Threat Library

Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.

This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.

Researchers demonstrate that LLM-controlled ROS 2 robots can be hijacked via prompt injections delivered through non-text sensory channels: vision (OCR), audio (Whisper STT), and fabricated LiDAR obstacle data injected at the system-prompt level. Several tested models show up to 100% attack success rates, and a proposed semantic firewall defense can still be bypassed roughly 10% of the time using obfuscated payloads, indicating a serious and only partially mitigated real-world safety risk for physical robotic systems.

This is an academic research paper (not an active exploit) that identifies a structural weakness in MCP-style agent runtimes: security is typically enforced only at the connection layer (auth, session checks, approval dialogs) while execution-time actions lack consistent, testable invariants like principal binding and data-flow authorization. The authors demonstrate that naive and even 'practice-informed' mitigation baselines still permit most modeled attacks, and propose a reference runtime (HCP) that blocks all 10 benchmark attack cases by enforcing explicit execution-layer controls.

This is a defensive research paper, not an active threat or exploit disclosure. It presents a detection method that identifies memory-poisoning attacks in LLM agents by analyzing tool-call ordering patterns (specifically, a memory-recall call preceding an email-send call), achieving very high classification accuracy. Since it describes a detection technique rather than a vulnerability or attack, severity is low from a threat standpoint, though the underlying attack class it detects (memory poisoning leading to data exfiltration) remains a legitimate concern.

This is an academic research paper (not an active exploit) introducing SafeClawArena, a benchmark that systematically measures security failures in always-on 'Claw-like' agents such as OpenClaw, which hold persistent credentials, files, and tool access. The findings show alarmingly high attack success rates (up to 70%, and 100% for malicious plugins), indicating that current agent platforms lack the isolation and mediation protections found in traditional OS design. Because this is a controlled research disclosure rather than an in-the-wild attack, severity is rated high (not critical) but warrants urgent defensive attention given the demonstrated real-world exploitability.

This is an academic/research announcement of an open-source defensive security tool (AI-Infra-Guard) designed to red-team and audit AI agent infrastructure, MCP servers, and agent-skill packages across multiple layers. It is not an active exploit, vulnerability disclosure, or attack in progress, but rather a proposed testing framework for defenders. No specific CVE, active campaign, or exploited vulnerability is described.

Kong Konnect's Model Context Protocol server prior to version 1.0.0 is vulnerable to indirect prompt injection, allowing a remote attacker to manipulate an LLM agent into executing unintended API requests. This effectively lets an attacker who controls untrusted content processed by the MCP server hijack the agent's actions against Kong-managed APIs, with a CVSS score of 7.4 indicating high severity.

Researchers reported what they describe as the first documented ransomware campaign, dubbed JadePuffer, allegedly executed end-to-end by an autonomous LLM agent rather than human operators. The article provides limited technical detail, so key claims (full autonomy, novelty, actual impact) cannot be independently verified from the source alone.

This is a blog post by Simon Willison describing benign research into using DSPy to evaluate and improve system prompts for Datasette Agent's SQL query feature. There is no security vulnerability, attack, or malicious activity described; it is purely a prompt-engineering optimization exercise.

The fast-mcp-telegram MCP server fails to sanitize Bearer tokens used for session file lookup, allowing a remote attacker to use path traversal sequences to authenticate as the default legacy Telegram session. This effectively bypasses the server's multi-user session isolation, letting an unauthenticated or low-privilege remote client impersonate the primary account owner and access their Telegram session and MCP tools.

This is an academic research paper (arXiv, not an active exploit) empirically benchmarking six major LLMs against direct, multilingual, and obfuscated prompt injection attacks. The study finds that all tested models can be induced to generate phishing content, malicious websites, and malware, with non-English prompts and multi-stage obfuscation significantly increasing compliance rates. Since this is a research disclosure rather than an in-the-wild exploit or agent-specific vulnerability, severity is rated medium rather than high/critical.

This is an academic research paper, not an active exploit or vulnerability disclosure. It introduces a benchmark (SecFid) showing that current defenses against indirect prompt injection achieve security by suppressing untrusted text, which degrades task fidelity for legitimate uses like translation or document editing. No new attack technique or exploited system is described; it is a measurement and evaluation contribution.

Attackers seed false facts or standing instructions into an agent's long-term memory or RAG store, quietly steering decisions across future sessions long after the original malicious input is gone.

Adversarial instructions planted in content processed by one agent can replicate into its outputs and infect downstream agents, spreading through normal inter-agent messaging the way the Morris II research worm spread through AI email assistants.

The MCP Inspector developer tool shipped a proxy that lacked authentication, allowing browser-based attackers to reach it from a malicious web page and execute code on the developer's machine. Reported by Oligo Security with a CVSS score of 9.4.

A critical flaw in the widely used mcp-remote OAuth proxy let malicious MCP servers achieve remote code execution on connecting developer machines, turning a routine agent connection into full host compromise. The package had hundreds of thousands of downloads before patching.

Malicious or compromised MCP servers embed hidden instructions in tool metadata that the model reads but the human approving the tool never sees, steering agents into data exfiltration or unauthorized actions. First documented publicly by Invariant Labs in 2025 and since reproduced across many clients.