Threat Library

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.

The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Researchers demonstrate that LLM agents frequently hallucinate plausible-sounding resource names (repos, skills, packages) when performing tasks like cloning or installation, and these hallucinations are predictable and transferable across models. Attackers can preemptively register these hallucinated resource names to host malicious payloads, causing agents that autonomously fetch and execute them to become compromised at scale, effectively forming a botnet without needing any direct prompt injection channel.

A vulnerability in n8n's AI Agents feature allowed a low-privilege user with only 'use' access to a shared credential to bypass the configured Allowed HTTP Request Domains restriction by pointing an MCP tool at an arbitrary attacker-controlled URL. This let the attacker exfiltrate the credential's secret value to an external server, effectively escalating from use-only access to full credential disclosure. The issue is fixed in n8n 2.27.4 and 2.28.1.

Researchers found that six popular AI coding assistants can be tricked by a malicious repository containing symlinks: the agent asks the user to approve an edit to what looks like a harmless file, but the actual write lands on a sensitive system file instead. This allows an attacker who convinces a developer to open a booby-trapped project to gain code execution or persistence on the developer's machine, bypassing the intended human-approval safety check.

Researchers at the AI Now Institute demonstrated an attack called 'Friendly Fire' where malicious source code, submitted for automated security review, tricks AI coding agents like Claude Code and OpenAI Codex into executing the attacker's payload on the host machine. This occurs when the agents run in autonomous modes that self-approve actions, turning a defensive scanning tool into a code execution vector.

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.

Unit 42 identified malicious 'skills' distributed through OpenClaw's ClawHub marketplace that evade automated security scanning to deploy infostealer malware and carry out agentic financial fraud. This represents a supply chain threat where trusted third-party agent extensions become a vector for compromising the host system and any credentials or financial capabilities the agent has access to.

A researcher demonstrated that AI 'Skills' (packaged capability bundles used by agent platforms) can be backdoored using invisible Unicode Tag codepoints that are stripped by human reviewers but still interpreted as instructions by models like Gemini, Claude, and Grok. This allows a malicious or compromised Skill to pass code review while silently injecting attacker instructions into the agent's context, enabling supply-chain prompt injection that survives manual auditing.

This post describes 'promptware'-based command and control, where prompt injection payloads act like malware to give attackers persistent, remote-controlled influence over an AI agent's actions. It builds on prior research showing that combining browsing tools with persistent memory features can create a full C2 channel, letting an attacker issue ongoing instructions to a compromised agent over time.

A researcher demonstrated that an image generated by ChatGPT could act as a carrier for an indirect prompt injection that hijacked Claude Opus 4.7's memory tool, causing it to persist false memories into future conversations. This shows that even hardened, reasoning-heavy models remain vulnerable to multimodal adversarial inputs crafted using puzzle-like framing to bypass safety reasoning.

This research describes a time-of-check-to-time-of-use (TOCTOU) attack against computer-use AI agents like ChatGPT Operator, where a malicious page or element changes between the moment the agent evaluates it and the moment it acts, causing the agent (and a supervising human) to click or execute something different from what was reviewed. The author reproduced a previously disclosed Google-reported vulnerability and demonstrated it live at a security conference. This is a legitimate and impactful vulnerability class for autonomous browser/UI-driving agents.

Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.

Researchers demonstrate that LLM-controlled ROS 2 robots can be hijacked via prompt injections delivered through non-text sensory channels: vision (OCR), audio (Whisper STT), and fabricated LiDAR obstacle data injected at the system-prompt level. Several tested models show up to 100% attack success rates, and a proposed semantic firewall defense can still be bypassed roughly 10% of the time using obfuscated payloads, indicating a serious and only partially mitigated real-world safety risk for physical robotic systems.