Unexpected Code Execution

9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.

Updated Jul 8, 2026 · CVSS 9.8

This is an academic defense paper, not an active exploit report. It describes and mitigates 'stored IPI', a known weakness in Dual-LLM prompt injection defenses where untrusted data written to disk/environment and later reread loses its 'untrusted symbol' tagging and becomes trusted again. The paper's proposed solution, DualView, is presented as fully blocking this class of attack in benchmarks, so the actual residual risk described here is low and mainly relevant to agents using prior, incomplete Dual-LLM protections.

Updated Jul 7, 2026

This item is a retrospective and largely positive report: OpenAI published a paper detailing mitigations for a long-known zero-click data exfiltration technique in which a language model can be manipulated into rendering attacker-controlled URLs (e.g., markdown images) that leak conversation data to an external server. The underlying vulnerability class was disclosed by the author nearly three years ago and was already mitigated by Microsoft in Bing Chat in 2023; this post covers OpenAI's newer, more formal write-up of defenses. Severity is moderate rather than critical because this is historical/defensive reporting on a well-understood, largely mitigated issue rather than a new active exploit.

Updated Jul 5, 2026

A server-side request forgery flaw exists in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server, where the 'url' argument passed to an MCP tool is not validated before the server fetches it. A remote attacker can supply this MCP-exposed tool with an internal or attacker-controlled URL to make the server issue requests on their behalf, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

Updated Jul 5, 2026 · CVSS 6.3

This is a Simon Willison blog post announcing an experimental alpha release of a Python coding agent library (llm-coding-agent) built on his LLM framework. It describes an AI-generated coding agent with file editing, shell execution, and file search tools, but the content is purely a release announcement with no evidence of a vulnerability, exploit, or malicious activity. The presence of powerful tools like execute_command and edit_file is inherent to any coding agent design and is explicitly disclosed by the author (including a --yolo flag), not a hidden threat.

Updated Jul 5, 2026

This is an academic research paper (not an active exploit) that identifies a structural weakness in MCP-style agent runtimes: security is typically enforced only at the connection layer (auth, session checks, approval dialogs) while execution-time actions lack consistent, testable invariants like principal binding and data-flow authorization. The authors demonstrate that naive and even 'practice-informed' mitigation baselines still permit most modeled attacks, and propose a reference runtime (HCP) that blocks all 10 benchmark attack cases by enforcing explicit execution-layer controls.

Updated Jul 5, 2026

This is a defensive research paper, not an active threat or exploit disclosure. It presents a detection method that identifies memory-poisoning attacks in LLM agents by analyzing tool-call ordering patterns (specifically, a memory-recall call preceding an email-send call), achieving very high classification accuracy. Since it describes a detection technique rather than a vulnerability or attack, severity is low from a threat standpoint, though the underlying attack class it detects (memory poisoning leading to data exfiltration) remains a legitimate concern.

Updated Jul 5, 2026

This is an academic research paper (not an active exploit) introducing SafeClawArena, a benchmark that systematically measures security failures in always-on 'Claw-like' agents such as OpenClaw, which hold persistent credentials, files, and tool access. The findings show alarmingly high attack success rates (up to 70%, and 100% for malicious plugins), indicating that current agent platforms lack the isolation and mediation protections found in traditional OS design. Because this is a controlled research disclosure rather than an in-the-wild attack, severity is rated high (not critical) but warrants urgent defensive attention given the demonstrated real-world exploitability.

Updated Jul 5, 2026

The MCP Inspector developer tool shipped a proxy that lacked authentication, allowing browser-based attackers to reach it from a malicious web page and execute code on the developer's machine. Reported by Oligo Security with a CVSS score of 9.4.

Updated Jul 3, 2026 · CVSS 9.4