Threat Library

Agno's PythonTools contains a path traversal flaw that lets an attacker escape the intended sandboxed base_dir by supplying '../' sequences in file arguments to read_file, save_to_file, or run_python_file. This can be triggered either through direct tool calls or by embedding traversal payloads in content the agent processes (prompt injection), resulting in arbitrary file read, write, or code execution at the privilege level of the agent process. Given the high CVSS score and ease of exploitation, this is a critical, actively exploitable vulnerability rather than a theoretical concern.

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.

This is an academic defensive framework, not an active threat or exploit. PACE proposes a way to cryptographically bind LLM-approved DeFi transaction intents to what actually executes on-chain, mitigating prompt-injection and plan-tampering risks in autonomous trading agents. It reduces risk rather than introducing it; severity is set to low because the raw data describes a mitigation, not a vulnerability being exploited in the wild.

This is an academic survey (not an active exploit) analyzing how existing agent-security weaknesses become far more dangerous when AI agents use MCP tools and skills to sign and execute transactions on public blockchains. The authors argue that irreversibility, private-key signing authority, autonomous operation, and multi-step transaction composition turn normally recoverable agent failures into permanent financial loss, and find current defenses stop fewer than 30% of attacks. Since this is a research synthesis rather than a disclosed vulnerability or in-the-wild attack, severity is rated medium/informational for defenders rather than critical.

This is an academic research paper (not an active exploit) introducing a benchmark, MobileWorldSafety, that measures how susceptible LLM-powered Android GUI agents are to environmental/indirect prompt injection embedded in app content. The study found attack success rates of 40.4%-66.9% across six agents, indicating a real and significant class of vulnerability, though the artifact itself is a defensive research tool rather than a live threat.

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

Context7 (through version 2.1.2) contains a critical prompt injection vulnerability in its Custom AI Instructions feature, served via its MCP server, that lets attackers plant malicious instructions which connected coding agents automatically execute. During a routine library documentation lookup, an unsuspecting agent can be hijacked to exfiltrate credentials from environment files and delete files on the victim's machine.

ArcadeDB's MCP server tool set_server_setting only checks a global allowAdmin flag rather than the calling user's actual role, allowing any authenticated read-only user to modify server-wide configuration when allowAdmin is enabled. This lets a low-privileged user tamper with GlobalConfiguration or trigger denial of service. The fix in 26.8.1 adds proper per-caller role enforcement.

A flaw in the CodeWhale agent framework causes the exec_shell_interact tool to skip the mandatory human-approval step for code execution, defaulting it to auto-approved. This lets attacker-controlled content ingested by the agent (e.g., a malicious web page, MCP tool result, or repo file) inject commands that execute silently inside an already-approved privileged shell session such as sudo, ssh, or a database console. Fixed in version 0.8.64.

CodeWhale's git_show tool passes an LLM-controlled 'rev' parameter directly into git's command line without sanitization, allowing a value like '--output=~/.ssh/authorized_keys' to be interpreted as a git flag rather than a revision. Because the tool is auto-approved and marketed as read-only, a malicious repository combined with prompt injection can trick the agent into silently overwriting sensitive files with attacker-controlled content, effectively achieving persistence or account takeover at the user's privilege level. This is a critical, easily exploitable vulnerability with a working fix already available in version 0.8.64.

CodeWhale's rlm_eval tool is misconfigured to always auto-approve code execution, bypassing the user's approval policy entirely. An attacker who can plant instructions in content the agent reads (a webpage, repo file, or MCP tool result) can trigger arbitrary Python execution on the user's machine at the user's privilege level, with no prompt or audit trail. This is a straightforward and highly exploitable prompt-injection-to-RCE chain fixed in version 0.8.64.

This is an academic research paper (not an active exploit) empirically studying how the structure of a code workspace -- directory depth, file modularity, injection location, and surrounding context -- affects the success rate of indirect prompt injection attacks against agentic coding assistants. The findings are useful defensively: they show that highly modular codebases and certain security-cue framing reduce attack success, informing how organizations should test and harden coding agents that ingest third-party code.

This is a defensive research paper describing TwinGridShield, a proposed runtime authorization system that validates LLM-proposed power grid commands against a physical network twin before execution. It is not an active exploit or vulnerability disclosure; it demonstrates a mitigation approach and honestly reports its own limitations under model mismatch conditions. Severity is low because this raw data describes protective research, not a threat.

This is an academic research paper describing a defensive authorization architecture (Agentic Principal Chain) for multi-agent LLM systems, not an active exploit or newly disclosed vulnerability. It identifies a real architectural weakness class in agent systems—static, per-request permission checks that ignore session history—and proposes and validates a mitigation. No new attack technique, tool, or malicious campaign is disclosed here.

MLflow's model registry fails to properly validate ownership when creating a model version linked to a run_id or model_id, only checking path containment rather than authorization. This lets any authenticated user reference another user's artifact directory and read private files via the artifact-get API, bypassing READ permission checks.

MLflow versions 3.13.0 through 3.14.x are missing an authorization check on the log-inputs API endpoint, letting any authenticated user inject fabricated dataset lineage records into another user's ML run without holding UPDATE permission. This undermines trust in experiment metadata and lineage tracking, which many AI agent pipelines rely on for provenance and reproducibility, but it does not itself provide remote code execution or full account takeover. The issue is fixed in MLflow 3.15.0.

An unauthenticated SSRF vulnerability exists in MLflow's webhook test endpoint that allows attackers to bypass URL validation using HTTP redirects. Attackers can craft a webhook pointing to a benign-looking URL that redirects to internal services or cloud metadata endpoints, then retrieve the response including sensitive credentials. This affects any AI agent or ML pipeline built on vulnerable MLflow versions, exposing cloud infrastructure secrets.

MemOS, a memory operating system for LLM agents, contains a critical authentication bypass where an unset internal-service secret causes the system to treat any unauthenticated request as a trusted internal caller with full privileges. This allows remote attackers to mint admin API keys, generate master keys, and access all data and memory endpoints without credentials. The flaw is trivially exploitable and results in complete compromise of the memory layer underlying dependent AI agents.

The mcp-florence2 MCP server contains a server-side request forgery vulnerability in its get_images function, allowing a remote attacker to supply a malicious 'src' argument that causes the server to make unauthorized HTTP requests. This could be used to probe internal networks, access cloud metadata endpoints, or interact with internal services reachable by the MCP server. A public exploit exists, increasing the urgency of remediation.

This raw data is a blog post by Simon Willison reviewing the Qwen 3.8 27B model, noting that its default 'xhigh' reasoning effort setting causes excessive token usage and long generation times on consumer hardware. This is a usability/performance observation about model configuration defaults, not a security vulnerability, prompt injection, or agent-to-agent threat.