Unexpected Code Execution

OpenAI Codex CLI and Desktop failed to correctly parse PowerShell's stop-parsing token (--%), causing malicious commands to be misclassified as safe and auto-approved. An attacker who gets a user to open a poisoned repository can trick Codex into running an unapproved file-writing Git command that rewrites Codex's own configuration, ultimately allowing it to launch an attacker-controlled MCP server and execute code with the user's privileges.

Updated Sep 4, 2026 · CVSS 8.8

This is an academic research paper proposing a new protocol-layer defense (Skill-as-API) rather than a report of an active exploit. It identifies a legitimate design weakness in current agent coordination protocols like MCP and A2A: they expose full skill descriptions, schemas, and potentially system prompts to all peers, and offer no mechanism to hide skill existence or narrow the prompt-injection surface structurally. Severity is low because this is a proactive mitigation proposal, not evidence of exploitation in the wild.

Updated Sep 3, 2026

Researchers demonstrate a novel attack (ISM) that manipulates which skill/tool an LLM agent selects by crafting benign-looking skill metadata and prompts whose semantic relationship is engineered to bias the selector, without any explicit steering instructions. This bypasses human review and existing prompt-injection defenses far more effectively than explicit instruction-based attacks, raising the target-selection rate from ~15% baseline to ~63-73%.

Updated Sep 3, 2026

This is a defensive research paper, not an active exploit or vulnerability disclosure. It formally describes how persistent AI agents can be poisoned when untrusted inputs (including prompt injections or unverified model inferences) get stored and later recalled as if they were verified agent history or user commitments, and proposes a typed provenance/guardrail system to prevent this. The core contribution is a mitigation architecture, evaluated against a small hand-authored conformance suite, not a report of a real-world attack.

Updated Sep 3, 2026

This is a defensive research paper, not an active exploit, that identifies a structural weakness in OAuth-secured remote MCP tool use: a tool endpoint can remain 'authorized' even after the underlying workload executing the call has been substituted, is running stale attestation state, or reuses authority meant for a different sender. The authors propose ACLE-MCP, an invocation-scoped capability-lease architecture that binds authorization to fresh, workload-specific execution state, and demonstrate it closes these gaps with a manageable latency cost.

Updated Sep 3, 2026

Manifold Security found eight flaws in seven popular command-line AI coding agents (including Claude Code, Codex, and Cursor) where a malicious repository's Git configuration can specify a command that the agent automatically executes on the developer's machine. This execution happens outside the agent's sandbox and without any user approval prompt, meaning simply cloning or opening a booby-trapped repo can lead to arbitrary code execution as the developer's user. Four of the eight issues remained unpatched at the time of publication.

Updated Sep 3, 2026 · CVSS 8.1

This is an academic systematization-of-knowledge (SoK) paper analyzing 197 prior works on multi-agent LLM system security, not a novel exploit or active threat. It proposes an organizing framework (A-I-R: adversary position, interaction interface, resulting risk) to unify understanding of how attacks propagate across agent boundaries in MAS. Severity is low because this is a research taxonomy/survey with no new attack disclosed, no PoC, and no affected product identified.

Updated Sep 2, 2026

This is a defensive research paper, not an active exploit or vulnerability disclosure. It proposes a system where AI agents exchange zero-knowledge proofs of policy compliance instead of raw data or unverifiable natural-language claims, reducing the prompt-injection-relevant attack surface of 'trust me, I complied' agent-to-agent communication. The authors themselves identify a residual limitation (proofs not bound to the system of record) and propose an enclave-attestation extension to address it.

Updated Sep 1, 2026

The sdcb 'chats' application (up to v1.12.0) contains a server-side request forgery (SSRF) vulnerability in its MCP-related fetch-tools endpoint, allowing a remote attacker to make the server issue arbitrary HTTP requests. A public exploit exists and the vendor has not responded to disclosure, so this remains unpatched. Severity is moderate given the network-based attack vector but no confirmed data exfiltration or code execution in the description.

Updated Sep 1, 2026 · CVSS 6.3

MCPHub, a management hub for MCP servers, fails to restrict server configuration endpoints to admin users and does not sanitize the command/args used to spawn MCP server processes. Any authenticated non-admin user can register a malicious MCP server configuration that MCPHub immediately executes, resulting in full remote code execution as the host's OS user, often root. This is a critical, easily exploitable authorization flaw with a severe real-world impact.

Updated Sep 1, 2026 · CVSS 9.9

MCPHub, a management hub for MCP servers, allows any authenticated non-admin user to register a malicious MCP server pointing at arbitrary internal or external URLs, causing the hub to make server-side requests without egress filtering. This enables both reflected SSRF (attacker sees response data via the OpenAPI proxy) and blind SSRF (via SSE/streamable-http transport), potentially exposing internal services, cloud metadata endpoints, and loopback/RFC1918 resources.

Updated Sep 1, 2026 · CVSS 7.1

MCPHub, a management hub for multiple MCP servers, contains a flawed authorization check that lets a bearer key scoped to one specific MCP server gain access to every other server in the same group. Any credential holder with narrow, single-server authorization can silently pivot to unauthorized MCP servers, effectively breaking the tool/server isolation model the hub is meant to enforce. This was fixed in version 1.0.31.

Updated Sep 1, 2026 · CVSS 8.1

This is a defensive research paper, not an active exploit or newly disclosed vulnerability. It proposes ROPE, a system that tracks the provenance of tool call parameters to block indirect prompt injection (IPI) attacks where malicious instructions embedded in tool-read content hijack an agent's tool calls. The underlying threat class (IPI leading to unauthorized state-changing tool calls) is real and well-known, but this document itself describes a mitigation with strong empirical results, not a new attack.

Updated Aug 31, 2026

The ash_ai library's MCP server implementation has a flawed origin validation check that can be bypassed using DNS rebinding, allowing a malicious website to issue cross-site requests to a user's locally running MCP server as that user's authenticated actor. Both values used in the trust decision (Host header and X-Forwarded-Proto header) are attacker-controlled from the browser, making the check ineffective by default. This affects versions 0.8.0 through before 1.0.0 and is fixed by defaulting to trusting only localhost origins.

Updated Aug 31, 2026

A critical flaw in IBM Langflow OSS allows an authenticated user to escalate from limited flow-building privileges to full arbitrary command execution on the server. By crafting a malicious 'type' field in a saved flow and triggering a build via a wrapper flow, an attacker bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false safeguard intended to block custom code execution. This effectively hands the attacker OS-level control of the agent server process.

Updated Aug 29, 2026 · CVSS 9.9

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation. This affects a widely used low-code framework for building AI agent workflows, meaning any authenticated user could potentially compromise the underlying host or downstream agent components.

Updated Aug 29, 2026 · CVSS 8.8

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to make the server send unauthorized requests to internal or external systems. This could be used for internal network reconnaissance or as a stepping stone for further attacks, but requires authentication and has moderate severity per its CVSS score of 4.3.

Updated Aug 29, 2026 · CVSS 4.3

The Dash MCP server bound its network listener to loopback but failed to validate the Host header of incoming requests, allowing DNS rebinding attacks from a malicious webpage to reach the local server. An attacker-controlled page in a victim's browser could rebind a domain to 127.0.0.1 and invoke the server's tools using the victim's stored Dropbox credentials. The issue is limited to the network transport mode and was fixed by adding host-checking transport security.

Updated Aug 29, 2026 · CVSS 3.1

tiger-slack's MCP HTTP transport failed to enable the SDK's built-in host allow-list/DNS-rebinding protection, allowing a malicious webpage visited by a user on the same machine to rebind a DNS name to the local MCP server's address and issue requests to it. This lets an attacker's browser-based script drive the locally running Slack MCP server on behalf of the victim, potentially reading or sending Slack data without authorization. The fix requires explicitly enabling the allow-list option, not just updating the dependency.

Updated Aug 29, 2026 · CVSS 6.8

ToolUniverse's python_code_executor tool exposes a Python sandbox that can be trivially escaped using the classic __class__.__base__.__subclasses__() technique to reach process and subprocess modules, because its security relies on an incomplete denylist rather than real isolation. This sandbox is served over HTTP and MCP endpoints that bind to all network interfaces with no authentication and debugging enabled, meaning any network-reachable attacker can achieve full remote code execution as the server process. This is a maximum-severity, trivially exploitable vulnerability with no prerequisites.

Updated Aug 29, 2026 · CVSS 10