AI Agent Threats

This is an academic systematization-of-knowledge (SoK) paper analyzing 197 prior works on multi-agent LLM system security, not a novel exploit or active threat. It proposes an organizing framework (A-I-R: adversary position, interaction interface, resulting risk) to unify understanding of how attacks propagate across agent boundaries in MAS. Severity is low because this is a research taxonomy/survey with no new attack disclosed, no PoC, and no affected product identified.

Updated Sep 2, 2026

This is an academic research paper describing a new defensive guardrail model (HiveTraceGuard-Pro) designed to detect prompt injection and jailbreak attempts, particularly in Russian text. It is not a threat, exploit, or vulnerability disclosure; it describes a mitigation tool along with its benchmark performance and methodological limitations.

Updated Sep 2, 2026

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, a popular open-source framework for building AI agent workflows. Successful exploitation allows attackers to execute arbitrary code on exposed Langflow instances and harvest sensitive credentials such as OpenAI and AWS keys stored in the environment. This poses a critical supply-chain risk to organizations running AI application pipelines built on this framework.

Updated Sep 2, 2026

This is an academic research paper describing a hybrid AI architecture that combines a multimodal LLM with deterministic computer-vision tools via MCP to solve darknet-style CAPTCHAs with high accuracy. It is not an active exploit or an attack on AI agents/infrastructure itself, but a dual-use capability that could be repurposed to automate access to illicit darknet marketplaces or services. There is no vulnerability in an agent framework, protocol, or inter-agent trust boundary being described here.

Updated Sep 1, 2026

This is a defensive research paper, not an active exploit or newly disclosed vulnerability. It describes SkillGuard, a harness-level enforcement mechanism that restricts an LLM agent's future capabilities once untrusted data from a tool/skill enters its context, mitigating indirect prompt injection attacks. Because it presents a mitigation and is evaluated against known benchmark attacks (AgentDojo), it does not represent a new threat to flag as high risk; severity is low from a threat-intelligence perspective, though the underlying attack class it defends against remains relevant.

Updated Sep 1, 2026

This is a defensive research paper, not an active exploit or vulnerability disclosure. It proposes a system where AI agents exchange zero-knowledge proofs of policy compliance instead of raw data or unverifiable natural-language claims, reducing the prompt-injection-relevant attack surface of 'trust me, I complied' agent-to-agent communication. The authors themselves identify a residual limitation (proofs not bound to the system of record) and propose an enclave-attestation extension to address it.

Updated Sep 1, 2026

This is a research paper describing SIR, a red-teaming methodology that automatically discovers and refines indirect prompt injection attacks against computer-use agents (CUAs) like Claude Opus and Gemini. It demonstrates that adaptive, self-improving attack composition significantly increases attack success rates over static hand-written injections, revealing that current CUA safety benchmarks likely underestimate real-world risk. No active exploit or in-the-wild campaign is described; this is disclosed academic security research intended to improve defenses.

Updated Sep 1, 2026

This is an academic research paper proposing a defensive attestation scheme to help verify which deployer produced given output bytes and whether cross-agent delegation edges were properly authorized in multi-agent AI systems. It is not describing an active exploit or vulnerability being exploited in the wild; rather it presents cryptographic designs (signed linked list, Merkle-chain, co-signed DAG) to detect unauthorized delegation claims, including after child-key compromise. The severity is low because the content is a proposed mitigation/verification framework, not a threat report.

Updated Sep 1, 2026

Researchers propose ECLIPSE, a framework that combines direct and indirect prompt injection to hijack long-horizon LLM agents (e.g., Codex, Claude Code) into executing multi-step malicious tool chains while evading detection. This is academic red-teaming research with a benchmark (LASE-Bench), not an observed in-the-wild exploit, but it demonstrates high attack success rates (up to 96.7%, 69.2% under defenses) against realistic multi-tool agent workflows.

Updated Sep 1, 2026

The sdcb 'chats' application (up to v1.12.0) contains a server-side request forgery (SSRF) vulnerability in its MCP-related fetch-tools endpoint, allowing a remote attacker to make the server issue arbitrary HTTP requests. A public exploit exists and the vendor has not responded to disclosure, so this remains unpatched. Severity is moderate given the network-based attack vector but no confirmed data exfiltration or code execution in the description.

Updated Sep 1, 2026 · CVSS 6.3

This item is a weekly news roundup from The Hacker News that briefly mentions various unrelated stories, including a passing reference to 'an AI agent deciding its assigned task was optional.' It contains no technical details, indicators, or reproducible information about any specific agentic AI vulnerability or attack. As presented, this is not an actionable security threat but rather a link aggregator teaser.

Updated Sep 1, 2026

This is a benign blog post from Simon Willison covering the announcement of 'wrapture', a Python monkeypatching/tracing library built by Graham Dumpleton. There is no security vulnerability, exploit, or attack technique described here; it is simply a developer tooling announcement that happens to mention the library was written with AI assistance.

Updated Sep 1, 2026

MCPHub, a multi-tenant hub for orchestrating MCP servers, failed to enforce ownership checks on its tool-execution API even though it correctly scoped list and config views. Any authenticated non-admin user could invoke tools on MCP servers owned by other tenants, leading to cross-tenant compromise including arbitrary host file reads and SSRF using another user's connected credentials. The issue is fixed in version 1.0.30.

Updated Sep 1, 2026 · CVSS 7.7

MCPHub, a centralized management hub for MCP servers, has an incomplete SSRF guard that fails to block IPv6 transition addresses like NAT64, 6to4, and Teredo. An attacker who can supply a URL for an MCP server connection can embed a private IPv4 address inside one of these IPv6 formats to bypass the filter and reach internal infrastructure. This is a classic SSRF filter evasion issue, patched in version 1.0.32.

Updated Sep 1, 2026

MCPHub, a management hub for MCP servers, fails to restrict server configuration endpoints to admin users and does not sanitize the command/args used to spawn MCP server processes. Any authenticated non-admin user can register a malicious MCP server configuration that MCPHub immediately executes, resulting in full remote code execution as the host's OS user, often root. This is a critical, easily exploitable authorization flaw with a severe real-world impact.

Updated Sep 1, 2026 · CVSS 9.9

MCPHub, a management hub for MCP servers, allows any authenticated non-admin user to register a malicious MCP server pointing at arbitrary internal or external URLs, causing the hub to make server-side requests without egress filtering. This enables both reflected SSRF (attacker sees response data via the OpenAPI proxy) and blind SSRF (via SSE/streamable-http transport), potentially exposing internal services, cloud metadata endpoints, and loopback/RFC1918 resources.

Updated Sep 1, 2026 · CVSS 7.1

MCPHub, a management hub for multiple MCP servers, contains a flawed authorization check that lets a bearer key scoped to one specific MCP server gain access to every other server in the same group. Any credential holder with narrow, single-server authorization can silently pivot to unauthorized MCP servers, effectively breaking the tool/server isolation model the hub is meant to enforce. This was fixed in version 1.0.31.

Updated Sep 1, 2026 · CVSS 8.1

MCPHub, a centralized hub for orchestrating multiple MCP servers, contained a broken access control flaw where any authenticated user could modify system-wide configuration via the PUT /api/system-config endpoint, since the handler never checked admin privileges. This allows a low-privileged user to reconfigure routing to MCP servers, potentially redirecting agent traffic, disabling security controls, or hijacking tool orchestration across the hub. The issue is fixed in version 1.0.29.

Updated Sep 1, 2026 · CVSS 8.8

MCPHub, a hub for managing multiple MCP servers, fails to sanitize the manifest.json 'name' field when extracting uploaded MCPB (zip) files, allowing an attacker to use path traversal sequences to write files outside the intended extraction directory. The same unsanitized field is also used during cleanup, enabling arbitrary directory deletion. This lets a malicious MCP server package achieve file system compromise on the host running MCPHub, potentially leading to code execution or destructive data loss.

Updated Sep 1, 2026

MCPHub prior to version 1.0.32 fails to enforce admin-only access on prompt and resource management endpoints, allowing any authenticated non-admin user to create, overwrite, or shadow globally-served prompt templates and resources. Because these tampered records are consulted before any connected MCP server for every session, the flaw enables stored prompt injection into other users' LLM sessions. The issue is patched in 1.0.32.

Updated Sep 1, 2026 · CVSS 7.1