AI Agent Threats

Flowise's CSV Agent node feeds untrusted user input directly into an LLM prompt used to generate Python code, then executes the LLM's response in an unsandboxed pyodide environment after only a weak regex blocklist check. An attacker can use prompt injection to make the LLM emit obfuscated malicious code that bypasses the blocklist and achieves arbitrary code execution on the host, with no authentication required.

Updated Aug 5, 2026

Flowise's OAuth2 credential refresh endpoint is exempt from authentication, allowing anyone who knows or guesses a credential ID to force the server to refresh and return a live OAuth access token for that connected third-party account. This lets attackers hijack victims' Google, Microsoft, GitHub, or other integrated service access without any login, and can also be abused to exhaust refresh token quotas as a denial-of-service.

Updated Aug 5, 2026

This is a large-scale academic security assessment (not an active exploit report) finding that thousands of publicly reachable Model Context Protocol (MCP) servers are deployed with weak or absent security controls. Researchers found high rates of missing authentication, exposed shell execution tools, SSRF against cloud metadata endpoints, SQL injection, and prompt template injection across hundreds of confirmed production servers. The findings represent systemic ecosystem-wide risk rather than a single vulnerability in one product.

Updated Aug 4, 2026

Flowise's DELETE endpoint for chatflows fails to verify that the resource being deleted actually matches the caller's granted permission scope, letting a user or API key with only 'agentflows:delete' permission delete Chatflows (and vice versa). This breaks the intended separation between agent workflow management roles and can result in unauthorized destruction of AI agent configurations within a workspace.

Updated Aug 4, 2026

Flowise's MCP security check uses a flag-blocklist and a four-item environment-variable blocklist to prevent malicious npx/node/python invocations, but npm's env-based configuration (e.g. npm_config_yes) reproduces blocked flag behavior and slips past the filter entirely. Because default Flowise deployments have no authentication, any unauthenticated attacker who can reach the Flowise API can supply an MCP server config that auto-installs and executes an arbitrary package, achieving remote code execution with the privileges of the Flowise process. This is a bypass of the prior fix for CVE-2025-8943, not a new class of bug.

Updated Aug 4, 2026

Flowise's CSV Agent and Airtable Agent allow LLM-generated Python code to run inside a Pyodide sandbox, gated by a regex blacklist meant to block dangerous constructs like __class__ or __import__. Because JavaScript's regex word boundaries are ASCII-only while Python 3 normalizes Unicode homoglyph identifiers (e.g., mathematical bold letters) to their ASCII equivalents, attackers can craft identifiers that bypass the filter but execute as the forbidden built-ins in Python, leading to full arbitrary code execution on the host running Flowise.

Updated Aug 4, 2026

Flowise, a low-code AI agent/workflow builder, fails to enforce its 'variables:view' permission when populating the $vars object inside the custom JavaScript function execution sandbox. A user or API key that is explicitly denied access to workspace variables can still call the node-custom-function endpoint and read all workspace variables, including runtime secrets pulled from server environment variables, effectively bypassing the platform's RBAC controls.

Updated Aug 4, 2026

Flowise's S3 Directory (and related S3File) document loader fails to sanitize S3 object keys before writing them to a local temp directory, allowing an authenticated user with document-store preview permissions to write attacker-controlled files anywhere on the host filesystem via path traversal sequences like '../'. Because cleanup only removes the original temp directory, malicious files persist, giving an attacker a path to arbitrary file write and potentially remote code execution on the Flowise server. This is a classic tool-layer vulnerability in an agentic/RAG framework rather than a model-level prompt injection issue.

Updated Aug 4, 2026

Flowise's CSVAgent node builds a Python script by unsafely interpolating an attacker-controlled base64 segment from a CSV file's data URI, allowing an attacker to break out of the Python string literal. Because Pyodide is configured with default Node.js bridging (exposing eval and dynamic import), the injected code escapes the WASM sandbox entirely and executes arbitrary file system and OS command operations on the host running Flowise. Any user who can create or modify a chatflow can plant this payload, and once the chatflow is exposed via the public prediction API, any unauthenticated request triggers full host compromise.

Updated Aug 4, 2026

Flowise's openai-assistants-vector-store endpoints accept a client-supplied credential ID without verifying it belongs to the caller's workspace, allowing any authenticated user to use another workspace's OpenAI API key. This is a classic multi-tenant IDOR that lets attackers hijack billing, read/modify/delete victim vector stores, and access victim OpenAI account resources.

Updated Aug 4, 2026

Flowise's GET /api/v1/upsert-history endpoint fails to scope results to the requesting user or workspace, instead returning the entire server-wide upsert history, including vector store credentials/configuration like Qdrant server URLs and collection names. Any authenticated (and possibly under-authorized) user can harvest infrastructure details belonging to other tenants, enabling follow-on targeted attacks against those backends.

Updated Aug 4, 2026

Flowise, a popular low-code LLM/agent orchestration platform, returns decrypted credential secrets in plaintext via its credentials API because its redaction logic only masks fields explicitly typed as 'password', missing string-typed fields that commonly hold database URLs, private keys, and API keys. Any authenticated user with 'credentials:view' permission can retrieve full secrets for connection strings, cloud service accounts, and other integrations configured in the workspace, enabling lateral movement into downstream systems the agent platform connects to.

Updated Aug 4, 2026 · CVSS 6.5

Flowise's OAuth2 credential endpoints (authorize, callback, refresh) look up credentials by ID alone without checking workspace ownership, and two of these endpoints are fully unauthenticated. This lets any authenticated user access other workspaces' OAuth2 client metadata, and lets any unauthenticated attacker forge callbacks to inject tokens into or refresh tokens for arbitrary credentials. Since these credentials are used by Flowise's AI agents to authenticate to third-party tools and APIs, the flaw effectively lets attackers hijack the external identities and permissions of agents belonging to other tenants.

Updated Aug 4, 2026

This is a blog quote about Steve Yegge's experience with a self-referential coding agent project ('Gas Town') that stopped converging when using Opus 4.7, exhibiting a 'just two more things' compulsive-tinkering behavior. This is a commentary on model reliability and agent usability, not a security vulnerability, exploit, or attack. No genuine security issue is described.

Updated Aug 4, 2026

This is an academic research paper (not an active exploit) that systematically demonstrates how prompt injection—both direct (task instructions) and indirect (via perception modules)—can manipulate LLM-based multi-agent robotic systems into unsafe or adversarial actions. The study's key contribution is showing that injected instructions can propagate from one compromised agent to others through shared prompt structures, expanding the blast radius beyond the initially targeted agent. Because it is a controlled research evaluation rather than an in-the-wild attack, real-world severity depends heavily on deployment specifics, but the findings are directly actionable for adversaries and defenders alike.

Updated Aug 4, 2026

This is an academic measurement study of the official MCP registry, not an active exploit or vulnerability disclosure. The researchers show that periodic, drift-ranked re-auditing of server descriptions poorly covers actual description changes over time, and recommend content-hash-based revalidation instead. No attack technique, malicious payload, or exploited weakness is described.

Updated Aug 4, 2026

Researchers demonstrate that malicious instructions can be covertly embedded in ambient audio to hijack voice-driven multimodal LLM agents while a legitimate user is speaking, achieving up to 69% attack success against Gemini 3 Pro and other frontier models. This is a peer-reviewed research disclosure (with a proposed defense), not evidence of in-the-wild exploitation, but it establishes a credible, high-impact attack surface for any product accepting continuous ambient audio input.

Updated Aug 4, 2026

Ouroboros, a local-first runtime for AI coding agents, has an incomplete denylist that fails to block several execution-routing environment variables. A malicious cloned repository can ship an auto-loaded .env file that redirects agent execution, MCP server roots, plugin roots, and sub-agent prompts to attacker-controlled locations, achieving arbitrary command execution without any user review step. This is fixed in version 0.42.1.

Updated Aug 4, 2026

Ouroboros, a local-first runtime for AI coding agents, blindly trusts a .env file found in the current working directory to configure execution-critical CLI backend paths. A malicious repository can set a variable like OUROBOROS_CLI_PATH to point at an attacker-controlled script, which then executes automatically when the victim runs basic Ouroboros commands. This is a classic untrusted-repository-triggers-code-execution supply chain flaw, fixed in version 0.39.0.

Updated Aug 4, 2026

A vulnerability in the shell tool of Amazon Strands Agents Tools (before v0.8.0) allows an attacker to craft a prompt that sets the 'non_interactive' parameter to true, bypassing the human consent gate designed to approve shell command execution. This enables remote actors to execute arbitrary OS commands on the agent's host without user approval, effectively turning a safety control into a no-op. This is a high-severity issue given the direct path from prompt injection to remote code execution.

Updated Aug 4, 2026 · CVSS 8.8