Threat Library

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.

This is a short opinion/commentary post by Simon Willison discussing the organizational concept of 'Directly Responsible Individuals' (DRI) and arguing that AI agents should never hold this accountability role since accountability is inherently human. There is no technical vulnerability, exploit, or security incident described here; it is a governance and ethics discussion.

AstrBot's dashboard MCP connection test feature allows an attacker to supply an arbitrary URL that the server will fetch, resulting in server-side request forgery (SSRF). This could let an attacker probe internal networks, hit cloud metadata endpoints, or pivot against internal services from the AstrBot server. Exploit details are public and the vendor has not responded, increasing real-world risk.

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

PraisonAI's CodeAgent executes LLM-generated Python code with no AST validation, import restrictions, or sandboxing, allowing an attacker who can influence the LLM's output via prompt injection to achieve full remote code execution on the host. This gives attackers a direct path to exfiltrate all environment secrets and compromise the underlying system, making it a maximum-severity flaw.

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.

MCP Server Kubernetes before version 3.9.0 has a flaw that lets attackers smuggle malicious flags (like --server) into kubectl commands by disguising them as resource names with leading dashes, bypassing the tool's dangerous-flag safety check. This allows redirecting kubectl operations to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster takeover.

A Drupal contributed module named 'AI Agents' has an access control flaw that allows forceful browsing, meaning unauthorized users may reach pages or functionality they shouldn't have access to. This is a standard web application authorization bug rather than a novel AI agent security issue, and no evidence in the data suggests prompt injection, tool poisoning, or agent-to-agent exploitation. Severity is moderate given the lack of CVSS score and limited detail on what functionality is exposed.

A Drupal contributed module called 'AI Agents' has a missing authorization vulnerability allowing forceful browsing, meaning certain pages or endpoints may be accessible without proper permission checks. This is a standard web application access-control flaw in a CMS module that happens to relate to AI agent functionality, rather than a novel AI-specific attack technique. Severity is moderate since exploitation depends on the module's deployment and what functionality is exposed without authorization.

PraisonAI's built-in prompt injection defense only blocks attacks rated CRITICAL, which requires three or more detector families to agree. This leaves a gap where cleverly crafted single- or double-vector injections score as HIGH and slip through untouched, reaching the underlying model. The flaw is a detection logic weakness rather than a full bypass of all protections, making it moderately severe.

This is an academic defense paper (not an active exploit report) presenting 'Prismata', a system that mitigates cross-site prompt injection in web browsing agents by dynamically labeling page content trust levels and restricting agent capabilities accordingly. It describes a well-known class of attack (untrusted webpage content hijacking agent instructions) and proposes mitigations rather than disclosing a new vulnerability. Severity is rated low because this raw data itself is defensive research, not a new exploit or active threat.

This is a defensive research paper describing an open-source firewall that intercepts web-based and programmatic LLM traffic to prevent sensitive data and proprietary code leakage. It is not an active exploit or vulnerability disclosure; it introduces a protective architecture rather than describing a threat to AI agents. Severity is set to low because the raw data does not describe a genuine security issue, only a mitigating tool.

This is a routine tech news article by Simon Willison describing OpenAI's new GPT-5.6 model family (Luna, Terra, Sol), pricing, benchmark comparisons against Claude, and new API features like programmatic tool calling and multi-agent support. It contains no evidence of a security vulnerability, exploit, or attack against AI agents or agent infrastructure.

The self-hosted HTTP transport of the DeepSeek MCP Server exposes the /mcp endpoint without any authentication, allowing any network-reachable client to initialize a session, enumerate tools, and invoke server-side functionality. This includes the deepseek_chat tool, which can consume the operator's own DEEPSEEK_API_KEY, leading to unauthorized API usage and potential cost/data exposure. The issue is patched in version 1.8.0.

The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.

Langroid versions before 0.65.2 contain a critical flaw where LLM-generated tool messages evaluated via Python's eval() with a supposedly empty 'locals' dict can still access all built-in functions, since '__builtins__' is implicitly injected into globals. This allows any attacker capable of influencing LLM output (e.g., via prompt injection) to achieve full unauthenticated remote code execution on the host running the agent.

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.