score of 5.8 and the dependency on network exposure and lack of authentication for actual exploitation.

Microsoft confirmed that a bug in its automated network maintenance request system caused a widespread outage affecting Microsoft 365 and Azure services. The bug erroneously removed IP routes from more network devices than intended, disrupting connectivity and service availability. This was a self-inflicted operational failure, not the result of a cyberattack or malicious activity.

A vulnerability in NanoClaw's MCP Server Approval component allows a local attacker to bypass authorization checks in the createChatSdkBridge.setup function, potentially approving or manipulating MCP server connections without proper consent. The flaw requires local access and has a public exploit available, but the vendor has not yet responded to the disclosure. Severity is moderate due to the local attack vector constraint, though the improper authorization could undermine trust in MCP server approval workflows.

SourTrade is a malvertising campaign active since late 2024 that impersonates trusted brands like TradingView, Solana, and Luno to lure retail traders and crypto investors. It uniquely constructs its malicious Windows executable client-side, in the victim's browser, using a legitimate Bun JavaScript runtime as its base, avoiding detection by never serving a single complete malicious binary from a static URL.

Threat actors are leveraging email addresses and personal data leaked by the ShinyHunters extortion group to send mass sextortion emails demanding $2,000 in Bitcoin. The scam uses previously breached data to add false credibility, threatening victims with fake claims of compromising webcam footage or browsing history unless payment is made.

Threat actors are posting fake troubleshooting guides on Steam discussion forums that use the ClickFix social engineering technique to trick gamers into executing malicious commands via the Windows Run dialog. These commands ultimately deploy XMRig cryptominers on victim machines, hijacking system resources for cryptocurrency mining.

OnTrac, a parcel delivery company, disclosed that attackers breached its corporate network and potentially accessed customer personal information. Details on the intrusion vector, threat actor, and full scope of compromised data remain limited based on available reporting.

Jan's local API server (through v0.8.4) mishandles trusted host configuration, replacing user-defined allowed origins with a wildcard that reflects any origin while still allowing credentials. This lets a network-adjacent or DNS-rebinding attacker reach the unauthenticated OpenAI-compatible API to run inference, enumerate models, invoke MCP tools, and read cross-origin responses. Fixed in commit 3e1c1e7; upgrade is the primary remediation.

Dolphin X is a newly identified remote access trojan that incorporates an AI-driven profiling feature to automatically score and rank infected hosts by potential value, allowing operators to prioritize high-value victims for follow-on exploitation. This automation reduces the manual triage effort typically required by threat actors managing large botnets of compromised machines.

A vulnerability in APIFold's auto-generated MCP server allows unauthenticated attackers to inject arbitrary JSON payloads via a webhook endpoint due to a missing signature validation configuration. These attacker-controlled payloads are stored and later served as trusted resource state to legitimate MCP clients, enabling a form of tool/data poisoning against downstream AI agents. The issue is fixed in a subsequent commit and requires no special access beyond knowledge of a server slug.

AgentGPT versions up to 1.0.0 fail to verify ownership of an agent run before attaching a task to it, letting any authenticated user who guesses or obtains another user's run_id inject tasks into that run. This can corrupt the victim's task history and exhaust their per-run task budget, indirectly driving up their LLM usage costs. It is a classic insecure direct object reference / broken object-level authorization bug rather than a novel agentic attack technique.

This is a research paper (not an active exploit) demonstrating that multi-agent LLM pipelines composed of individually safe models are not safe by default, because the hops between planner, worker, verifier, and synthesizer agents are unmonitored channels an adversary can use to smuggle instructions. The authors show that apparent 'zero attack success' in undefended pipelines was largely an artifact of cloud-provider server-side filtering rather than genuine architectural safety, and propose a training-free gating defense (ChannelGuard) that meaningfully reduces tool-poisoning and prompt-injection success. Severity is moderate: this is a measurement/defense study highlighting a real but already partially-known class of risk, not a novel zero-day.