Threat Library

An MCP server (mcp-dominican-layer) exposes a PDF-parsing tool that accepts a remote URL without adequate validation, allowing an attacker to force the server to make arbitrary outbound requests (SSRF). This could be used to probe internal networks, hit cloud metadata endpoints, or interact with internal services reachable from the MCP host. The vendor has not responded to the disclosure and a public exploit exists, increasing near-term risk for any deployment using this component.

An MCP server tool called parse-csv accepts a user-supplied URL (csvUrl) and fetches it with axios.get without validating the destination, allowing an attacker to force the server to make requests to arbitrary internal or external endpoints. This is a classic server-side request forgery (SSRF) vulnerability exposed through an agent tool interface, remotely exploitable, with a public exploit and no vendor response yet. Severity is moderate given CVSS 6.3, but the risk is amplified in agent contexts where the MCP server may have network access to internal services, cloud metadata endpoints, or other agents.

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

This CVE describes a terminal escape sequence injection vulnerability in the Oh My Posh shell prompt renderer, not an AI agent-specific prompt injection despite the matched keyword. Attacker-controlled Git metadata (commit messages, author names, repo URLs) and directory names could contain unsanitized control characters that manipulate the terminal, spoof the display, or overwrite the clipboard when a victim's shell prompt renders that data. This is a legitimate but conventional software vulnerability with no direct relevance to AI agent architectures, LLM prompt injection, or inter-agent protocols.

HCL AION is vulnerable to indirect prompt injection where untrusted content processed by the agent can cause malicious HTML/markup to be injected into rendered output shown to users. This is a moderate-severity issue (CVSS 4.3) that could enable UI manipulation or phishing-style deception rather than direct system compromise. The vulnerability stems from insufficient output sanitization rather than a deep architectural flaw.

This is a research paper (not an active exploit) introducing ToolHazard, a framework for synthesizing scalable adversarial environments to test how LLM agents handle indirect prompt injections embedded in tool outputs and environmental states. The work demonstrates that current agents remain broadly vulnerable to such injections and that injection timing/placement matters, but also shows that training on ToolHazard-generated data improves robustness. Severity is medium because it is a defensive/evaluation contribution highlighting a well-known class of risk rather than disclosing a new live exploit.

Security researchers at Tracebit demonstrated a defensive technique called 'context bombing,' which plants prompt injections next to decoy secrets (passwords, API keys) in cloud environments. When an autonomous AI hacking agent discovers and reads these decoys, the embedded injection triggers the attacker LLM's own safety guardrails, causing it to refuse and halt the intrusion. This is a legitimate, low-risk defensive use of prompt injection rather than a novel attack, though it highlights the broader unreliability of LLM instruction boundaries.

This is a research paper (not an active exploit) that benchmarks static analysis techniques against malicious 'Agent Skills' — installable instruction/script packages for LLM agents. The authors show static analysis catches data exfiltration and steganographic payloads well but completely misses host-destruction attacks using common shell commands and largely misses natural-language prompt injection, highlighting a real supply-chain detection gap for agent skill marketplaces.

ToolJet, a platform used to build internal tools and AI agents, fails to verify that the organizationId in the URL path matches the authenticated user's actual organization membership when calling its ToolJet Database API. Any authenticated user can manipulate the tj-workspace-id header and the target organizationId to read or modify database tables belonging to other tenants, including table schemas, rows, and data used by that tenant's workflows or agents. This is a broken object-level authorization (IDOR) vulnerability rather than a novel AI-specific attack, but it directly threatens the confidentiality and integrity of data feeding AI agents built on the platform.

This is an academic research paper introducing StepJack, a benchmark that demonstrates how indirect prompt injection attacks against computer-use agents (CUAs) become significantly more effective when the adversarial goal is split across multiple innocuous-looking sub-steps distributed across a chain of web pages. It is not an active exploit, but the findings show meaningfully higher attack success rates against several state-of-the-art CUAs compared to single-step injection, indicating a real and underexplored gap in current agent safety defenses. Severity is rated medium because this is disclosed research with a public benchmark rather than an in-the-wild attack, but the technique is practically reproducible.

An MCP server tool (read_webpage) fails to validate the 'url' argument, allowing server-side request forgery when a malicious or manipulated URL is passed to it. Exploitation requires local access, which limits severity but still poses risk in multi-tenant or agent-orchestrated environments where untrusted input reaches this tool. A patch is available and should be applied.

This is an editorial/news item about Anthropic making 'auto mode' the default in Claude Code, reducing human permission prompts in favor of automated risk judgments. Anthropic cites a third-party eval claiming zero successful indirect prompt injections out of 720 attempts, but the author (a respected security researcher) is skeptical that the lethal trifecta problem is truly solved, noting the eval's narrow scope (72 held-out scenarios) and that 11% of dangerous-action tests still slipped past auto mode. This is not a disclosed exploit but a discussion of risk trade-offs in agent autonomy design.

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api versions up to 1.11.9, specifically in the dynamic client registration handling code. A remote attacker can exploit this flaw to make the MCP server issue unauthorized requests to internal or arbitrary network destinations. The issue is fixed in version 1.11.10.

This is a research paper (not an active exploit) demonstrating that proprietary 'skills' offered by AI agent platforms can have their hidden functionality functionally cloned purely through legitimate use, without ever disclosing the underlying files. The method, SkillClone, builds an interface hypothesis from public documentation, probes the skill with structured benign queries, and iteratively synthesizes and repairs a replica using differential validation against real outputs. This shows that file-disclosure defenses are insufficient to protect proprietary agent logic, since functional secrecy can be broken through cumulative, non-malicious-looking interactions.

This is a research paper describing PIMiner, an academic agentic red-teaming system that automatically discovers and transfers prompt injection strategies against LLM agents like Gemini, GPT-5.1, and Claude. It is a defensive/evaluative research tool rather than an active in-the-wild exploit, but it demonstrates high attack success rates (up to 86.7%) with very few queries, meaning its techniques could be repurposed by attackers to efficiently craft prompt injections against production agents. Severity is moderate because it is disclosed research intended to improve defenses, not an observed live attack campaign.

Langflow OSS, a framework used to build AI agent and LLM workflows, contains a server-side request forgery vulnerability caused by incomplete SSRF protections. An attacker able to supply URLs or trigger outbound requests through Langflow components could force the server to reach internal or restricted network resources.

The AWS Labs DocumentDB MCP Server before version 1.0.12 fails to properly enforce read-only mode when processing certain aggregation pipeline stages, allowing an authenticated MCP client to perform unintended write operations on the connected database. This is a logic flaw in authorization enforcement rather than a novel AI-specific attack, but it is significant because agents and LLM-driven clients often rely on the read-only flag as a safety boundary to prevent destructive actions. Exploitation requires an already-authenticated client, limiting severity, but the impact on data integrity could be substantial in agentic workflows that assume read-only guarantees.

Authenticated users of IBM Langflow OSS (versions 1.0.0 through 1.10.3) can abuse a built-in component to read arbitrary server environment variables, bypassing controls meant to disable custom components. This can expose secrets such as API keys, database credentials, or other sensitive configuration data stored in the environment.

This is an academic research paper (not an active exploit) that systematically studies how prompt injection attacks against LLM-based robotic task planners can induce unsafe actions and degrade task completion. The authors show that in multi-agent robotic systems, injected instructions can propagate from a compromised agent to others via shared prompt structures, expanding the impact beyond the initially targeted agent.

Flowise's text-to-speech generation endpoint is whitelisted to bypass authentication and fails to verify whether the referenced chatflow is public, allowing anyone who knows or guesses a chatflow UUID to invoke that chatflow's stored OpenAI or ElevenLabs credential. This lets an unauthenticated attacker generate unlimited TTS audio at the chatflow owner's expense, resulting in financial abuse and indirect credential misuse. This is a genuine broken-access-control vulnerability in an AI agent orchestration platform, not a prompt injection or model-level attack.