Unexpected Code Execution

This is not a vulnerability disclosure but a research paper describing AgentFlow, a defensive framework that enforces data-flow policies across LLM agent tool calls and delegation boundaries to prevent prompt-injection-driven data exfiltration and unsafe cross-agent authority propagation. The work reports strong reductions in confirmed compromise rates across several established agent security benchmarks (AgentDojo, AgentDyn, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox). Severity is rated low because the raw data describes a proposed mitigation, not an active threat, exploit, or newly discovered weakness.

Updated Aug 25, 2026

The Continue CLI's headless/auto mode relies solely on an incomplete denylist to block dangerous shell commands, missing paths like /home, /root, /var, and failing to properly handle variable expansion such as $HOME. An attacker who can inject instructions into content the agent reads (web pages, repo files, issues) can trigger destructive commands like recursive deletion, causing unattended agent runs to destroy user data.

Updated Aug 25, 2026 · CVSS 7.4

This is a defensive research paper describing ClawSentry, a security gateway that monitors LLM agents to detect and block malicious third-party skills/tools before and during execution. It is not an active exploit or vulnerability disclosure, but rather a proposed mitigation framework benchmarked against known attack scenarios (SkillInject, SkillsSafety). Severity is low from a threat perspective since this describes protective tooling, though it implicitly confirms that unprotected agent runtimes have high attack success rates (33.5-49.7%) against malicious skill injection.

Updated Aug 24, 2026

This is an academic research paper (not an active exploit) demonstrating that persistent agent memory systems are highly vulnerable to simple, plainly worded false statements: poisoning just 1.2% of a memory corpus dropped answer accuracy from 0.85 to 0.30. The authors show that both write-time content screening and provenance-weighted retrieval defenses fail to catch these low-effort attacks, exposing a fundamental architectural gap rather than a specific software bug.

Updated Aug 24, 2026

The CKAN MCP Server's earlier SSRF fix only blocked the literal hostname 'localhost' and dotted IPv4/bracketed IPv6 loopback literals, but missed alternate hostname aliases like 'ip6-localhost' and 'ip6-loopback' that resolve to loopback addresses. A remote caller invoking CKAN tools (e.g. ckan_package_search, sparql_query) with a crafted server_url/base_url parameter could bypass the filter and force the server to make requests to internal or loopback network locations. This is a moderate-severity SSRF bypass affecting a specific tool integration, not a novel or high-impact agentic exploitation technique.

Updated Aug 22, 2026 · CVSS 5.7

Omnigent, an open-source AI agent orchestration framework, fails to validate the os_env.cwd field in uploaded agent bundles, allowing an authenticated user to supply an absolute or traversal path. When the runner has no configured workspace root, this attacker-controlled path becomes the trusted root for file and shell tools, letting an agent read, write, or execute outside its intended sandbox and potentially exfiltrate host secrets.

Updated Aug 22, 2026 · CVSS 8.8

Omnigent, an open-source AI agent orchestration framework, contains a shell-command parser that fails to recognize certain command syntax (combined flags, timing wrappers, command substitution, background operators). This causes the framework's git/gh write allowlist and workspace confinement policies to silently abstain rather than block, letting an agent push to unauthorized repositories or branches or escape its intended working directory. A prompt-injected or otherwise manipulated coding agent could exploit this gap to perform unauthorized writes outside its granted scope.

Updated Aug 22, 2026 · CVSS 7.1

Omnigent, an open-source AI agent orchestration framework, fails to validate the dotted Python path an authenticated user supplies for a tool callable when uploading an agent bundle. This allows a low-privilege authenticated user to point a tool at dangerous built-ins like subprocess.check_output, achieving arbitrary command execution with the runner's permissions. The result is full compromise of the runner process, including credentials, environment variables, workspace data, and internal service access.

Updated Aug 22, 2026 · CVSS 8.8

A flaw in the Omnigent AI agent framework allows a user with only edit access to their own session to tamper with a shared or template agent that isn't properly bound to that session, injecting a malicious stdio MCP server configuration. When other sessions later reuse the poisoned shared agent, attacker-controlled commands execute with the full permissions of the Omnigent runner process, exposing files, credentials, and internal services. This is a critical broken-authorization vulnerability with a CVSS score of 9.0, fixed in version 0.3.0.

Updated Aug 22, 2026 · CVSS 9

LangChain's SitemapLoader fails to apply its restrict_to_same_domain protection to nested sitemap references, only filtering leaf URLs. An attacker who can influence an ingested sitemap can point a nested <sitemap> element at internal or loopback addresses, causing the agent's backend to fetch and return that internal content to the caller. This is a server-side request forgery that defeats a documented security control and can leak internal network data.

Updated Aug 21, 2026 · CVSS 8.6

LangBot, an LLM-based IM bot platform, allows any authenticated user to configure a STDIO MCP server, which the backend uses to launch an arbitrary subprocess with server-level privileges. This means a low-privileged account holder can achieve full remote code execution on the LangBot host, leading to data disclosure, tampering, and service disruption. No fix is currently available, making this a high-priority, actively exploitable weakness.

Updated Aug 20, 2026 · CVSS 8.8

Neo.mjs's file-system MCP server contains a command injection flaw where two exposed tools build shell commands from unsanitized file paths. An AI agent that is tricked or manipulated into calling these tools with a malicious path can trigger arbitrary OS command execution on the host running the MCP server. This is a serious vulnerability because it turns a routine agent tool call into full system compromise.

Updated Aug 20, 2026

This is a defensive research paper, not an active threat, describing a post-training method to reduce 'excess-authority' errors where tool-using LLM agents perform actions beyond what a task requires. The work proposes an auditing and reward framework to teach models task-conditioned least privilege in terminal and MCP environments, reporting significant reduction in excess-authority events. There is no vulnerability disclosure, exploit, or attack technique here; severity is low as it documents mitigation research rather than a genuine threat.

Updated Aug 20, 2026

A vulnerability in the Splunk MCP Server app (versions below 1.2.1) allows a user with the admin Splunk role to execute arbitrary operating system commands. The flaw stems from unsafe deserialization of stored credential data without type validation. This gives an already-privileged user a path to full host compromise via the MCP integration layer.

Updated Aug 20, 2026 · CVSS 9.1

A critical vulnerability in the marimo notebook application allows an attacker to achieve arbitrary command execution simply by getting a victim to open a malicious notebook file in edit mode. The malicious payload is hidden inside an MCP server configuration entry and is launched as a subprocess automatically, with no authentication and no need to run any notebook cell.

Updated Aug 20, 2026 · CVSS 8.8

Agno's PythonTools contains a path traversal flaw that lets an attacker escape the intended sandboxed base_dir by supplying '../' sequences in file arguments to read_file, save_to_file, or run_python_file. This can be triggered either through direct tool calls or by embedding traversal payloads in content the agent processes (prompt injection), resulting in arbitrary file read, write, or code execution at the privilege level of the agent process. Given the high CVSS score and ease of exploitation, this is a critical, actively exploitable vulnerability rather than a theoretical concern.

Updated Aug 20, 2026 · CVSS 8.8

This is an academic defensive framework, not an active threat or exploit. PACE proposes a way to cryptographically bind LLM-approved DeFi transaction intents to what actually executes on-chain, mitigating prompt-injection and plan-tampering risks in autonomous trading agents. It reduces risk rather than introducing it; severity is set to low because the raw data describes a mitigation, not a vulnerability being exploited in the wild.

Updated Aug 19, 2026

This is an academic survey (not an active exploit) analyzing how existing agent-security weaknesses become far more dangerous when AI agents use MCP tools and skills to sign and execute transactions on public blockchains. The authors argue that irreversibility, private-key signing authority, autonomous operation, and multi-step transaction composition turn normally recoverable agent failures into permanent financial loss, and find current defenses stop fewer than 30% of attacks. Since this is a research synthesis rather than a disclosed vulnerability or in-the-wild attack, severity is rated medium/informational for defenders rather than critical.

Updated Aug 19, 2026

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

Updated Aug 19, 2026 · CVSS 8.1

ArcadeDB's MCP server tool set_server_setting only checks a global allowAdmin flag rather than the calling user's actual role, allowing any authenticated read-only user to modify server-wide configuration when allowAdmin is enabled. This lets a low-privileged user tamper with GlobalConfiguration or trigger denial of service. The fix in 26.8.1 adds proper per-caller role enforcement.

Updated Aug 18, 2026 · CVSS 6.3