AI Agent Threats

ForgeCode, an AI pair-programming CLI, automatically parses and executes MCP server configurations from a repository's .mcp.json file without any user confirmation. A malicious or compromised repository can embed arbitrary OS commands in this file, achieving code execution with the developer's privileges the moment they run forge inside the cloned repo. This turns routine repository evaluation into a reliable initial-access vector for supply-chain attacks against developers.

Updated Jul 19, 2026 · CVSS 7.8

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing an authenticated attacker to read arbitrary files on the host, including the JWT signing key used to issue authentication tokens. With this key, an attacker can forge valid tokens and impersonate any user, effectively bypassing authentication controls within the Langflow agent-building platform.

Updated Jul 18, 2026 · CVSS 7.5

IBM Langflow versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote code execution due to incomplete validation of MCP server configuration files. An attacker who can supply or modify an MCP server config could execute arbitrary code on the Langflow host, fully compromising the agent runtime and any connected tools or data.

Updated Jul 18, 2026 · CVSS 8.8

Langflow, an open-source framework used to build AI agent workflows, contains a server-side request forgery vulnerability caused by weak default configuration and incomplete SSRF protections. An attacker could exploit this to make the Langflow server issue unauthorized requests to internal or cloud-metadata endpoints, potentially exposing sensitive infrastructure or credentials. This is a genuine, credibly documented vulnerability (CVSS 7.7) rather than a speculative or low-quality report.

Updated Jul 18, 2026 · CVSS 7.7

IBM Langflow, an open-source visual builder for AI agent workflows, contains a path traversal flaw where a malicious flow can fetch attacker-controlled content and write it to arbitrary paths on the server via a crafted Content-Disposition header. An authenticated attacker can abuse this to overwrite configuration, code, or scheduled/startup files, likely leading to full compromise of the Langflow instance. This is a serious framework-level vulnerability requiring only low-privilege authenticated access.

Updated Jul 18, 2026 · CVSS 8.8

A vulnerability in IBM Langflow's Python Interpreter component allows an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation. This affects Langflow OSS versions 1.0.0 through 1.10.1, and could allow an attacker with low-level access to escalate privileges and take control of the underlying system. Given the CVSS score of 8.8, this is a serious flaw that requires prompt patching.

Updated Jul 18, 2026 · CVSS 8.8

IBM Langflow OSS versions 1.0.0 through 1.10.1 expose a public flow build endpoint that allows unauthenticated remote code execution due to an incomplete security denylist. Attackers can construct flows using code-execution-capable agent components (OpenDsStarAgent, CodeActAgentSmolagents, CSVAgent) that are not blocked by the validation function, achieving arbitrary code execution without any authentication.

Updated Jul 18, 2026 · CVSS 8.1

IBM Langflow contains a vulnerability where its ToolGuard security policy fails to validate dynamically generated Python code fields, allowing attackers with flow creation privileges to inject and execute arbitrary code on the backend despite custom component restrictions being disabled. The flaw is worsened by an MCP tool that accepts attacker-controlled user IDs, enabling cross-tenant injection into other users' flows, and can require little to no authentication under common misconfigurations.

Updated Jul 18, 2026 · CVSS 9.9

Langflow, a widely used low-code framework for building AI agent workflows, ships with an AUTO_LOGIN feature enabled by default that issues long-lived superuser bearer tokens to any unauthenticated network requester hitting a specific login endpoint. Combined with permissive CORS settings, this allows a remote attacker with no credentials to obtain full administrative control over the Langflow instance, including any agents, flows, and connected tools/credentials it manages. This is a critical, actively exploitable misconfiguration in a default deployment rather than a subtle logic flaw.

Updated Jul 18, 2026 · CVSS 9.8

IBM Langflow OSS versions 1.0.0-1.10.0 allow unauthenticated attackers to register new user accounts that, under the common NEW_USER_IS_ACTIVE=true configuration, are immediately active without admin approval. This lets attackers authenticate and reach code-execution endpoints, effectively bypassing intended access controls even when AUTO_LOGIN is disabled. Given the critical CVSS score of 9.8, this is a genuine and severe vulnerability requiring urgent patching.

Updated Jul 18, 2026 · CVSS 9.8

IBM Langflow versions 1.0.0 through 1.10.0 contain a critical vulnerability chain allowing any unauthenticated network attacker to obtain superuser credentials and execute arbitrary code on the server. This affects default deployments of a widely used AI agent-building platform, giving attackers full control of the host and any connected agent workflows, data, or credentials.

Updated Jul 18, 2026 · CVSS 9.8

Claude Code Action, prior to version 1.0.74, checked out attacker-controlled pull request branches and blindly loaded and enabled any MCP servers defined in a PR's .mcp.json file. This allowed an external attacker to open a malicious pull request that, once processed by the Claude Code action, achieved arbitrary code execution on the GitHub Actions runner and exfiltrated CI secrets such as API keys and tokens.

Updated Jul 18, 2026

LiteLLM 1.18.10 allows any user who can submit MCP server configuration JSON to specify arbitrary OS commands and arguments that are executed unvalidated on the host. This gives an attacker remote code execution with the privileges of the LiteLLM process, a critical risk given the 9.8 CVSS score and the ease of exploitation.

Updated Jul 18, 2026 · CVSS 9.8

A concurrency flaw in IBM Cognos Analytics' Agentic AI assistant causes incorrect report summaries or processing failures when multiple authenticated users submit report tasks at the same time. This is a reliability/integrity bug rather than an exploitable attacker-controlled takeover primitive, though it could be leveraged to degrade service or corrupt report outputs relied on for decision-making.

Updated Jul 18, 2026 · CVSS 5.4

Agentic-Flow's MCP server tools passed user- and agent-supplied parameters (agent, task, name, language, agentdb) directly into shell commands via execSync() without sanitization, enabling arbitrary OS command execution. Any client, upstream agent, or automated caller able to invoke these MCP tools could achieve full remote code execution at the privilege level of the MCP server process. This is a critical, unauthenticated-adjacent injection flaw affecting core orchestration and swarm tooling.

Updated Jul 18, 2026 · CVSS 8.8

This is a follow-up disclosure from Embrace The Red detailing how an LLM agent that outputs untrusted content into a macOS Terminal could be leveraged to trigger DNS requests via crafted ANSI escape sequences, effectively exfiltrating data through DNS lookups. Apple has since fixed the underlying macOS Terminal behavior, so this report documents a resolved vulnerability rather than an active ongoing threat. Severity is moderate given the fix is already deployed, but the technique remains relevant for agents/tools still rendering raw terminal output without sanitization.

Updated Jul 17, 2026

This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.

Updated Jul 17, 2026

Academic research demonstrates that malicious instructions planted inside persistent memory files (used by agentic coding assistants like Claude Code and OpenAI Codex for cross-session context) can influence and hijack future agent sessions. This is a controlled research study, not an observed in-the-wild exploit, but it highlights a real and underexplored attack surface as agents adopt long-term memory.

Updated Jul 17, 2026

This is a defensive security research paper describing FlowGuard, a detection system that identifies real vulnerabilities (like command injection and file system access risks) in MCP servers by combining semantic analysis with runtime evidence verification. It is not an active exploit or attack technique, but rather a scanner designed to help defenders find genuine risks in the MCP ecosystem, which it did find in real-world servers (523 findings across 326 servers). The paper itself poses no direct threat; it highlights that underlying vulnerabilities in MCP tool implementations are prevalent enough to warrant sophisticated detection tooling.

Updated Jul 17, 2026

This article is a blog post by Simon Willison discussing the release of Moonshot AI's Kimi K3 model, covering pricing, benchmarks, and a whimsical 'pelican riding a bicycle' SVG test. It contains no security incident, vulnerability, or threat relevant to AI agents, agent frameworks, or agent protocols.

Updated Jul 17, 2026