Memory and Context Poisoning

This is an academic research paper proposing a defensive attestation scheme to help verify which deployer produced given output bytes and whether cross-agent delegation edges were properly authorized in multi-agent AI systems. It is not describing an active exploit or vulnerability being exploited in the wild; rather it presents cryptographic designs (signed linked list, Merkle-chain, co-signed DAG) to detect unauthorized delegation claims, including after child-key compromise. The severity is low because the content is a proposed mitigation/verification framework, not a threat report.

Updated Sep 1, 2026

MCPHub, a centralized hub for orchestrating multiple MCP servers, contained a broken access control flaw where any authenticated user could modify system-wide configuration via the PUT /api/system-config endpoint, since the handler never checked admin privileges. This allows a low-privileged user to reconfigure routing to MCP servers, potentially redirecting agent traffic, disabling security controls, or hijacking tool orchestration across the hub. The issue is fixed in version 1.0.29.

Updated Sep 1, 2026 · CVSS 8.8

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authorization flaw that lets any authenticated user execute or read another user's private flows. This is a classic access-control bug in an agent-orchestration framework rather than a novel agentic attack technique, but it can expose proprietary prompts, credentials embedded in flows, and business logic, or allow unauthorized execution of another tenant's automation.

Updated Aug 29, 2026 · CVSS 6.4

ServiceNow patched a code injection vulnerability in its AI platform that could have let an unauthenticated attacker run arbitrary code and access or modify instance data beyond intended scope. The vendor has already shipped fixes and states no known active exploitation, but the flaw's unauthenticated nature and broad impact on instance data make it significant. This is a legitimate, remediated vulnerability rather than an emerging in-the-wild campaign.

Updated Aug 27, 2026

This is a defensive research paper, not an active exploit. It quantifies how LLM agents habitually over-share privacy-sensitive data in tool call arguments (81-88% of calls) and proposes ToolMinimize, a middleware that rewrites arguments to the minimum necessary data. The finding highlights a systemic data-hygiene weakness in agent-to-tool interactions rather than describing a novel attack technique.

Updated Aug 27, 2026

PraisonAI's local MCP HTTP Stream server uses a flawed startswith() check to validate the HTTP Origin header, allowing an attacker-controlled domain like 'localhost.evil.example' to pass as if it were 'localhost'. A malicious webpage visited by a victim can exploit this to send unauthenticated tools/call requests directly to the victim's local MCP server, invoking any exposed tool without an API key.

Updated Aug 25, 2026 · CVSS 6.9

Infracost, a cost-analysis tool used alongside AI coding agents and CI/CD pipelines, could be tricked into sending a configured Terraform Cloud or registry token to an attacker-controlled host. This happens because the tool derives the destination hostname from untrusted Terraform input (e.g., in a pull request) rather than validating it against the trusted host configuration. The issue is fixed in version 0.10.45.

Updated Aug 22, 2026

Infracost's template functions used by AI coding agents and CI/CD pipelines fail to properly resolve intermediate directory symlinks, allowing a malicious repository to trick the tool into reading arbitrary files accessible to the CI runner, including secrets. The leaked content can then be surfaced in the Infracost dashboard or pull request comments, creating a data exfiltration path. This is a classic path traversal/symlink vulnerability in a tool commonly invoked by AI agents and CI automation, fixed in version 0.10.45.

Updated Aug 22, 2026

The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.

Updated Aug 13, 2026 · CVSS 4.3

Flowise's OpenAI Assistants integration fails to verify workspace ownership when looking up credentials by UUID, letting any authenticated user access credentials, assistant metadata, and file/vector store data belonging to other workspaces. Attackers can also upload files into victim workspaces, enabling both data theft and data poisoning across tenant boundaries. This is a critical multi-tenant isolation failure in an agent orchestration platform.

Updated Aug 7, 2026 · CVSS 9.9

Flowise, an AI agent/workflow orchestration platform, has a PUT endpoint for updating workflow execution records that lacks the authorization middleware present on its sibling GET and DELETE endpoints. Any authenticated user with a valid API key, even one with minimal permissions, can modify the state and data of any execution belonging to their workspace, enabling manipulation of agent workflow results and metadata.

Updated Aug 5, 2026 · CVSS 7.5

Flowise's GET /api/v1/upsert-history endpoint fails to scope results to the requesting user or workspace, instead returning the entire server-wide upsert history, including vector store credentials/configuration like Qdrant server URLs and collection names. Any authenticated (and possibly under-authorized) user can harvest infrastructure details belonging to other tenants, enabling follow-on targeted attacks against those backends.

Updated Aug 4, 2026

Google's mcp-toolbox contains an SSRF vulnerability in its generic HTTP tool/source component: the underlying HTTP client follows redirects without validating destination IPs or hosts, allowing crafted path parameters to redirect requests to internal or arbitrary external endpoints. This is especially dangerous in MCP deployments because a malicious or data-driven prompt could supply the crafting input, letting an LLM-invoked tool call pivot into internal network reconnaissance or cloud metadata access.

Updated Jul 31, 2026

The MCP Ruby SDK's StreamableHTTP transport failed to bind session IDs to the client/owner that created them, so anyone who obtains a valid session ID (via theft, leakage in logs/URLs, or interception) could issue tools/call requests that execute with the victim's authenticated session context. This allows an attacker to impersonate a legitimate user or agent and trigger tool actions on their behalf without needing credentials.

Updated Jul 30, 2026

The alibabacloud-rds-openapi-mcp-server binds its MCP endpoint to all network interfaces by default, allowing any network-adjacent attacker to reach and invoke its exposed tools without proper access restriction. This is a configuration/deployment flaw rather than a novel exploit technique, but it can let unauthorized parties trigger RDS-related MCP tools if the server is reachable. Severity is moderate given the CVSS score of 5.8 and the dependency on network exposure and lack of authentication for actual exploitation.

Updated Jul 28, 2026 · CVSS 5.8

A vulnerability in NanoClaw's MCP Server Approval component allows a local attacker to bypass authorization checks in the createChatSdkBridge.setup function, potentially approving or manipulating MCP server connections without proper consent. The flaw requires local access and has a public exploit available, but the vendor has not yet responded to the disclosure. Severity is moderate due to the local attack vector constraint, though the improper authorization could undermine trust in MCP server approval workflows.

Updated Jul 26, 2026 · CVSS 5.3

Researchers found a sandbox escape flaw in Anthropic's Claude Cowork that allows the AI agent (or something controlling it) to break out of its intended Linux VM isolation and read/write arbitrary files on the host Mac. This undermines the core security guarantee that the agent's actions are confined to the sandbox, exposing roughly 500,000 macOS users to potential host-level file access. This is a genuine isolation/architecture vulnerability rather than a prompt-injection-specific issue.

Updated Jul 24, 2026

nono, a sandboxing framework for running AI agents with reduced privileges, failed to block access to local Unix domain sockets prior to version 0.55.0. This allowed a sandboxed AI agent to reach the per-user systemd D-Bus socket and escape the intended isolation boundary, potentially gaining broader system access than intended. Users should upgrade to 0.55.0 immediately.

Updated Jul 21, 2026 · CVSS 6.1

This is an academic survey paper analyzing 21 proposals and 5 commercial AI agents for how they handle user-level permissions, not a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies rather than customizable per-user permissions, identifying this as a research gap rather than describing a specific attack.

Updated Jul 16, 2026

The MCP Python SDK's experimental task management feature failed to bind tasks to the session that created them, allowing any connected client to list, read, cancel, or consume messages for tasks belonging to other clients. This is a broken access control / IDOR-style flaw that breaks the trust boundary between concurrent MCP sessions on the same server. It is fixed in version 1.27.2.

Updated Jul 16, 2026 · CVSS 7.6