Showing 301–320 of 563 threats, newest first
This item is a routine blog post from Simon Willison about OpenAI's GPT-5.6 model family price reductions and use of the model to optimize its own inference kernels. There is no security vulnerability, attack, or agent threat described in this content.
Updated Jul 31, 2026
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability allowing a remote, likely unauthenticated attacker to inject and execute arbitrary code due to improper handling of user-supplied input. Given the near-maximum CVSS score of 9.9, this represents a severe risk to any environment running affected Langflow instances, potentially exposing the underlying host, connected agent pipelines, and any credentials or tools accessible to the Langflow server.
Updated Jul 31, 2026 · CVSS 9.9
IBM Langflow OSS fails to enforce per-user isolation of Chroma vector store collections, allowing any authenticated attacker to guess or reuse another user's persist_directory and collection_name to read their private documents. The same flaw lets an attacker write poisoned documents into the victim's namespace, corrupting the data that victim's RAG workflows retrieve on. This is a straightforward multi-tenancy authorization failure rather than a novel agentic exploit, but it directly compromises confidentiality and integrity of agent memory.
Updated Jul 31, 2026 · CVSS 8.1
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation flaw in the PythonREPL sandbox tool, allowing an attacker to escape the intended execution boundary. Given the CVSS score of 9.9, this likely enables arbitrary code execution on the host running the Langflow agent, posing a critical risk to any deployment exposing this component. Organizations running affected versions should treat this as an urgent patching priority.
Updated Jul 31, 2026 · CVSS 9.9
IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.
Updated Jul 31, 2026 · CVSS 7.5
IBM Langflow, an open-source framework used to build AI agent/LLM workflows, contains two broken access control flaws in its file handling API. One endpoint allows completely unauthenticated retrieval of image files tied to any flow, while another allows authenticated users to access other users' files via an IDOR, breaking tenant isolation in multi-user deployments. This can expose sensitive data stored within private agent flows.
Updated Jul 31, 2026 · CVSS 6.5
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.
Updated Jul 30, 2026 · CVSS 7.1
Langflow's MCP stdio launcher fails to block dangerous shell environment variables (SHELLOPTS, BASHOPTS, PS4), allowing unauthenticated remote attackers to achieve arbitrary code execution. This is a critical, easily exploitable flaw in a widely used agent orchestration framework's tool-invocation layer.
Updated Jul 30, 2026 · CVSS 9.8
This is a research paper describing a defensive self-play system used internally to discover and patch prompt injection weaknesses in frontier LLMs, not an active exploit or vulnerability disclosure. The described system is intended to improve model robustness rather than attack live production agents, so it does not represent a genuine threat in itself.
Updated Jul 30, 2026
Pydantic AI's UI adapters (AG-UI and Vercel AI) had a message-sanitization bug where a stale index calculation allowed a crafted client message history to reintroduce an unresolved, client-controlled tool call as if it were the model's own output. This let a remote client trigger execution of registered server tools with attacker-chosen arguments, bypassing model-request guardrail hooks, though approval-gated tools were not affected. The vendor has patched this in 1.107.1 and 2.5.0.
Updated Jul 30, 2026 · CVSS 6.5
A maximum-severity vulnerability (CVSS 10.0) in Ruflo, an open-source meta-harness used to orchestrate Claude Code and OpenAI Codex agents via MCP, allows unauthenticated attackers to remotely execute arbitrary commands and poison the agent's persistent memory. This flaw, dubbed RufRoot, affects all versions prior to 3.16.3 and poses severe risk to any deployment exposing the Ruflo MCP interface without proper authentication controls.
Updated Jul 30, 2026 · CVSS 10
This is a benign 'Today I Learned' post by Simon Willison describing how to connect a custom MCP server to Claude and ChatGPT chat interfaces. It contains no vulnerability disclosure, exploit, or threat details, and simply documents a configuration process.
Updated Jul 30, 2026
Pydantic AI's UI adapters (e.g., the Vercel AI adapter) accept client-submitted message history containing 'UploadedFile' references, such as S3/GCS URIs or provider file IDs, without validating that the requesting client should have access to them. Because the server resolves these references using its own privileged credentials (IAM role, service account, or API key), an attacker who can guess or obtain a valid file identifier can trick the server into reading files it should not have access to on the attacker's behalf, including data belonging to other tenants. This is a classic confused-deputy vulnerability affecting a widely used Python agent framework, fixed in versions 1.106.0 and 2.0.0b6.
Updated Jul 30, 2026 · CVSS 6.8
Pydantic AI's protection against SSRF to cloud metadata endpoints can be bypassed when an application allows local/private URL downloads, because the IP blocklist fails to recognize IPv6-encoded forms (IPv4-mapped, 6to4, NAT64) of metadata service addresses. On dual-stack or NAT64-translated networks, this lets an attacker-controlled URL reach the cloud metadata service and potentially steal short-lived IAM credentials. This only affects apps that explicitly opt into 'force_download=allow-local' on URLs influenced by untrusted input; the issue has been patched in version 1.99.0.
Updated Jul 30, 2026 · CVSS 6.8
Flyto2 Core, an execution kernel for AI-agent workflows, contains a widespread SSRF vulnerability where numerous HTTP-emitting modules (HTTP requests, GraphQL, notifications, monitoring, vision analysis, browser proxying, and LLM/agent base_url handling) fail to validate caller-supplied URLs. This allows an attacker who can influence tool input or agent-generated parameters to force the agent to make requests to internal services or cloud metadata endpoints, potentially leaking credentials or pivoting into internal networks. The issue is fixed in version 2.26.7.
Updated Jul 30, 2026 · CVSS 8.5
The official MCP Ruby SDK contained a flaw where its HTTP transport read entire JSON-RPC request bodies into memory without any size limit. An unauthenticated remote attacker could send oversized POST requests to exhaust server memory and crash the MCP server, disrupting all agents relying on it. This is fixed in version 0.23.0.
Updated Jul 30, 2026 · CVSS 7.5
The MCP Ruby SDK's StreamableHTTP transport failed to bind session IDs to the client/owner that created them, so anyone who obtains a valid session ID (via theft, leakage in logs/URLs, or interception) could issue tools/call requests that execute with the victim's authenticated session context. This allows an attacker to impersonate a legitimate user or agent and trigger tool actions on their behalf without needing credentials.
Updated Jul 30, 2026
The official MCP Ruby SDK fails to expire sessions in its StreamableHTTPTransport, allowing an attacker to repeatedly send initialize requests and accumulate ServerSession objects indefinitely. This can exhaust server memory and cause a denial of service against any MCP server built on this SDK. The issue is fixed in version 0.23.0.
Updated Jul 30, 2026 · CVSS 5.3
The official MCP Ruby SDK (versions prior to 0.23.0) contains a denial-of-service vulnerability where its stdio transport reads input without a byte limit. A malicious peer (client or server) connected over stdio can send data without a newline terminator to exhaust the host process's memory, crashing or degrading the MCP server or client. This is a straightforward availability issue, not a code-execution or data-exfiltration flaw, and is fixed in 0.23.0.
Updated Jul 30, 2026 · CVSS 6.2
The MCP Ruby SDK's HTTP transport failed to validate Host or Origin headers before version 0.23.0, allowing a malicious website to use DNS rebinding to reach a locally running MCP server from a victim's browser. This lets an attacker invoke tools exposed by the local MCP server without authorization, effectively bypassing the same-origin trust boundary that localhost services normally rely on.
Updated Jul 30, 2026