Threat Library

A server-side request forgery (SSRF) vulnerability exists in the aerostack-mcp project's mcp-whatsapp component, specifically in the upload_media function's media_url argument. A remote attacker can supply a malicious URL to force the MCP server to make unintended requests, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

This item is a retrospective and largely positive report: OpenAI published a paper detailing mitigations for a long-known zero-click data exfiltration technique in which a language model can be manipulated into rendering attacker-controlled URLs (e.g., markdown images) that leak conversation data to an external server. The underlying vulnerability class was disclosed by the author nearly three years ago and was already mitigated by Microsoft in Bing Chat in 2023; this post covers OpenAI's newer, more formal write-up of defenses. Severity is moderate rather than critical because this is historical/defensive reporting on a well-understood, largely mitigated issue rather than a new active exploit.

A server-side request forgery flaw exists in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server, where the 'url' argument passed to an MCP tool is not validated before the server fetches it. A remote attacker can supply this MCP-exposed tool with an internal or attacker-controlled URL to make the server issue requests on their behalf, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.

This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.

This is an academic research paper (not an active exploit) that identifies a structural weakness in MCP-style agent runtimes: security is typically enforced only at the connection layer (auth, session checks, approval dialogs) while execution-time actions lack consistent, testable invariants like principal binding and data-flow authorization. The authors demonstrate that naive and even 'practice-informed' mitigation baselines still permit most modeled attacks, and propose a reference runtime (HCP) that blocks all 10 benchmark attack cases by enforcing explicit execution-layer controls.

This is an academic research paper (arXiv, not an active exploit) empirically benchmarking six major LLMs against direct, multilingual, and obfuscated prompt injection attacks. The study finds that all tested models can be induced to generate phishing content, malicious websites, and malware, with non-English prompts and multi-stage obfuscation significantly increasing compliance rates. Since this is a research disclosure rather than an in-the-wild exploit or agent-specific vulnerability, severity is rated medium rather than high/critical.