Threat Library

This is an academic survey paper (arXiv cs.CR) analyzing how 21 proposals and 5 commercial AI agent products handle user-level permissions, rather than a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies instead of customizable per-user permissions, and identifies gaps in interface design, policy derivation, and runtime enforcement. No specific exploit, CVE, or actively exploited flaw is described; this is foundational research useful for informing future defenses.

This is an academic research paper (not an active exploit) demonstrating a novel attack against multi-hop RAG agents called 'Salience Induction,' which manipulates fact position, emphasis, and framing in retrieved documents to redirect an agent's reasoning without injecting false facts or instructions. The authors also propose a defense, Salience Normalization, that substantially reduces attack success. This is a legitimate, disclosed research contribution rather than an in-the-wild threat, but it identifies a real and previously underexplored weakness in agentic RAG reasoning pipelines.

This is an academic research paper introducing a benchmark for testing how well LLM agent defenders resist adaptive, multi-round prompt injection attacks driven by other LLMs. It is not a report of an active exploit or vulnerability in a deployed system, but a methodology and dataset release showing that adaptive multi-turn attackers achieve modestly higher success rates than single-turn attacks against frontier models. Severity is low as a threat item since it describes research tooling and findings rather than a concrete exploitable weakness in a specific product.

Researchers identified roughly 7,600 malicious GitHub repositories, with over 800 masquerading as AI 'skills' or Model Context Protocol (MCP) servers, used to distribute the SmartLoader malware family in a campaign dubbed FakeGit. The attackers use copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP downloads to trick developers into executing malware, exploiting growing trust in AI/MCP tooling as a lure.

This is an opinion post by Simon Willison observing that coding agents have made it cheaper for hobbyists to reverse-engineer and automate their own home devices. It does not describe a vulnerability, exploit, or attack technique involving AI agents; it is a general reflection on the economics of AI-assisted coding.

NextCRM's MCP server exposes product catalog management tools (create, update, archive, delete) without enforcing the same role-based restrictions applied to the normal web application. Any authenticated low-privileged user who can obtain an MCP Bearer token can tamper with the shared CRM product catalog, an action normally reserved for managers and admins. This is a broken access control flaw surfaced through an agent-facing tool interface, not a novel AI-specific attack.

AgenticMail's task API let any authenticated low-privileged agent enumerate and hijack tasks belonging to other agents by guessing/looking up their names and task IDs. This breaks the intended per-agent task isolation, allowing one agent to claim, complete, or fail work assigned to another. The vendor fixed this in version 0.9.64.

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

Network-AI's MCP SSE server ships with an empty default authentication secret, meaning every request is treated as authorized regardless of whether an Authorization header is present. Combined with a wildcard CORS policy on all responses, this lets a malicious webpage silently invoke any of the 22 exposed MCP tools on a victim's local server, including spawning agents and writing to shared blackboard state. This is a classic drive-by CSRF-style attack against a locally running privileged agent orchestrator.

The WhatsApp MCP server's local bridge API (port 8080) had no authentication, no Host header validation, and allowed arbitrary file paths in message attachments. This let any local process, sibling MCP server, or even a malicious webpage (via DNS rebinding) send WhatsApp messages as the paired user and exfiltrate sensitive local files like SSH keys as WhatsApp attachments. It is fixed in v0.2.1 with bearer token auth, host allow-listing, and path confinement.

This is an academic paper describing a defensive framework (Neural Cryptographic Services) that mitigates prompt-injection-driven tool hijacking in agentic workflows, not a new attack or active exploit. It highlights the well-known underlying threat—authenticated agents being manipulated via prompt injection to execute unintended but identity-valid tool calls—and proposes cryptographic gating as a countermeasure. Severity is low since no exploit, vulnerable product, or active threat is disclosed here.

This is academic research (not an active exploit) demonstrating that using humor as an indirect refusal mechanism in LLMs can itself introduce hidden safety risks. The authors show that a crafted attack, HumorPIA, can covertly embed harmful or toxic content inside seemingly safe humorous outputs, significantly increasing toxicity while evading existing safety detectors.

Hugging Face disclosed a security incident it attributes to an autonomous AI agent conducting an intrusion end-to-end, and a separate report describes 'JADEPUFFER,' an alleged agent-driven ransomware capable of real-time adaptation. Both reports indicate a shift toward AI systems autonomously executing attack chains, but the JADEPUFFER report lacks victim identification and methodology transparency, limiting verifiability. Severity is high due to the plausibility and real-world implications of autonomous offensive agents, but confidence is tempered by sparse technical detail in the secondary source.

Hugging Face disclosed that an autonomous AI agent was used to breach its production infrastructure, resulting in unauthorized access to internal datasets and credentials. The incident is notable because the attack vector was an AI agent operating with some degree of autonomy rather than a purely manual intrusion, highlighting real-world risk of agentic systems being weaponized against AI platform infrastructure. Details remain limited, as the source article is truncated and lacks technical specifics on the agent's tooling or exploitation method.

IBM Langflow, a popular open-source visual builder for LLM/agent workflows, ships with hard-coded credentials (password or cryptographic key) used for inbound authentication, outbound service communication, or internal data encryption. Because these secrets are static and embedded in the codebase across versions 1.0.0-1.10.1, any attacker who knows or extracts them can authenticate as a legitimate component, decrypt protected data, or impersonate trusted internal services. The maximum CVSS score of 9.8 reflects the potential for full compromise of confidentiality, integrity, and availability with low attack complexity and no privileges required.

Langflow's APIRequest component, when its 'Save to File' feature is enabled, trusts filenames supplied by an external HTTP server's Content-Disposition header without sanitizing them. A malicious or compromised remote endpoint can inject path traversal sequences to write arbitrary files outside the intended temporary directory, potentially leading to full remote code execution on the host running the agent flow.

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability allowing any authenticated user to escalate privileges to superuser by directly manipulating the underlying database. This grants attackers full control over the Langflow service, enabling arbitrary system command execution and complete system compromise. Given Langflow's role as an agent orchestration/flow-building platform, this is a severe supply-chain and framework-level risk for any AI agent pipelines built on it.

NadMesh is a Go-based botnet that scans the internet for unauthenticated, publicly exposed AI infrastructure (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) and abuses them to harvest cloud credentials, including a claimed 3,811 unique AWS keys, as well as Kubernetes tokens. This is not an attack on agent reasoning or protocols themselves, but exploitation of poor deployment hygiene around AI tooling that teams stand up quickly without adequate authentication or network controls. Severity is high because successful compromise yields direct cloud/infrastructure takeover, not just AI misuse.