AI Agent Threats

This advisory is a withdrawn duplicate of GHSA-9r8p-h6cc-6qhm, describing an n8n bug where the full Google Service Account PEM private key was mistakenly written into the JWT header's 'kid' field instead of a key identifier. Since JWT headers are only Base64-encoded (not encrypted), anything that logs or inspects the token could recover the private key, allowing impersonation of the associated Google Cloud service account. Impact is limited to n8n instances configured with Google Service Account credentials, and the issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.

Updated Jul 22, 2026

A time-of-check-to-time-of-use (TOCTOU) flaw in n8n's Git node lets an authenticated user swap a validated directory for a symlink right before the clone operation executes, planting a malicious repository into the custom node directory. Because n8n loads custom nodes as executable JavaScript on restart, this results in full remote code execution on the server. Both self-hosted and cloud n8n instances are affected wherever the Git node is usable by workflow authors.

Updated Jul 22, 2026

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

Updated Jul 22, 2026

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

Updated Jul 22, 2026

n8n, a workflow automation platform commonly used to orchestrate AI agent and API integrations, incorrectly embedded the full PEM private key of a Google Service Account inside the 'kid' field of a JWT header instead of a key identifier. Because JWT headers are only Base64-encoded (not encrypted), any system that logged, proxied, or inspected these tokens could recover the private key and impersonate the service account against Google Cloud resources. This is a genuine credential-exposure vulnerability with a clear patch, not a novel agentic-AI attack technique, but it is highly relevant to agent pipelines that rely on n8n for tool/API orchestration.

Updated Jul 22, 2026

This is an academic paper (not an active exploit) that defines a threat model called the 'hijacked authorized agent problem' for LLM agents operating in HPC environments. It argues that agents inheriting a user's credentials to manage Slurm jobs, logs, and files can be redirected by adversarial instructions embedded in logs, tool descriptions, or peer-agent messages, even though every resulting action remains fully authenticated and permitted. The paper proposes a research agenda and a benchmark (TaskBound) rather than demonstrating a working attack.

Updated Jul 22, 2026

This is an academic research paper (arXiv, not an active exploit) demonstrating that decentralized collaborative prompt optimization systems like TCPO are vulnerable to malicious clients injecting instructions that survive server-side aggregation and persist through subsequent benign optimization rounds. The authors also propose a partial defense (APAgg) but show existing defenses are largely ineffective, indicating a genuine but currently theoretical/lab-demonstrated vulnerability class relevant to multi-agent and federated LLM optimization pipelines.

Updated Jul 22, 2026

This is a defensive research paper describing a pre-deployment pipeline that scans, hardens, and validates agentic applications against data leakage and prompt injection, rather than describing a new attack or active exploit. It proposes mitigations such as schema tightening, boundary sanitization, and allowlist-based tool gating, and reports strong empirical reductions in leakage on benchmark and real-world agents. Since this is a protective methodology rather than a vulnerability disclosure, severity is low from a threat perspective, though it is highly relevant to defenders.

Updated Jul 22, 2026

n8n's OAuth 2.1 consent flow for MCP Server Trigger workflows fails to verify that the requesting user actually owns or has access to the workflow they are authorizing. A low-privileged member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token that runs the victim's workflow using the victim's stored credentials. This breaks project/user isolation and lets an attacker read outputs and manipulate tool inputs of an MCP agent tool they should never have access to.

Updated Jul 22, 2026

A vulnerability in n8n's AI Agents feature allows a low-privileged 'Project Viewer' user to escalate privileges by simply chatting with an agent that has node tools enabled. Missing authorization checks on the node-execution tool let the attacker run arbitrary workflow nodes and access stored credential secrets they should not have access to.

Updated Jul 22, 2026

A vulnerability in the Ansible Lightspeed MCP server allows an attacker to use indirect prompt injection to manipulate the AI agent into writing files outside of intended directories. This path traversal flaw can expose sensitive host data and enable execution of malicious commands, potentially leading to full system compromise. The CVSS score of 6.6 reflects meaningful but not maximal severity, likely due to required conditions like agent exposure to untrusted content.

Updated Jul 22, 2026 · CVSS 6.6

Researchers found that hidden text on an ordinary web page could hijack AWS Kiro, an agentic coding IDE, causing it to rewrite its own configuration file and execute attacker-controlled code without any human approval step. A simple task like asking Kiro to summarize a webpage was enough to trigger full remote code execution on the developer's machine. AWS has since patched the flaw, though no CVE has been assigned.

Updated Jul 22, 2026

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

Updated Jul 22, 2026

Langflow, a widely used visual builder for LLM/agent workflows, contains a vulnerability allowing remote attackers to execute arbitrary code by including functionality from an untrusted control sphere. This has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild, with a very short remediation window (3 days from add date to due date). Because Langflow is often used to orchestrate AI agents and connect them to tools and data sources, compromise of the platform can lead to full takeover of downstream agent pipelines and connected systems.

Updated Jul 22, 2026

MCP-for-Stata, an MCP server that lets AI agents drive Stata, fails to sanitize the log_file_name parameter before interpolating it into a Stata command string. An attacker (or a compromised upstream agent) can craft a malicious log_file_name to inject arbitrary Stata commands such as shell, python, or erase, achieving code execution on the host running the MCP server. The issue is patched in version 1.17.3.

Updated Jul 22, 2026

The mcp-webresearch MCP server's visit_page tool fails to filter private, loopback, or cloud metadata IP ranges before directing its Playwright browser to fetch a URL. An attacker who can influence the LLM's tool arguments (e.g., via prompt injection from a webpage the agent reads) can redirect the server to internal endpoints like cloud metadata services, leaking sensitive internal data or credentials into the model's context.

Updated Jul 22, 2026 · CVSS 8.2

This raw data is a blog post transcript from Simon Willison covering a fireside chat with Anthropic's Claude Code team about product development, dogfooding practices, and system prompt design philosophy. It contains no indicators of prompt injection, tool poisoning, agent impersonation, or any other security threat to AI agents. This should be treated as informational content, not a security incident.

Updated Jul 21, 2026

This is an academic survey paper (arXiv cs.CR) analyzing how 21 proposals and 5 commercial AI agent products handle user-level permissions, rather than a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies instead of customizable per-user permissions, and identifies gaps in interface design, policy derivation, and runtime enforcement. No specific exploit, CVE, or actively exploited flaw is described; this is foundational research useful for informing future defenses.

Updated Jul 21, 2026

This is an academic research paper (not an active exploit) demonstrating a novel attack against multi-hop RAG agents called 'Salience Induction,' which manipulates fact position, emphasis, and framing in retrieved documents to redirect an agent's reasoning without injecting false facts or instructions. The authors also propose a defense, Salience Normalization, that substantially reduces attack success. This is a legitimate, disclosed research contribution rather than an in-the-wild threat, but it identifies a real and previously underexplored weakness in agentic RAG reasoning pipelines.

Updated Jul 21, 2026

This is an academic research paper introducing a benchmark for testing how well LLM agent defenders resist adaptive, multi-round prompt injection attacks driven by other LLMs. It is not a report of an active exploit or vulnerability in a deployed system, but a methodology and dataset release showing that adaptive multi-turn attackers achieve modestly higher success rates than single-turn attacks against frontier models. Severity is low as a threat item since it describes research tooling and findings rather than a concrete exploitable weakness in a specific product.

Updated Jul 21, 2026