Threat Library

The MCP Kotlin SDK's stdio transport buffers incoming bytes with no size limit and only flushes frames on a newline delimiter, allowing a malicious or malformed peer to stream endless newline-free data and exhaust JVM memory until the host process is OOM-killed. This is a remote, pre-authentication denial-of-service issue affecting any deployment where stdin to the MCP server is fed by an untrusted producer, such as a proxy or wrapper bridging network input to stdio. The vendor has released version 0.13.0 with a fix.

A vulnerability in n8n allowed a workflow's caller restriction setting ('This workflow can be called by') to be bypassed when the restricted workflow was attached to an AI Agent as a tool instead of invoked via the standard Execute Workflow node. This let a user with Agent-building privileges invoke and read output from workflows they were explicitly not authorized to call, breaking intended access boundaries. The issue is fixed in n8n 2.37.7 and 2.38.2.

This is an academic research paper (not an active exploit) that reframes indirect prompt injection as a search problem, showing that an attacker agent with more compute and structured strategy management becomes significantly better at finding and exploiting injection vulnerabilities in victim agents. The core finding is that attack success scales with attacker search budget and adaptive strategy, meaning current security evaluations that treat 'attack success' as fixed likely underestimate real-world risk against tool-using agents.

Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw in the SaveToFileComponent that lets an authenticated, low-privileged user write files to arbitrary locations on the server via the /api/v1/run/{flow_id} endpoint. This is a classic input validation failure in an agent-building tool component rather than a novel agentic attack, but it can be leveraged to escalate into further server compromise depending on deployment. Severity is moderate due to the authentication requirement, but risk increases sharply in multi-tenant or exposed Langflow deployments.

A stored cross-site scripting vulnerability exists in the Playground chat interface of IBM Langflow OSS, a popular framework for building LLM/agent workflows. An attacker could inject malicious script content that executes in the browser of another user viewing the chat, potentially hijacking sessions or performing actions on their behalf within the Langflow UI.

Rowboat versions through 0.9.1 let authenticated users register arbitrary MCP server and webhook URLs without validating the destination, enabling server-side request forgery. An attacker can abuse this to reach internal-only services or cloud instance metadata endpoints, potentially exposing credentials or internal network topology. This is a classic insecure agent-tool-configuration flaw rather than a novel agentic attack technique.

The postgres-mcp-server (versions before 1.1.7) has an incomplete SQL input validation blocklist that can be bypassed with crafted SQL, allowing data modification even when the tool is configured for read-only access. This lets a user of the MCP server escape its intended safety boundary and perform writes it should have blocked.

An authenticated user of IBM MQ Console can submit oversized or computationally expensive requests to the AI Agent feature, tying up LLM agent workers for extended periods. Sending multiple such requests concurrently exhausts the worker pool, degrading or fully blocking the AI Agent feature for all other users. This is a classic denial-of-service issue rather than a model-manipulation or data-exfiltration threat.

This is a controlled academic study (not an active exploit) showing that when an agent pulls data via MCP and then relays it to another agent via A2A, simply attaching a 'PUBLIC - OK TO SHARE' label to a record can increase the odds that sensitive substantive field values are copied verbatim into outbound messages, compared to unlabeled data. The effect is strongly model-dependent (pronounced in one Claude model, weaker or floor-limited in GPT-5.6 tiers) and the paper is explicit that this is an association in one configuration, not a proven general or causal effect. Severity is modest because it is a research finding highlighting a labeling/trust-heuristic weakness rather than a demonstrated in-the-wild attack.

This is a defensive research paper, not an active exploit, that identifies a structural weakness in OAuth-secured remote MCP tool use: a tool endpoint can remain 'authorized' even after the underlying workload executing the call has been substituted, is running stale attestation state, or reuses authority meant for a different sender. The authors propose ACLE-MCP, an invocation-scoped capability-lease architecture that binds authorization to fresh, workload-specific execution state, and demonstrate it closes these gaps with a manageable latency cost.

Boruta, an OAuth2/OIDC authorization server, logged sensitive credentials including access tokens, refresh tokens, ID tokens, and agent tokens in plaintext business event logs prior to version 0.10.0. Anyone with access to these logs, log aggregation pipelines, or the admin log viewer could extract valid tokens and reuse them for unauthorized access until expiration or revocation. This is a credential-hygiene vulnerability rather than a novel agent-specific attack, but it directly threatens agent-to-service authentication where 'agent tokens' are among the logged values.

Unit 42 reports on an incident in which an attacker used autonomous AI agents to accelerate reconnaissance, exploitation, and lateral movement, compromising an enterprise network within hours. The article is a threat intelligence/case study piece describing attacker tradecraft rather than a specific vulnerability in an agent framework, protocol, or tool; the raw data provided lacks technical detail on the AI tooling or agent architecture used. Given the absence of concrete technical indicators, this is rated medium severity as a notable trend/case study rather than an actionable exploit.

This is an academic research paper (not an active exploit) that formalizes a threat model for multi-agent LLM delegation and empirically shows that popular agent frameworks (LangGraph, CrewAI, AutoGen) and the MCP authorization model lack proper confinement, allowing a prompt-injected agent or compromised sub-agent to exceed its delegated authority. The paper also proposes and validates an authorization broker as a mitigation. Severity is medium because it describes a systemic design gap rather than a live exploit, but the underlying issue (broad bearer credentials plus in-model authorization) is a real and widely applicable weakness.

This is a research paper describing SIR, a red-teaming methodology that automatically discovers and refines indirect prompt injection attacks against computer-use agents (CUAs) like Claude Opus and Gemini. It demonstrates that adaptive, self-improving attack composition significantly increases attack success rates over static hand-written injections, revealing that current CUA safety benchmarks likely underestimate real-world risk. No active exploit or in-the-wild campaign is described; this is disclosed academic security research intended to improve defenses.

The sdcb 'chats' application (up to v1.12.0) contains a server-side request forgery (SSRF) vulnerability in its MCP-related fetch-tools endpoint, allowing a remote attacker to make the server issue arbitrary HTTP requests. A public exploit exists and the vendor has not responded to disclosure, so this remains unpatched. Severity is moderate given the network-based attack vector but no confirmed data exfiltration or code execution in the description.

A person reportedly embedded hidden AI instructions inside a legal filing, attempting to manipulate any AI system that later reads and processes the document into ruling or advising in their favor. This is a classic indirect prompt injection attack applied to a real-world professional document workflow rather than a novel technical exploit. Severity is moderate since the report describes a single documented incident without technical detail on payload sophistication or actual impact on a legal outcome.

This is an academic benchmark paper (not an active exploit) demonstrating that existing prompt injection defenses, which perform reasonably in short-context settings, largely fail when injected instructions are embedded in long documents like resumes, code, or emails. The authors show even simple heuristic injection attacks bypass state-of-the-art defenses at high success rates in realistic long-context LLM application scenarios. Severity is moderate because it is a research finding highlighting a systemic weakness rather than a disclosed exploit against a specific product or live system.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authorization flaw that lets any authenticated user execute or read another user's private flows. This is a classic access-control bug in an agent-orchestration framework rather than a novel agentic attack technique, but it can expose proprietary prompts, credentials embedded in flows, and business logic, or allow unauthorized execution of another tenant's automation.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to make the server send unauthorized requests to internal or external systems. This could be used for internal network reconnaissance or as a stepping stone for further attacks, but requires authentication and has moderate severity per its CVSS score of 4.3.

This report describes how AI coding agents are now able to turn a mere rumor of a bug (e.g. a patch shared for discussion) into a working exploit within minutes, drastically outpacing traditional open-source security disclosure and embargo timelines. This is not an attack on AI agents themselves, but a broader supply-chain/process risk: maintainers like rclone report a 20x increase in security disclosures alongside overwhelmed CVE assignment pipelines. Severity is assessed as medium because it describes a systemic process/workflow risk rather than a specific exploitable vulnerability in an agent framework or protocol.