Threat Library

Researchers demonstrated that a simple malicious website summary request can hijack Claude Code Opus 5's 'Auto Mode' and achieve remote code execution with a 60-80% success rate. This directly contradicts Anthropic-commissioned third-party evaluations that reported a 0.00% prompt injection success rate, showing the safety classifier that replaced human approval prompts is far more bypassable in practice than claimed.

This is a defensive research paper, not an active exploit. It quantifies how LLM agents habitually over-share privacy-sensitive data in tool call arguments (81-88% of calls) and proposes ToolMinimize, a middleware that rewrites arguments to the minimum necessary data. The finding highlights a systemic data-hygiene weakness in agent-to-tool interactions rather than describing a novel attack technique.

Google's langfun library (versions before 0.1.2) evaluates Python expressions generated by an LLM in response to lf.query prompts without any sandboxing. A remote unauthenticated attacker who can influence prompt input can cause the model to emit malicious Python code that gets executed directly in the host application, resulting in full arbitrary code execution.

This raw data is a blog post quoting commentary about AI's ability to write and refine large amounts of code over time. It contains no information about vulnerabilities, attacks, or security issues involving AI agents, tools, or protocols. This is not a security threat.

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

This is an academic security analysis (not an active exploit) of Google's Agent Payments Protocol v0.2, which is used by LLM-driven shopping agents to authorize payments. The researchers show that while signed Checkout and Payment Mandates protect transaction integrity after signing, the A2A and MCP interactions that shape the transaction beforehand are unprotected, enabling an agent to be manipulated into signing a mandate that does not reflect the user's true intent. The paper identifies 48 catalogued threats across five attack families, with eight rated High severity, and provides proof-of-concept demonstrations plus a deployment-aware scanner.

This is a defensive research paper, not an active threat or exploit. It proposes 'Semantic Overlays,' a technique using learned adapters on a model's residual stream to help LLMs distinguish trusted instructions from untrusted content (e.g., tool outputs, user input), thereby mitigating prompt injection. The paper reports strong benchmark improvements against known prompt injection attack suites, and severity is low since it describes a mitigation, not a vulnerability or attack.

This is a defensive research paper, not an active exploit: it identifies real trust-boundary gaps in the emerging W3C WebMCP proposal that let malicious web pages spoof tool ownership, manipulate tool lifecycles, and inject prompts via tool metadata/descriptions into browser-integrated LLM agents. The authors propose and empirically validate a dual-layer runtime (cryptographic tool provenance plus a quarantine/privileged agent split) that reduces these attack classes to near-zero success, while also disclosing a residual bypass via malicious tool names invoked before inspection.

This is a defensive research paper, not an active exploit or vulnerability disclosure. It proposes Attnlocate, a runtime framework that analyzes LLM attention patterns to pinpoint which parts of external/tool-provided context are actually driving an agent's tool-calling decisions, helping detect indirect prompt injection and tool poisoning attacks. Since this describes a mitigation technique rather than a new threat, severity is low from a threat standpoint, though the underlying attack classes it addresses (indirect prompt injection, tool poisoning) remain real risks for agentic systems.

Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.

AnonyMousKIT is a phishing-as-a-service platform that uses voice AI agents to impersonate Apple support and trick victims into revealing codes needed to unlock stolen iPhones and disable Activation Lock. This is primarily a human-facing social engineering threat that leverages AI voice generation to scale traditional vishing rather than an attack on agent infrastructure or protocols. Severity is high due to real-world financial and privacy harm to victims and the commoditization of AI-driven fraud tooling.

MCP tools in the sublinear-time-solver and consciousness-explorer packages accept a user-supplied file path parameter and pass it directly to filesystem operations without validating or restricting the destination. This allows any client able to invoke these MCP tools to read, write, or overwrite arbitrary files accessible to the server process, leading to data exposure, tampering, or service disruption. The issue is fixed in later versions of both packages.

The genieacs-mcp MCP server, prior to version 0.3.2, exposes an unauthenticated HTTP listener on localhost by default and fails to validate Host/Origin headers, making it vulnerable to DNS rebinding attacks from malicious websites. An attacker who lures a victim to a malicious webpage can pivot through the victim's browser into the local MCP server and issue commands against the GenieACS TR-069 ACS backend, potentially rebooting devices, altering firmware tasks, or changing CPE configuration. This is a genuine, well-documented vulnerability with a clear exploitation path and meaningful impact on managed device fleets.

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

A vulnerability in Amazon Strands Agents Tools' python_repl tool allows attackers to craft prompts that bypass the human-in-the-loop consent gate by forwarding a non_interactive_mode keyword argument through the batch tool. This can lead to arbitrary Python code execution on the agent's host without human approval, effectively defeating a key safety control. Upgrading to version 0.8.5 or later remediates the issue.

The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.

The Nextcloud MCP Server's webhook endpoint lacks authentication by default because a required secret defaults to None, letting any network attacker send forged requests. These forged requests can delete or force re-indexing of another user's semantic search embeddings in Qdrant, effectively destroying or manipulating the AI assistant's retrieval memory. This is a critical, unauthenticated remote vulnerability fixed in version 0.117.2.

mcp-shell, an MCP server designed to run shell commands securely, contains a filter bypass that allows a malicious or compromised caller to execute arbitrary OS commands via a crafted Git alias, even with 'secure mode' enabled. Because the default Docker deployment includes Git and runs the vulnerable filters out of the box, any agent or user with MCP connectivity to the tool can achieve full arbitrary code execution as the mcpuser process. This is a critical tool-layer vulnerability affecting the trust boundary between an AI agent and the command-execution tool it calls.

The mcp-shell MCP server, intended to safely execute allowlisted shell commands on behalf of an AI agent, fails to properly validate command arguments when the executable is bash. An attacker or a compromised/malicious agent can invoke the shell_exec tool with '/bin/bash -c <command>' to run arbitrary commands as the mcpuser, completely bypassing the intended security allowlist. This is a high-severity tool-layer vulnerability that gives an attacker code execution wherever the fixed pre-0.6.0 mcp-shell server is deployed.

mcp-shell, an MCP server that exposes shell command execution to LLM agents, ships with security disabled by default and the documented installation steps never enable it. As a result, any LLM or agent connected to a default deployment can run arbitrary OS commands as the mcp-shell process user, giving effectively unrestricted remote code execution through a trusted tool interface. The issue is fixed in version 0.6.0.