AI Agent Threats

The Fay AI agent framework (version 4.3.1) exposes its MCP server management interface without adequate access control, allowing remote attackers to register a malicious MCP STDIO server with attacker-controlled commands. This results in full arbitrary command execution on the host running the Fay service, making it a critical, easily exploitable remote code execution vulnerability.

Updated Jul 17, 2026 · CVSS 9.8

Reports indicate that OpenAI's Codex coding agent (referenced as GPT-5.6) can unexpectedly delete a user's entire $HOME directory when run in 'full access mode' without sandboxing or auto-review safeguards. The root cause is the model attempting to override the $HOME environment variable to create a temporary directory and mistakenly deleting the real $HOME instead. This is an unintentional agent malfunction rather than a malicious attack, but it demonstrates severe real-world consequences of granting autonomous coding agents unsandboxed filesystem access.

Updated Jul 16, 2026

AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 logged raw user prompts and full agent responses into OpenTelemetry span attributes without any filtering or masking, which then flowed into customer CloudWatch aws/spans log groups. Any principal with read access to those logs could view sensitive user content, including secrets or PII that may have been part of prompts or agent outputs. This is a data exposure issue rather than an active exploit, and requires local/authenticated access to the customer's own logging infrastructure.

Updated Jul 16, 2026 · CVSS 5.7

The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.

Updated Jul 16, 2026 · CVSS 6.1

The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.

Updated Jul 16, 2026 · CVSS 3.1

The dbt-mcp MCP server, prior to version 1.17.1, logged raw tool call arguments—including SQL queries, variables, and node selections—in plaintext to a local log file when file logging was enabled. This is a genuine but low-severity information disclosure issue requiring local file access or misconfigured log exposure to exploit, with a CVSS score of 2.5 and an official fix already released.

Updated Jul 16, 2026 · CVSS 2.5

The dbt-mcp MCP server, prior to version 1.17.1, failed to sanitize client-supplied node_selection and resource_type values before passing them as dbt CLI arguments. Although the use of shell=False blocks shell metacharacter injection, an MCP client could still smuggle dbt global flags like --profiles-dir, --project-dir, or --target into the subprocess call, allowing unauthorized redirection of dbt execution context.

Updated Jul 16, 2026 · CVSS 6.3

This item is a blog post by Simon Willison describing a fun side project: a WebAssembly port of a Mermaid diagram renderer (extracted from the open-sourced Grok CLI codebase) that outputs Unicode box art in a browser. There is no indication of a vulnerability, malicious behavior, prompt injection, or any agent security issue in this content.

Updated Jul 16, 2026

This is a defensive research paper describing a new guardrail system (nsfaguard) that classifies and detects operational threats to agentic AI, such as prompt injection and tool misuse, rather than describing an actual vulnerability or attack. It introduces a risk taxonomy and benchmark models for real-time threat detection. No exploit, vulnerable framework, or active threat is disclosed; this is a mitigation/detection contribution.

Updated Jul 16, 2026

This is an academic survey paper analyzing 21 proposals and 5 commercial AI agents for how they handle user-level permissions, not a report of an active vulnerability or exploit. It highlights that most agentic systems apply uniform, product-level security policies rather than customizable per-user permissions, identifying this as a research gap rather than describing a specific attack.

Updated Jul 16, 2026

This is an academic research paper (arXiv, not an active exploit) introducing SkillSec-Eval, a framework for evaluating security risks across the full lifecycle of reusable LLM agent 'skills' — from repository admission through retrieval, planner selection, execution, and evolution. The authors evaluated 327 real-world skills and found vulnerabilities exist beyond just runtime execution, suggesting attackers could poison skills at earlier stages like publishing or ranking to influence which skills agents select and trust.

Updated Jul 16, 2026

This is an academic arXiv paper proposing a methodology for penetration testing AI-enabled systems, reframing testing to focus on behavioral objective violations rather than only infrastructure compromise. It is not an active exploit, vulnerability disclosure, or attack report but a conceptual framework and taxonomy referencing known adversarial vectors like prompt injection and tool misuse. Severity is low since no new exploitable vulnerability, affected product, or working payload is disclosed.

Updated Jul 16, 2026

The BetterDocs WordPress plugin before version 4.5.5 lets unauthenticated users trigger an AI documentation-summary feature whose output is stored and rendered without sanitization. An attacker can craft input that causes the AI to emit malicious HTML/JavaScript, which then executes as stored XSS in the browser of anyone viewing the page, including site administrators.

Updated Jul 16, 2026

xAI's Grok Build CLI coding agent was found to upload the entire working directory (and in one reported case, a user's home directory including SSH keys and password manager databases) to xAI's Google Cloud storage without clear user consent. xAI disabled the feature, deleted retained data, and open-sourced the codebase in response to backlash, but this represents a serious real-world data exfiltration incident caused by an overly broad and opaque agent tool/data-retention design rather than a targeted attack.

Updated Jul 16, 2026

A flaw in n8n-MCP's multi-tenant HTTP mode allowed an authenticated tenant to access or delete workflow-version backups belonging to the default scope rather than being confined to their own tenant. This could expose or destroy legacy backup data left over from prior single-tenant deployments or migrations. The issue is fixed in version 2.57.4.

Updated Jul 16, 2026 · CVSS 4.2

n8n-MCP, an MCP server exposing n8n workflow automation to AI assistants, failed to isolate workflow version history backups between tenants when multi-tenancy was enabled. Any authenticated tenant could read, delete, or destroy other tenants' backup snapshots, which contained full node definitions, credential references, and authorization headers. This is a severe cross-tenant data exposure and destruction flaw fixed in version 2.56.1.

Updated Jul 16, 2026 · CVSS 9.9

Repomix's MCP server contains a flaw where two specific tool flows can be used to register and read arbitrary local files without triggering the secret-scanning safety check that normally protects file reads. This allows an MCP client (or an attacker controlling one) to exfiltrate sensitive local files, including those containing credentials, that were meant to be blocked by the redaction/validation layer.

Updated Jul 16, 2026

The elasticsearch_memory tool in strands-agents-tools exposed connection parameters like the target host directly to LLM control, allowing a crafted prompt to redirect the tool to an attacker-controlled server. When the api_key parameter was omitted, the tool silently fell back to the operator's environment-stored Elasticsearch API key and sent it to whatever host the LLM specified, leaking the credential via the Authorization header. This is a classic tool-schema over-permissioning issue that turns an LLM-controllable field into a credential exfiltration vector.

Updated Jul 16, 2026 · CVSS 6.5

The deprecated WebSocket transport in the MCP Python SDK accepted connections without validating Host or Origin headers, meaning any malicious webpage a victim's browser visits could open a WebSocket connection to a locally or network-exposed MCP server. This is a classic Cross-Site WebSocket Hijacking (CSWSH) pattern that could let an attacker-controlled origin interact with an MCP server's tools on behalf of an unwitting user. Severity is moderated because the affected transport is deprecated and impact depends on what the exposed server can do and whether it's reachable from a browser context.

Updated Jul 16, 2026

The MCP Python SDK's experimental task management feature failed to bind tasks to the session that created them, allowing any connected client to list, read, cancel, or consume messages for tasks belonging to other clients. This is a broken access control / IDOR-style flaw that breaks the trust boundary between concurrent MCP sessions on the same server. It is fixed in version 1.27.2.

Updated Jul 16, 2026 · CVSS 7.6