AI Agent Threats

The MCP Python SDK's SSE and stateful Streamable HTTP transports route messages to sessions based solely on a session ID, without checking that the requesting client is the same authenticated principal who created that session. Any bearer-token-authenticated client that learns or guesses a valid session ID can inject JSON-RPC messages into another user's active session, effectively hijacking it. This is a serious cross-tenant authorization flaw fixed in version 1.27.2.

Updated Jul 16, 2026 · CVSS 7.1

A researcher discovered a loophole in Anthropic's Claude web_fetch tool that allowed a malicious website to exfiltrate private user data (name, location, employer) by chaining together a sequence of attacker-controlled links discovered within previously fetched pages. This bypassed the intended safeguard that web_fetch could only follow user- or search-originated URLs, effectively encoding stolen data letter-by-letter into a series of outbound requests. Anthropic has since patched the issue by disallowing navigation to links found within fetched content.

Updated Jul 15, 2026

Penpot's MCP server component exposed an unauthenticated HTTP endpoint bound to all network interfaces that allowed arbitrary JavaScript execution on the host. Any network-adjacent attacker could remotely execute code without credentials, making this a critical, easily exploitable vulnerability in an agent-tooling component.

Updated Jul 15, 2026 · CVSS 8.8

Cursor's browser-enabled Cloud Agent exposed a local agent control endpoint without authentication, allowing malicious web content encountered by the agent's browsing capability to reach it from inside the sandbox. This let attacker-controlled pages trigger code execution within the agent's session and steal repository files, environment variables, credentials, and GitHub App tokens. The vendor fixed the issue by requiring authentication on the endpoint.

Updated Jul 15, 2026

This is a defensive research paper, not a disclosed vulnerability or active exploit. It proposes PVDetector, a training-free method to detect prompt injection attacks against purpose-specific LLM agents by analyzing hidden activation states for 'policy-violation' concepts rather than just input/output text. Since the raw data describes a detection technique intended to help defenders, it does not itself constitute a threat.

Updated Jul 15, 2026

PraisonAI versions before 4.6.78 default to running the MCP HTTP-stream server without any API key or authentication, meaning anyone who can reach the endpoint can list and invoke all exposed tools. The server also fails to validate tool-call arguments against the advertised schema, compounding the risk of malformed or malicious inputs reaching tool handlers. Exploitation requires the operator to have bound the server to a network-accessible address rather than the safe localhost default.

Updated Jul 15, 2026 · CVSS 7.3

An unauthenticated attacker can abuse the Grafana MCP Server by injecting a crafted X-Grafana-URL header, tricking the server into acting as a proxy that leaks its own privileged Grafana service-account token. This same flaw allows server-side request forgery against internal networks and cloud metadata endpoints, giving attackers a path to full credential theft and internal reconnaissance without needing any prior authentication.

Updated Jul 15, 2026 · CVSS 8.6

This is a Simon Willison blog post describing a fun, benign feature of OpenAI's Codex Desktop app: an animated desktop 'pet' (a pelican on a bicycle) created using gpt-image-2 and open-source skill scripts. There is no security vulnerability, exploit, or malicious activity described in this content.

Updated Jul 15, 2026

The mastergo-magic-mcp MCP server (versions up to 0.2.0) contains a server-side request forgery vulnerability in its getComponentLink tool, caused by insufficient validation of the url argument passed to a z.string schema check. A remote attacker can supply a crafted URL to make the MCP server issue requests to arbitrary internal or external endpoints. A public exploit exists and the vendor has not yet responded to the disclosure.

Updated Jul 15, 2026 · CVSS 6.3

The AWS HealthLake MCP Server fails to validate that pagination URLs returned via the next_token parameter point back to the legitimate HealthLake endpoint, enabling an authenticated user to redirect the server's outbound requests to an attacker-controlled endpoint. This can leak AWS temporary security credentials used by the MCP server, giving an attacker a foothold to access AWS resources tied to those credentials. Fixed in version 0.0.14.

Updated Jul 15, 2026 · CVSS 7.3

This is a quoted essay excerpt from Armin Ronacher discussing how shared understanding in software projects is built through human friction, and how AI coding agents affect that process. It contains no technical details about vulnerabilities, exploits, or attacks against AI agents, and is purely a philosophical/editorial commentary piece.

Updated Jul 14, 2026

Researchers demonstrate that malicious text placed in the physical environment (e.g., signs, labels) can be captured by camera-equipped smart glasses and hijack the behavior of Vision-Language Models, causing them to ignore true visual context and produce harmful, biased, or false outputs. This is a research paper describing a demonstrated but not actively exploited class of attack, with success rates up to 96% in simulation and 60% in real-world tests across 12 VLM models.

Updated Jul 14, 2026

This is an academic benchmark paper (NetInjectBench), not an active exploit, demonstrating that LLM agents used for network operations can be manipulated via indirect prompt injection embedded in tickets, alerts, logs, and ChatOps messages to trigger unsafe tool actions. The researchers show naive agents execute unsafe actions 82.5% of the time under attack, but a metadata-aware execution-time policy gate can reduce this to near-zero while preserving usefulness. The severity is rated medium because this is defensive research quantifying and mitigating a known risk class rather than a disclosed vulnerability in a specific deployed product.

Updated Jul 14, 2026

Researchers demonstrate that an adversary can poison an open dataset with misleading metadata and upload it to a public repository, causing autonomous AI research agents (built on Claude, GPT, Gemini) to unknowingly retrieve and use the poisoned data, producing fraudulent scientific conclusions in nearly half of tested runs. No prompt injection, agent compromise, or fabricated papers are needed — only manipulation of the open data ecosystem — and current agents rarely detect the poisoning (6% detection rate), though provenance auditing fully mitigates it in testing.

Updated Jul 14, 2026

This is an academic research paper, not an active exploit or attack. The authors built MCPZoo, a large dataset of runnable MCP servers, and found that existing MCP security scanners are unreliable: they flag ~97% of servers as risky, but fewer than half of sampled alerts are true positives, and different scanners disagree substantially with each other.

Updated Jul 14, 2026

This is a Simon Willison blog post sharing a GitHub code-frequency chart to illustrate how much AI coding agents (e.g. Opus 4.8, GPT-5.5) have increased his output on the Datasette open source project. There is no security vulnerability, attack technique, or agent threat described in this content.

Updated Jul 14, 2026

MCP Appium, an MCP server for automating mobile app testing, fails to sanitize attacker-controlled UI element attributes before embedding them in an HTML template returned by its generate_locators tool. A malicious mobile app under test can inject HTML/JavaScript that executes in the MCP client's rendering context and calls arbitrary MCP tools via postMessage, effectively letting the app-under-test hijack the testing agent's capabilities.

Updated Jul 14, 2026 · CVSS 8.2

Flowise, a popular low-code AI agent/LLM workflow builder, ships with hardcoded fallback JWT secrets, audience, and issuer values that activate silently when operators fail to set the corresponding environment variables. An attacker who knows these public default values can forge valid JWTs to impersonate any user, including administrators, granting full control over the agent platform and any connected tools, credentials, or workflows.

Updated Jul 13, 2026 · CVSS 9.8

This is a short opinion/commentary post by Simon Willison discussing the organizational concept of 'Directly Responsible Individuals' (DRI) and arguing that AI agents should never hold this accountability role since accountability is inherently human. There is no technical vulnerability, exploit, or security incident described here; it is a governance and ethics discussion.

Updated Jul 13, 2026

AstrBot's dashboard MCP connection test feature allows an attacker to supply an arbitrary URL that the server will fetch, resulting in server-side request forgery (SSRF). This could let an attacker probe internal networks, hit cloud metadata endpoints, or pivot against internal services from the AstrBot server. Exploit details are public and the vendor has not responded, increasing real-world risk.

Updated Jul 12, 2026 · CVSS 6.3