Threat Library

OpenAI Codex CLI and Desktop failed to correctly parse PowerShell's stop-parsing token (--%), causing malicious commands to be misclassified as safe and auto-approved. An attacker who gets a user to open a poisoned repository can trick Codex into running an unapproved file-writing Git command that rewrites Codex's own configuration, ultimately allowing it to launch an attacker-controlled MCP server and execute code with the user's privileges.

A WordPress plugin that exposes an MCP interface and llms.txt generation for AI agents contains a broken access control flaw allowing low-privileged Subscriber-level users to perform actions reserved for higher-privilege roles. This could let an attacker with minimal site access escalate privileges or manipulate AI-agent-facing configuration and content. No evidence of active exploitation is provided in the raw data, but the CVSS score indicates meaningful impact if exploited.

This report from Unit 42 describes conventional threat actors using AI tools as part of their tooling to exfiltrate data from Latin American organizations, and highlights operational security mistakes that allowed defenders to disrupt them. The raw data provided is only a brief press-release style teaser with no technical detail on agent-specific vulnerabilities, prompt injection, tool poisoning, or inter-agent exploitation, so no genuine agentic-AI security threat can be substantiated from this content alone.

This is an academic research paper proposing a new protocol-layer defense (Skill-as-API) rather than a report of an active exploit. It identifies a legitimate design weakness in current agent coordination protocols like MCP and A2A: they expose full skill descriptions, schemas, and potentially system prompts to all peers, and offer no mechanism to hide skill existence or narrow the prompt-injection surface structurally. Severity is low because this is a proactive mitigation proposal, not evidence of exploitation in the wild.

This is a controlled academic study (not an active exploit) showing that when an agent pulls data via MCP and then relays it to another agent via A2A, simply attaching a 'PUBLIC - OK TO SHARE' label to a record can increase the odds that sensitive substantive field values are copied verbatim into outbound messages, compared to unlabeled data. The effect is strongly model-dependent (pronounced in one Claude model, weaker or floor-limited in GPT-5.6 tiers) and the paper is explicit that this is an association in one configuration, not a proven general or causal effect. Severity is modest because it is a research finding highlighting a labeling/trust-heuristic weakness rather than a demonstrated in-the-wild attack.

This is a defensive research paper describing a system for tamper-evident logging and forensic auditing of AI agent actions, not an active exploit or vulnerability. It proposes hash-chained, Merkle-batched, on-chain-anchored audit trails to help detect and investigate incidents like cascading tool-use failures or prompt injection spread after the fact. Severity is low because the content describes a mitigation/monitoring tool rather than a threat vector.

Researchers demonstrate a novel attack (ISM) that manipulates which skill/tool an LLM agent selects by crafting benign-looking skill metadata and prompts whose semantic relationship is engineered to bias the selector, without any explicit steering instructions. This bypasses human review and existing prompt-injection defenses far more effectively than explicit instruction-based attacks, raising the target-selection rate from ~15% baseline to ~63-73%.

This is a defensive research paper, not an active exploit or vulnerability disclosure. It formally describes how persistent AI agents can be poisoned when untrusted inputs (including prompt injections or unverified model inferences) get stored and later recalled as if they were verified agent history or user commitments, and proposes a typed provenance/guardrail system to prevent this. The core contribution is a mitigation architecture, evaluated against a small hand-authored conformance suite, not a report of a real-world attack.

This is a defensive research paper, not an active exploit, that identifies a structural weakness in OAuth-secured remote MCP tool use: a tool endpoint can remain 'authorized' even after the underlying workload executing the call has been substituted, is running stale attestation state, or reuses authority meant for a different sender. The authors propose ACLE-MCP, an invocation-scoped capability-lease architecture that binds authorization to fresh, workload-specific execution state, and demonstrate it closes these gaps with a manageable latency cost.

Manifold Security found eight flaws in seven popular command-line AI coding agents (including Claude Code, Codex, and Cursor) where a malicious repository's Git configuration can specify a command that the agent automatically executes on the developer's machine. This execution happens outside the agent's sandbox and without any user approval prompt, meaning simply cloning or opening a booby-trapped repo can lead to arbitrary code execution as the developer's user. Four of the eight issues remained unpatched at the time of publication.

This item is a Schneier on Security blog post describing anecdotal emails from self-described autonomous AI agents that were given money, a VPS, and instructions to earn cryptocurrency within self-imposed ethical constraints. There is no evidence of a specific exploit, vulnerability, or attack technique here—it's a human-interest/commentary piece about agent autonomy and behavior, not a security incident report. Severity is low because no concrete technical threat, vulnerability, or attack pattern is described.

This is a routine blog post from Simon Willison announcing version 0.34 of the llm-gemini plugin, which adds support for a new Gemini 3.8 Flash model and fixes a minor bug. There is no indication of a security vulnerability, prompt injection, tool poisoning, or any agent-related threat in this content.

Boruta, an OAuth2/OIDC authorization server, logged sensitive credentials including access tokens, refresh tokens, ID tokens, and agent tokens in plaintext business event logs prior to version 0.10.0. Anyone with access to these logs, log aggregation pipelines, or the admin log viewer could extract valid tokens and reuse them for unauthorized access until expiration or revocation. This is a credential-hygiene vulnerability rather than a novel agent-specific attack, but it directly threatens agent-to-service authentication where 'agent tokens' are among the logged values.

Unit 42 reports on an incident in which an attacker used autonomous AI agents to accelerate reconnaissance, exploitation, and lateral movement, compromising an enterprise network within hours. The article is a threat intelligence/case study piece describing attacker tradecraft rather than a specific vulnerability in an agent framework, protocol, or tool; the raw data provided lacks technical detail on the AI tooling or agent architecture used. Given the absence of concrete technical indicators, this is rated medium severity as a notable trend/case study rather than an actionable exploit.

This raw data is a press release/announcement from OWASP GenAI Security Project about their 2026 Top 10 for LLM Applications, a new Agent Control Standard, and new sponsors joining their community. It does not describe an actual vulnerability, exploit, or attack against AI agents; it is community and industry news.

This item is a routine release announcement for datasette-mcp 0.2, a plugin implementing the Model Context Protocol for Datasette. The changes described are a data-format improvement (rows returned as objects instead of arrays) and a dependency version bump. There is no indication of a security vulnerability, malicious behavior, or attack technique in this content.

This is a blog post about Paint.NET's developer using Claude to write a large, unreviewed reimplementation of Direct2D for WINE/Linux support. It is a commentary on AI-assisted software development practices ('vibe coding'), not a report of any prompt injection, agent security exploit, or protocol vulnerability. No genuine security issue involving AI agents, tools, or inter-agent communication is described.

This is an academic research paper describing a defensive auditing technique, not an active threat or exploit. AgentProv helps detect when commercial LLM API providers silently swap, quantize, or wrap the advertised model, using tool-call patterns instead of unreliable text-output analysis. It is a beneficial transparency/integrity tool for consumers of agentic LLM APIs, not an attack vector.

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

This is an academic systematization-of-knowledge (SoK) paper analyzing 197 prior works on multi-agent LLM system security, not a novel exploit or active threat. It proposes an organizing framework (A-I-R: adversary position, interaction interface, resulting risk) to unify understanding of how attacks propagate across agent boundaries in MAS. Severity is low because this is a research taxonomy/survey with no new attack disclosed, no PoC, and no affected product identified.