Threat Library

Cline's local Hub dashboard server fails to validate the Origin header on its WebSocket /browser endpoint, allowing any malicious website visited by a user to connect and issue commands. When ROOM_SECRET is unset (the default for local binds), attackers can read workspace state, tamper with MCP and provider settings, and trigger arbitrary command execution if a model provider is configured. This is a critical, fully remotely exploitable vulnerability via drive-by browser interaction with no user awareness required.

LiteLLM's MCP Streamable HTTP endpoint prior to version 1.84.0 could be tricked into skipping key validation by sending a fabricated Authorization header, causing the server to fall back to an empty, effectively unauthenticated user context. This let attackers reach MCP tooling and any downstream tools/agents exposed through the proxy without holding a valid LiteLLM API key. The vulnerability is fixed in 1.84.0.

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

Langflow, a popular visual builder for LLM/agent workflows, has an authorization bypass that lets an authenticated user execute any other user's flow simply by supplying that victim's flow ID. This is a classic insecure direct object reference (IDOR) that fails to verify flow ownership before execution, allowing cross-tenant abuse in multi-user deployments. CISA has added it to the Known Exploited Vulnerabilities catalog, indicating active exploitation and urgency to patch.

This raw data is a routine blog post by Simon Willison announcing the release of sqlite-utils 4.0, describing new features like schema migrations, nested transactions, and compound foreign keys. There is no indication of any security vulnerability, prompt injection, agent compromise, or threat to AI agents or agent frameworks in this content.

9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.

This is an academic research paper benchmarking how well LLM agents orchestrate a large suite of security tools (HexStrikeAI, 150+ tools over MCP) against CTF challenges, not a report of an active vulnerability or attack. The study analyzes factors affecting agent capability (client vs. model, tool access, reasoning limits) and reports improved solve rates after fixes; it describes no new attack technique, exploit, or in-the-wild threat.

This is an academic defense paper, not an active exploit report. It describes and mitigates 'stored IPI', a known weakness in Dual-LLM prompt injection defenses where untrusted data written to disk/environment and later reread loses its 'untrusted symbol' tagging and becomes trusted again. The paper's proposed solution, DualView, is presented as fully blocking this class of attack in benchmarks, so the actual residual risk described here is low and mainly relevant to agents using prior, incomplete Dual-LLM protections.

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

This is a defensive research paper, not a description of an active threat or exploit. It proposes a method (UCM) to protect web-browsing AI agents from prompt injection by redacting untrusted DOM regions before the agent sees them and routing interactions through a sandboxed, privilege-separated interface. Severity is low because no vulnerability is being disclosed here — the paper describes a mitigation, though it implicitly confirms that web agents remain broadly susceptible to prompt injection absent such defenses.

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

This is a PortSwigger web security research post describing a CSS injection technique that exfiltrates attribute data via chained conditional CSS in inline style attributes, without needing selectors or stylesheet imports. It is a general web application security finding about browsers and CSS, with no relationship to AI agents, LLMs, agent frameworks, or agent-to-agent protocols such as MCP or A2A.

This item is a vendor blog post from Unit 42 discussing general risks of integrating third-party 'skills' or plugins into enterprise AI agents, and advocating for integrity verification practices. It does not describe a specific vulnerability, exploit, or active threat, so it is classified as low severity informational content rather than a genuine incident.

This item is a promotional blog post from Unit 42 about their SOC, MDR, and XSIAM services, framed around the statistic that attackers can move from initial access to exfiltration in 72 minutes. It does not describe any specific threat, vulnerability, or technique involving AI agents, agent frameworks, or agent protocols, so no genuine security issue can be extracted from it.

This Unit 42 research describes a cloud storage misconfiguration risk where attackers exploit globally unique bucket namespaces across cloud service providers to hijack references to deleted or unclaimed buckets, redirecting data intended for legitimate storage to attacker-controlled buckets. This is a traditional cloud infrastructure security issue and does not involve AI agents, agent frameworks, agent protocols (MCP/A2A), or inter-agent communication in any way. Severity is rated low strictly for relevance to AI agent security; the underlying cloud risk itself may carry higher severity in a pure cloud-security context, but that is out of scope here.

Unit 42 identified malicious 'skills' distributed through OpenClaw's ClawHub marketplace that evade automated security scanning to deploy infostealer malware and carry out agentic financial fraud. This represents a supply chain threat where trusted third-party agent extensions become a vector for compromising the host system and any credentials or financial capabilities the agent has access to.