Memory and Context Poisoning

The MCP Python SDK's SSE and stateful Streamable HTTP transports route messages to sessions based solely on a session ID, without checking that the requesting client is the same authenticated principal who created that session. Any bearer-token-authenticated client that learns or guesses a valid session ID can inject JSON-RPC messages into another user's active session, effectively hijacking it. This is a serious cross-tenant authorization flaw fixed in version 1.27.2.

Updated Jul 16, 2026 · CVSS 7.1

PraisonAI versions before 4.6.78 default to running the MCP HTTP-stream server without any API key or authentication, meaning anyone who can reach the endpoint can list and invoke all exposed tools. The server also fails to validate tool-call arguments against the advertised schema, compounding the risk of malformed or malicious inputs reaching tool handlers. Exploitation requires the operator to have bound the server to a network-accessible address rather than the safe localhost default.

Updated Jul 15, 2026 · CVSS 7.3

Researchers found that six popular AI coding assistants can be tricked by a malicious repository containing symlinks: the agent asks the user to approve an edit to what looks like a harmless file, but the actual write lands on a sensitive system file instead. This allows an attacker who convinces a developer to open a booby-trapped project to gain code execution or persistence on the developer's machine, bypassing the intended human-approval safety check.

Updated Jul 9, 2026

This item is an OWASP Gen AI Security Project blog post discussing memory and context poisoning as a conceptual risk category (ASI06) for agentic AI systems, not a report of a specific active exploit or vulnerability. It explains why persistent agent memory can become an attack surface if untrusted input is carried forward and later trusted, but contains no technical exploit details, affected products, or indicators of compromise. Severity is set to low because this is educational/awareness content rather than a disclosed incident or vulnerability.

Updated Jul 5, 2026

This research describes a time-of-check-to-time-of-use (TOCTOU) attack against computer-use AI agents like ChatGPT Operator, where a malicious page or element changes between the moment the agent evaluates it and the moment it acts, causing the agent (and a supervising human) to click or execute something different from what was reviewed. The author reproduced a previously disclosed Google-reported vulnerability and demonstrated it live at a security conference. This is a legitimate and impactful vulnerability class for autonomous browser/UI-driving agents.

Updated Jul 5, 2026

Attackers seed false facts or standing instructions into an agent's long-term memory or RAG store, quietly steering decisions across future sessions long after the original malicious input is gone.

Updated Jul 3, 2026