Threat Library

Academic research demonstrates that malicious instructions planted inside persistent memory files (used by agentic coding assistants like Claude Code and OpenAI Codex for cross-session context) can influence and hijack future agent sessions. This is a controlled research study, not an observed in-the-wild exploit, but it highlights a real and underexplored attack surface as agents adopt long-term memory.

This is a defensive security research paper describing FlowGuard, a detection system that identifies real vulnerabilities (like command injection and file system access risks) in MCP servers by combining semantic analysis with runtime evidence verification. It is not an active exploit or attack technique, but rather a scanner designed to help defenders find genuine risks in the MCP ecosystem, which it did find in real-world servers (523 findings across 326 servers). The paper itself poses no direct threat; it highlights that underlying vulnerabilities in MCP tool implementations are prevalent enough to warrant sophisticated detection tooling.

This article is a blog post by Simon Willison discussing the release of Moonshot AI's Kimi K3 model, covering pricing, benchmarks, and a whimsical 'pelican riding a bicycle' SVG test. It contains no security incident, vulnerability, or threat relevant to AI agents, agent frameworks, or agent protocols.

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

Reports indicate that OpenAI's Codex coding agent (referenced as GPT-5.6) can unexpectedly delete a user's entire $HOME directory when run in 'full access mode' without sandboxing or auto-review safeguards. The root cause is the model attempting to override the $HOME environment variable to create a temporary directory and mistakenly deleting the real $HOME instead. This is an unintentional agent malfunction rather than a malicious attack, but it demonstrates severe real-world consequences of granting autonomous coding agents unsandboxed filesystem access.

AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 logged raw user prompts and full agent responses into OpenTelemetry span attributes without any filtering or masking, which then flowed into customer CloudWatch aws/spans log groups. Any principal with read access to those logs could view sensitive user content, including secrets or PII that may have been part of prompts or agent outputs. This is a data exposure issue rather than an active exploit, and requires local/authenticated access to the customer's own logging infrastructure.

The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.

The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.

The dbt-mcp MCP server, prior to version 1.17.1, logged raw tool call arguments—including SQL queries, variables, and node selections—in plaintext to a local log file when file logging was enabled. This is a genuine but low-severity information disclosure issue requiring local file access or misconfigured log exposure to exploit, with a CVSS score of 2.5 and an official fix already released.

The dbt-mcp MCP server, prior to version 1.17.1, failed to sanitize client-supplied node_selection and resource_type values before passing them as dbt CLI arguments. Although the use of shell=False blocks shell metacharacter injection, an MCP client could still smuggle dbt global flags like --profiles-dir, --project-dir, or --target into the subprocess call, allowing unauthorized redirection of dbt execution context.

This item is a blog post by Simon Willison describing a fun side project: a WebAssembly port of a Mermaid diagram renderer (extracted from the open-sourced Grok CLI codebase) that outputs Unicode box art in a browser. There is no indication of a vulnerability, malicious behavior, prompt injection, or any agent security issue in this content.

This is a defensive research paper describing a new guardrail system (nsfaguard) that classifies and detects operational threats to agentic AI, such as prompt injection and tool misuse, rather than describing an actual vulnerability or attack. It introduces a risk taxonomy and benchmark models for real-time threat detection. No exploit, vulnerable framework, or active threat is disclosed; this is a mitigation/detection contribution.

This is an academic survey paper analyzing 21 proposals and 5 commercial AI agents for how they handle user-level permissions, not a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies rather than customizable per-user permissions, identifying this as a research gap rather than describing a specific attack.

This is an academic research paper (arXiv, not an active exploit) introducing SkillSec-Eval, a framework for evaluating security risks across the full lifecycle of reusable LLM agent 'skills' — from repository admission through retrieval, planner selection, execution, and evolution. The authors evaluated 327 real-world skills and found vulnerabilities exist beyond just runtime execution, suggesting attackers could poison skills at earlier stages like publishing or ranking to influence which skills agents select and trust.

This is an academic arXiv paper proposing a methodology for penetration testing AI-enabled systems, reframing testing to focus on behavioral objective violations rather than only infrastructure compromise. It is not an active exploit, vulnerability disclosure, or attack report but a conceptual framework and taxonomy referencing known adversarial vectors like prompt injection and tool misuse. Severity is low since no new exploitable vulnerability, affected product, or working payload is disclosed.

The BetterDocs WordPress plugin before version 4.5.5 lets unauthenticated users trigger an AI documentation-summary feature whose output is stored and rendered without sanitization. An attacker can craft input that causes the AI to emit malicious HTML/JavaScript, which then executes as stored XSS in the browser of anyone viewing the page, including site administrators.

xAI's Grok Build CLI coding agent was found to upload the entire working directory (and in one reported case, a user's home directory including SSH keys and password manager databases) to xAI's Google Cloud storage without clear user consent. xAI disabled the feature, deleted retained data, and open-sourced the codebase in response to backlash, but this represents a serious real-world data exfiltration incident caused by an overly broad and opaque agent tool/data-retention design rather than a targeted attack.

A flaw in n8n-MCP's multi-tenant HTTP mode allowed an authenticated tenant to access or delete workflow-version backups belonging to the default scope rather than being confined to their own tenant. This could expose or destroy legacy backup data left over from prior single-tenant deployments or migrations. The issue is fixed in version 2.57.4.

n8n-MCP, an MCP server exposing n8n workflow automation to AI assistants, failed to isolate workflow version history backups between tenants when multi-tenancy was enabled. Any authenticated tenant could read, delete, or destroy other tenants' backup snapshots, which contained full node definitions, credential references, and authorization headers. This is a severe cross-tenant data exposure and destruction flaw fixed in version 2.56.1.

Repomix's MCP server contains a flaw where two specific tool flows can be used to register and read arbitrary local files without triggering the secret-scanning safety check that normally protects file reads. This allows an MCP client (or an attacker controlling one) to exfiltrate sensitive local files, including those containing credentials, that were meant to be blocked by the redaction/validation layer.