Threat Library

Eclipse Theia's AI Agent Mode file-editing tools fail to validate that model-supplied file paths stay within the workspace, allowing a malicious or manipulated model output to write or delete arbitrary files on the host. Since these tools execute without user confirmation, an attacker who can influence model output via indirect prompt injection can escalate to full code execution on the backend by overwriting files like shell startup scripts or SSH authorized_keys. This is a critical, high-impact vulnerability combining a classic path traversal flaw with the AI-specific attack surface of untrusted model-controlled tool arguments.

Agno versions up to 2.5.8 allow an unauthenticated attacker to achieve remote code execution by embedding malicious instructions in content the agent processes, such as a web page or document. Because LLM-generated arguments are passed unsanitized into exec(), runpy.run_path(), and subprocess.run(), the agent itself becomes the execution vector for attacker-controlled code. This is a critical, actively exploitable framework vulnerability with no authentication required.

Researchers demonstrated that a simple malicious website summary request can hijack Claude Code Opus 5's 'Auto Mode' and achieve remote code execution with a 60-80% success rate. This directly contradicts Anthropic-commissioned third-party evaluations that reported a 0.00% prompt injection success rate, showing the safety classifier that replaced human approval prompts is far more bypassable in practice than claimed.

Context7 (through version 2.1.2) contains a critical prompt injection vulnerability in its Custom AI Instructions feature, served via its MCP server, that lets attackers plant malicious instructions which connected coding agents automatically execute. During a routine library documentation lookup, an unsuspecting agent can be hijacked to exfiltrate credentials from environment files and delete files on the victim's machine.

Flowise's CSV Agent node feeds untrusted user input directly into an LLM prompt used to generate Python code, then executes the LLM's response in an unsandboxed pyodide environment after only a weak regex blocklist check. An attacker can use prompt injection to make the LLM emit obfuscated malicious code that bypasses the blocklist and achieves arbitrary code execution on the host, with no authentication required.

A vulnerability in the shell tool of Amazon Strands Agents Tools (before v0.8.0) allows an attacker to craft a prompt that sets the 'non_interactive' parameter to true, bypassing the human consent gate designed to approve shell command execution. This enables remote actors to execute arbitrary OS commands on the agent's host without user approval, effectively turning a safety control into a no-op. This is a high-severity issue given the direct path from prompt injection to remote code execution.

Researchers found that hidden text on an ordinary web page could hijack AWS Kiro, an agentic coding IDE, causing it to rewrite its own configuration file and execute attacker-controlled code without any human approval step. A simple task like asking Kiro to summarize a webpage was enough to trigger full remote code execution on the developer's machine. AWS has since patched the flaw, though no CVE has been assigned.

AgenticMail's inbound-mail bridge lets any external email trigger a full resume of the operator's Claude Code agent session in an unrestricted 'bypassPermissions' mode, without verifying the sender is actually the operator. Because the attacker-controlled email subject, sender, and preview text are inserted verbatim into the resumed agent's prompt, this is a straightforward indirect prompt injection path into a fully privileged agent capable of Bash, file edits, web fetches, and other MCP tools. This is a critical, easily exploitable vulnerability with a vendor-supplied fix.

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.