Threat Library

A person reportedly embedded hidden AI instructions inside a legal filing, attempting to manipulate any AI system that later reads and processes the document into ruling or advising in their favor. This is a classic indirect prompt injection attack applied to a real-world professional document workflow rather than a novel technical exploit. Severity is moderate since the report describes a single documented incident without technical detail on payload sophistication or actual impact on a legal outcome.

This is a defensive research paper, not an active exploit report. It describes 'Semantic Overlays,' a technique using trained adapters on a model's residual stream to help LLMs distinguish trusted instructions from untrusted content (e.g., tool output, user input), thereby mitigating prompt injection attacks. The underlying threat it addresses—LLMs losing track of span identity and being manipulated by text that mimics instructions—is a well-known, genuine issue, but the raw data itself presents a mitigation, not a novel attack.

This is a defensive research paper, not an active exploit or newly disclosed vulnerability. It proposes ROPE, a system that tracks the provenance of tool call parameters to block indirect prompt injection (IPI) attacks where malicious instructions embedded in tool-read content hijack an agent's tool calls. The underlying threat class (IPI leading to unauthorized state-changing tool calls) is real and well-known, but this document itself describes a mitigation with strong empirical results, not a new attack.

This is an academic research paper describing CAITLYN, a defensive middleware designed to detect and autonomously synthesize countermeasures against prompt injection attacks on LLM agents. It is not an active exploit or attack disclosure, but rather a proposed defense system; the paper also introduces a new benchmark ('Emerging') that reveals existing static defenses are vulnerable to novel injection techniques, which is a defensive-research finding rather than a new threat.

This is an academic benchmark paper (not an active exploit) demonstrating that existing prompt injection defenses, which perform reasonably in short-context settings, largely fail when injected instructions are embedded in long documents like resumes, code, or emails. The authors show even simple heuristic injection attacks bypass state-of-the-art defenses at high success rates in realistic long-context LLM application scenarios. Severity is moderate because it is a research finding highlighting a systemic weakness rather than a disclosed exploit against a specific product or live system.

The ash_ai library's MCP server implementation has a flawed origin validation check that can be bypassed using DNS rebinding, allowing a malicious website to issue cross-site requests to a user's locally running MCP server as that user's authenticated actor. Both values used in the trust decision (Host header and X-Forwarded-Proto header) are attacker-controlled from the browser, making the check ineffective by default. This affects versions 0.8.0 through before 1.0.0 and is fixed by defaulting to trusting only localhost origins.

The ash_ai library for the Elixir Ash framework evaluates user-influenced prompt content as live EEx templates, allowing an unauthenticated remote attacker to inject Elixir code that executes on the server before any LLM call is made. This is a classic code injection flaw exposed through an AI agent's prompt-construction pipeline, not a prompt injection against a model itself, but it is trivially reachable via any agent action that lets request data flow into a prompt template. Any deployment using ash_ai versions before 1.0.0 with dynamic prompt content is at critical risk of full server compromise.

This article is a descriptive walkthrough by Simon Willison explaining OpenAI's new 'ChatGPT Work' feature set, covering model selection, code execution, browser access, and sub-agents. It contains no evidence of a vulnerability, exploit, or malicious activity involving AI agents.

This article is a business/product news item about Anthropic adjusting Claude Code's weekly usage limits and pricing tiers. It does not describe any security vulnerability, attack, or threat involving AI agents, tools, or protocols.

A critical flaw in IBM Langflow OSS allows an authenticated user to escalate from limited flow-building privileges to full arbitrary command execution on the server. By crafting a malicious 'type' field in a saved flow and triggering a build via a wrapper flow, an attacker bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false safeguard intended to block custom code execution. This effectively hands the attacker OS-level control of the agent server process.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authorization flaw that lets any authenticated user execute or read another user's private flows. This is a classic access-control bug in an agent-orchestration framework rather than a novel agentic attack technique, but it can expose proprietary prompts, credentials embedded in flows, and business logic, or allow unauthorized execution of another tenant's automation.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a flaw where user identifiers can collide across namespaces, allowing a remote attacker to access another user's sensitive data or inject messages into their session. This is a serious multi-tenancy isolation failure in a widely used agent-building framework, warranting prompt patching.

A path traversal vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.11.1) allows a remote attacker to read arbitrary files on the host system. Langflow is a visual builder for LLM/agent workflows, so this flaw could expose sensitive configuration, credentials, or agent memory/state files stored on disk. This is a genuine, high-severity infrastructure vulnerability rather than a novel agentic attack technique.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authentication flaw that allows a remote attacker to execute arbitrary flows and access sensitive information without valid credentials. This is a genuine, high-impact vulnerability in a widely used agent/LLM orchestration framework that could let attackers run arbitrary agent pipelines and exfiltrate data. Organizations running affected versions should patch immediately.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation. This affects a widely used low-code framework for building AI agent workflows, meaning any authenticated user could potentially compromise the underlying host or downstream agent components.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to make the server send unauthorized requests to internal or external systems. This could be used for internal network reconnaissance or as a stepping stone for further attacks, but requires authentication and has moderate severity per its CVSS score of 4.3.

IBM Langflow versions 1.0.0 through 1.11.1 contain a critical flaw in the Agent-to-Agent (A2A) public endpoint that fails to properly enforce security restrictions, allowing a remote unauthenticated attacker to execute arbitrary code. With a CVSS score of 9.8, this is a severe, easily exploitable vulnerability that could grant full control of the affected system.

This report describes how AI coding agents are now able to turn a mere rumor of a bug (e.g. a patch shared for discussion) into a working exploit within minutes, drastically outpacing traditional open-source security disclosure and embargo timelines. This is not an attack on AI agents themselves, but a broader supply-chain/process risk: maintainers like rclone report a 20x increase in security disclosures alongside overwhelmed CVE assignment pipelines. Severity is assessed as medium because it describes a systemic process/workflow risk rather than a specific exploitable vulnerability in an agent framework or protocol.

The Dash MCP server bound its network listener to loopback but failed to validate the Host header of incoming requests, allowing DNS rebinding attacks from a malicious webpage to reach the local server. An attacker-controlled page in a victim's browser could rebind a domain to 127.0.0.1 and invoke the server's tools using the victim's stored Dropbox credentials. The issue is limited to the network transport mode and was fixed by adding host-checking transport security.

tiger-slack's MCP HTTP transport failed to enable the SDK's built-in host allow-list/DNS-rebinding protection, allowing a malicious webpage visited by a user on the same machine to rebind a DNS name to the local MCP server's address and issue requests to it. This lets an attacker's browser-based script drive the locally running Slack MCP server on behalf of the victim, potentially reading or sending Slack data without authorization. The fix requires explicitly enabling the allow-list option, not just updating the dependency.