Human-Agent Trust Exploitation

This is a defensive research paper describing a system for tamper-evident logging and forensic auditing of AI agent actions, not an active exploit or vulnerability. It proposes hash-chained, Merkle-batched, on-chain-anchored audit trails to help detect and investigate incidents like cascading tool-use failures or prompt injection spread after the fact. Severity is low because the content describes a mitigation/monitoring tool rather than a threat vector.

Updated Sep 3, 2026

This is an academic research paper describing a defensive auditing technique, not an active threat or exploit. AgentProv helps detect when commercial LLM API providers silently swap, quantize, or wrap the advertised model, using tool-call patterns instead of unreliable text-output analysis. It is a beneficial transparency/integrity tool for consumers of agentic LLM APIs, not an attack vector.

Updated Sep 2, 2026

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, a popular open-source framework for building AI agent workflows. Successful exploitation allows attackers to execute arbitrary code on exposed Langflow instances and harvest sensitive credentials such as OpenAI and AWS keys stored in the environment. This poses a critical supply-chain risk to organizations running AI application pipelines built on this framework.

Updated Sep 2, 2026

The CKAN MCP Server, prior to version 0.4.112, leaks raw upstream response bodies and internal exception details (hostnames, internal IPs, DB errors, stack fragments) to callers when errors occur or when the server is redirected to a non-CKAN host. This is a low-severity information disclosure issue rather than a direct compromise vector, but it can aid reconnaissance for further attacks, especially if combined with SSRF-style redirection. The vendor has already released a fix.

Updated Aug 14, 2026 · CVSS 3.7

This is an arXiv research paper describing a defensive gateway architecture that solves an existing enterprise problem: inconsistent, fragmented authentication across internally built MCP servers. It documents a solution (centralized auth gateway with OAuth token exchange) rather than disclosing a new exploit or vulnerability. No active threat, PoC, or attack technique is presented; the underlying risk it addresses (weak/inconsistent MCP auth) is real but already well-known and is being mitigated here.

Updated Aug 12, 2026

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote attacker to execute arbitrary code by exploiting improper validation of configuration parameters. Since Langflow is used to build and orchestrate AI agent workflows, a compromise here could give an attacker control over the host running agent pipelines. Organizations running affected versions should patch immediately given the high severity and remote, unauthenticated attack potential implied by the CVSS score.

Updated Aug 5, 2026 · CVSS 7.2

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

Updated Jul 31, 2026 · CVSS 7.5

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

Updated Jul 22, 2026

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

Updated Jul 22, 2026

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

Updated Jul 18, 2026 · CVSS 5.4

The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.

Updated Jul 16, 2026 · CVSS 3.1

The dbt-mcp MCP server, prior to version 1.17.1, logged raw tool call arguments—including SQL queries, variables, and node selections—in plaintext to a local log file when file logging was enabled. This is a genuine but low-severity information disclosure issue requiring local file access or misconfigured log exposure to exploit, with a CVSS score of 2.5 and an official fix already released.

Updated Jul 16, 2026 · CVSS 2.5

This is an academic research paper, not an active exploit or attack. The authors built MCPZoo, a large dataset of runnable MCP servers, and found that existing MCP security scanners are unreliable: they flag ~97% of servers as risky, but fewer than half of sampled alerts are true positives, and different scanners disagree substantially with each other.

Updated Jul 14, 2026

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

Updated Jul 6, 2026

Researchers reported what they describe as the first documented ransomware campaign, dubbed JadePuffer, allegedly executed end-to-end by an autonomous LLM agent rather than human operators. The article provides limited technical detail, so key claims (full autonomy, novelty, actual impact) cannot be independently verified from the source alone.

Updated Jul 5, 2026