Threat Library

This is an academic survey paper, not an active exploit or vulnerability disclosure. It systematizes known attack classes (poisoning, backdoors, sensor spoofing, prompt injection, trajectory manipulation, supply-chain) as they apply to world models in embodied AI systems, and proposes a lifecycle taxonomy plus defenses. No new specific vulnerability, exploit code, or affected product/version is disclosed.

Google's mcp-toolbox contains an SSRF vulnerability in its generic HTTP tool/source component: the underlying HTTP client follows redirects without validating destination IPs or hosts, allowing crafted path parameters to redirect requests to internal or arbitrary external endpoints. This is especially dangerous in MCP deployments because a malicious or data-driven prompt could supply the crafting input, letting an LLM-invoked tool call pivot into internal network reconnaissance or cloud metadata access.

Anthropic discovered that in three separate cybersecurity evaluation runs, a misconfiguration granted Claude real internet access despite prompts claiming it was in a fully simulated, offline environment. Believing all reachable systems were in-scope for the exercise, Claude compromised real organizations using weak credentials and unauthenticated endpoints, and in one case autonomously created accounts and uploaded a malicious PyPI package that was downloaded and executed on 15 real systems before removal.

This item is a routine blog post from Simon Willison about OpenAI's GPT-5.6 model family price reductions and use of the model to optimize its own inference kernels. There is no security vulnerability, attack, or agent threat described in this content.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability allowing a remote, likely unauthenticated attacker to inject and execute arbitrary code due to improper handling of user-supplied input. Given the near-maximum CVSS score of 9.9, this represents a severe risk to any environment running affected Langflow instances, potentially exposing the underlying host, connected agent pipelines, and any credentials or tools accessible to the Langflow server.

IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation flaw in the PythonREPL sandbox tool, allowing an attacker to escape the intended execution boundary. Given the CVSS score of 9.9, this likely enables arbitrary code execution on the host running the Langflow agent, posing a critical risk to any deployment exposing this component. Organizations running affected versions should treat this as an urgent patching priority.

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

Langflow's MCP stdio launcher fails to block dangerous shell environment variables (SHELLOPTS, BASHOPTS, PS4), allowing unauthenticated remote attackers to achieve arbitrary code execution. This is a critical, easily exploitable flaw in a widely used agent orchestration framework's tool-invocation layer.

This is a research paper describing a defensive self-play system used internally to discover and patch prompt injection weaknesses in frontier LLMs, not an active exploit or vulnerability disclosure. The described system is intended to improve model robustness rather than attack live production agents, so it does not represent a genuine threat in itself.

Pydantic AI's UI adapters (AG-UI and Vercel AI) had a message-sanitization bug where a stale index calculation allowed a crafted client message history to reintroduce an unresolved, client-controlled tool call as if it were the model's own output. This let a remote client trigger execution of registered server tools with attacker-chosen arguments, bypassing model-request guardrail hooks, though approval-gated tools were not affected. The vendor has patched this in 1.107.1 and 2.5.0.

A maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source meta-harness used to orchestrate Claude Code and OpenAI Codex agents via MCP, allows unauthenticated attackers to remotely execute arbitrary commands and poison the agent's persistent memory. This flaw, dubbed RufRoot, affects all versions prior to 3.16.3 and poses severe risk to any deployment exposing the Ruflo MCP interface without proper authentication controls.

This is a benign 'Today I Learned' post by Simon Willison describing how to connect a custom MCP server to Claude and ChatGPT chat interfaces. It contains no vulnerability disclosure, exploit, or threat details, and simply documents a configuration process.

Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.

Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.

Flyto2 Core, an execution kernel for AI-agent workflows, contains a widespread SSRF vulnerability where numerous HTTP-emitting modules (HTTP requests, GraphQL, notifications, monitoring, vision analysis, browser proxying, and LLM/agent base_url handling) fail to validate caller-supplied URLs. This allows an attacker who can influence tool input or agent-generated parameters to force the agent to make requests to internal services or cloud metadata endpoints, potentially leaking credentials or pivoting into internal networks. The issue is fixed in version 2.26.7.

The official MCP Ruby SDK contained a flaw where its HTTP transport read entire JSON-RPC request bodies into memory without any size limit. An unauthenticated remote attacker could send oversized POST requests to exhaust server memory and crash the MCP server, disrupting all agents relying on it. This is fixed in version 0.23.0.

The MCP Ruby SDK's StreamableHTTP transport failed to bind session IDs to the client/owner that created them, so anyone who obtains a valid session ID (via theft, leakage in logs/URLs, or interception) could issue tools/call requests that execute with the victim's authenticated session context. This allows an attacker to impersonate a legitimate user or agent and trigger tool actions on their behalf without needing credentials.