Threat Library

This is a blog post by Simon Willison describing a personal web tool that renders SVG embedded in Markdown, adds export tabs (PNG/JPEG/MP4), and uses ffmpeg.wasm in the browser to compile animation frames into video. There is no mention of AI agents, prompt injection, tool poisoning, or any inter-agent communication in this content, and no security vulnerability is described.

mcp-memory-service, a semantic memory backend used by AI agents, exposes all /api/documents/* routes without any authentication check even when an API key or OAuth is configured. This lets an unauthenticated remote attacker read, write, or delete an agent's persistent memory store, enabling memory poisoning and data theft. The flaw is fixed in version 10.67.1.

The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.

The CKAN MCP Server's data quality tools validate the server_url parameter using a prefix-only regular expression intended to restrict requests to dati.gov.it, but the check can be bypassed with suffix-host or userinfo tricks in the URL. This allows an attacker to redirect the MCP tool's outbound request to an attacker-controlled host and return spoofed data to the agent as if it came from the trusted source.

Trigger.dev, a platform for managing AI agent workflows, contains a path traversal vulnerability in its packet/object-store signing logic that lets an authenticated caller with any valid environment API key generate presigned URLs pointing into other tenants' storage. This allows reading or overwriting another tenant's task payloads, breaking tenant isolation. The vendor has fixed this in 4.5.0-rc.5.

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.

MindsDB Minds Platform (v26.1.0 and earlier) has an unauthenticated remote code execution vulnerability where attackers can configure their own LLM key via an unprotected settings endpoint, then submit a crafted prompt that directs the 'Anton' agent to invoke its scratchpad tool, which calls exec() on attacker-controlled Python code without sandboxing. This grants full OS command execution as the user running the application, exposing SSH keys, credentials, and environment secrets. This is a critical, fully unauthenticated, trivially exploitable vulnerability warranting immediate patching.

The CKAN MCP Server, prior to version 0.4.112, leaks raw upstream response bodies and internal exception details (hostnames, internal IPs, DB errors, stack fragments) to callers when errors occur or when the server is redirected to a non-CKAN host. This is a low-severity information disclosure issue rather than a direct compromise vector, but it can aid reconnaissance for further attacks, especially if combined with SSRF-style redirection. The vendor has already released a fix.

The Cortex MCP server incorrectly trusts the CLAUDE_PROJECT_DIR environment variable to identify a legitimate Cortex source checkout, using only two file-presence checks as validation. An attacker who convinces a victim to open a malicious repository as their active project in Claude Code can plant these marker files and cause Cortex's open_visualization tool to execute an arbitrary attacker-controlled Python script with the victim's local user privileges.

Langflow, an open-source framework used to visually build LLM/agent workflows, contains a flaw allowing unlimited authentication attempts, enabling remote attackers to brute-force user credentials. Given a 9.1 CVSS score, successful exploitation could grant unauthorized access to accounts controlling agent pipelines, connected tools, and stored credentials/secrets.

An MCP server (mcp-dominican-layer) exposes a PDF-parsing tool that accepts a remote URL without adequate validation, allowing an attacker to force the server to make arbitrary outbound requests (SSRF). This could be used to probe internal networks, hit cloud metadata endpoints, or interact with internal services reachable from the MCP host. The vendor has not responded to the disclosure and a public exploit exists, increasing near-term risk for any deployment using this component.

An MCP server tool called parse-csv accepts a user-supplied URL (csvUrl) and fetches it with axios.get without validating the destination, allowing an attacker to force the server to make requests to arbitrary internal or external endpoints. This is a classic server-side request forgery (SSRF) vulnerability exposed through an agent tool interface, remotely exploitable, with a public exploit and no vendor response yet. Severity is moderate given CVSS 6.3, but the risk is amplified in agent contexts where the MCP server may have network access to internal services, cloud metadata endpoints, or other agents.

Trigger.dev, a platform used to build and deploy AI agents and workflows, had a critical authorization flaw where the deployment lookup did not verify that a deployment belonged to the caller's own project. Any authenticated user with a valid API key for one project could reference another project's deployment ID and hijack it by linking an attacker-controlled background worker, altering its deployment state. This allows cross-tenant compromise of AI agent deployments, potentially letting an attacker inject their own worker code into a victim's production agent pipeline.

Trigger.dev, a platform for managing AI agent workflows, fails to check Google's email_verified flag during OAuth login, allowing an attacker to create a Google account with an email matching an existing victim's account and take it over. Because Trigger.dev orchestrates AI agent deployments, compromising an account gives an attacker control over that user's agents, workflows, secrets, and API keys. This is a classic identity-spoofing/authentication flaw rather than a novel agentic attack, but it has serious downstream impact on agent supply-chain trust.

A vulnerability in Trigger.dev, a platform for orchestrating managed AI agents and workflows, allows any authenticated tenant to pollute Object.prototype in the shared webapp process via a metadata update API. This corrupts database queries and metrics across all tenants and can break worker authentication or crash the process, resulting in a cross-tenant denial-of-service condition. The issue is fixed in version 4.5.6.

An MCP server component (mcp-rdf-explorer 1.0.0) contains a server-side request forgery vulnerability in its explore_url tool function, allowing a remote attacker to make the server issue arbitrary HTTP requests by manipulating the url argument. A public exploit exists and the vendor has not responded to disclosure, leaving the issue unpatched.

The auth-fetch-mcp server, which lets AI assistants fetch authenticated web content, has a flawed SSRF blocklist that fails to catch IPv4-mapped IPv6 loopback addresses in their hex-normalized form. An attacker who can influence the URL passed to the fetch tool (directly or via prompt injection) can reach internal loopback services that the security control was explicitly designed to block. This is exploitable out-of-the-box with no special configuration.

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.