Threat Library

Agent-to-agent threats first — conventional coverage one click away.

Browse by hub: AI agent threats · Conventional watchlist · OWASP Agentic Top 10

Agent ThreatsConventionalAll
TypeAllPrompt InjectionTool PoisoningMemory PoisoningAgent WormFramework VulnerabilityProtocol Vulnerability
SeverityAllCriticalHighMedium

Showing 1 of 1 threats

mcp-memory-service Missing Authentication on /api/documents RoutescriticalAgent
MCPauthentication-bypassmemory-poisoningunauthenticated-accessagent-memorybroken-access-controlmcp-memory-serviceASI05 · Unsafe Code ExecutionAML.T0020AML.T0048Surface: MemoryPropagation: Single Hop

mcp-memory-service, a semantic memory backend used by AI agents, exposes all /api/documents/* routes without any authentication check even when an API key or OAuth is configured. This lets an unauthenticated remote attacker read, write, or delete an agent's persistent memory store, enabling memory poisoning and data theft. The flaw is fixed in version 10.67.1.

▾