AI Agent Threats

Researchers demonstrated 'Ghostcommit,' a technique that hides prompt injection instructions inside a PNG image committed to a repository. AI code review tools like CodeRabbit and Bugbot don't inspect image contents, but a downstream coding agent that does process the image can be tricked into reading a repo's .env file and exfiltrating secrets by encoding them as numeric data in code. This shows a real, demonstrated cross-modal injection vector with tangible secret-theft impact, not a theoretical concern.

Updated Jul 12, 2026

PraisonAI's CodeAgent executes LLM-generated Python code with no AST validation, import restrictions, or sandboxing, allowing an attacker who can influence the LLM's output via prompt injection to achieve full remote code execution on the host. This gives attackers a direct path to exfiltrate all environment secrets and compromise the underlying system, making it a maximum-severity flaw.

Updated Jul 11, 2026 · CVSS 10

PraisonAI versions before 4.6.78 ship with a prompt injection defense that only blocks CRITICAL-severity threats by default, letting HIGH-severity attacks such as instruction overrides pass through with only logging. This allows attackers to extract system prompts and trigger unauthorized tool calls via single-vector injection attempts that the framework detects but fails to stop.

Updated Jul 11, 2026 · CVSS 7.5

LangChain4j's MariaDB and pgvector embedding store integrations build SQL queries by unsafely concatenating metadata filter keys (and MariaDB string values) into query strings, allowing an attacker who controls filter input to inject SQL. This can lead to blind data exfiltration, denial of service, and mass deletion of vector store data via crafted EmbeddingSearchRequest filters.

Updated Jul 11, 2026 · CVSS 7.6

MCP Server Kubernetes before version 3.9.0 has a flaw that lets attackers smuggle malicious flags (like --server) into kubectl commands by disguising them as resource names with leading dashes, bypassing the tool's dangerous-flag safety check. This allows redirecting kubectl operations to an attacker-controlled API server, leaking the operator's bearer token and enabling full Kubernetes cluster takeover.

Updated Jul 11, 2026 · CVSS 9.8

A Drupal contributed module named 'AI Agents' has an access control flaw that allows forceful browsing, meaning unauthorized users may reach pages or functionality they shouldn't have access to. This is a standard web application authorization bug rather than a novel AI agent security issue, and no evidence in the data suggests prompt injection, tool poisoning, or agent-to-agent exploitation. Severity is moderate given the lack of CVSS score and limited detail on what functionality is exposed.

Updated Jul 11, 2026

A Drupal contributed module called 'AI Agents' has a missing authorization vulnerability allowing forceful browsing, meaning certain pages or endpoints may be accessible without proper permission checks. This is a standard web application access-control flaw in a CMS module that happens to relate to AI agent functionality, rather than a novel AI-specific attack technique. Severity is moderate since exploitation depends on the module's deployment and what functionality is exposed without authorization.

Updated Jul 11, 2026

PraisonAI's built-in prompt injection defense only blocks attacks rated CRITICAL, which requires three or more detector families to agree. This leaves a gap where cleverly crafted single- or double-vector injections score as HIGH and slip through untouched, reaching the underlying model. The flaw is a detection logic weakness rather than a full bypass of all protections, making it moderately severe.

Updated Jul 10, 2026 · CVSS 5.3

This is an academic defense paper (not an active exploit report) presenting 'Prismata', a system that mitigates cross-site prompt injection in web browsing agents by dynamically labeling page content trust levels and restricting agent capabilities accordingly. It describes a well-known class of attack (untrusted webpage content hijacking agent instructions) and proposes mitigations rather than disclosing a new vulnerability. Severity is rated low because this raw data itself is defensive research, not a new exploit or active threat.

Updated Jul 10, 2026

This is a defensive research paper describing an open-source firewall that intercepts web-based and programmatic LLM traffic to prevent sensitive data and proprietary code leakage. It is not an active exploit or vulnerability disclosure; it introduces a protective architecture rather than describing a threat to AI agents. Severity is set to low because the raw data does not describe a genuine security issue, only a mitigating tool.

Updated Jul 10, 2026

This is a routine tech news article by Simon Willison describing OpenAI's new GPT-5.6 model family (Luna, Terra, Sol), pricing, benchmark comparisons against Claude, and new API features like programmatic tool calling and multi-agent support. It contains no evidence of a security vulnerability, exploit, or attack against AI agents or agent infrastructure.

Updated Jul 10, 2026

The self-hosted HTTP transport of the DeepSeek MCP Server exposes the /mcp endpoint without any authentication, allowing any network-reachable client to initialize a session, enumerate tools, and invoke server-side functionality. This includes the deepseek_chat tool, which can consume the operator's own DEEPSEEK_API_KEY, leading to unauthorized API usage and potential cost/data exposure. The issue is patched in version 1.8.0.

Updated Jul 10, 2026 · CVSS 5.3

The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.

Updated Jul 10, 2026 · CVSS 8.6

Langroid versions before 0.65.2 contain a critical flaw where LLM-generated tool messages evaluated via Python's eval() with a supposedly empty 'locals' dict can still access all built-in functions, since '__builtins__' is implicitly injected into globals. This allows any attacker capable of influencing LLM output (e.g., via prompt injection) to achieve full unauthenticated remote code execution on the host running the agent.

Updated Jul 10, 2026 · CVSS 10

Langroid's file read/write tools fail to properly restrict operations to a configured working directory, allowing an LLM agent or user-controlled tool call to escape that directory using path traversal sequences. This lets an attacker read arbitrary files (e.g., secrets, credentials) or write files anywhere the process has permissions, despite the framework appearing to sandbox file access to a project workspace. The issue is patched in version 0.64.0.

Updated Jul 10, 2026 · CVSS 7.1

Langroid's SQLChatAgent uses an incomplete regex denylist to block dangerous SQL functions before executing LLM-generated queries against a live database. Because the denylist omits PostgreSQL file-reading functions (pg_read_file, pg_stat_file, etc.) and certain SQL Server/SQLite file-attach primitives, an attacker who can influence the generated SQL—directly or via prompt injection in ingested data—can craft ordinary SELECT statements that read arbitrary files from the database host, bypassing the agent's strict default safety configuration entirely.

Updated Jul 10, 2026

Langroid's Neo4jChatAgent forwards LLM-generated Cypher queries directly to the Neo4j driver without validation, statement allowlisting, or an opt-out mechanism. An attacker who can influence the prompt—either directly or via indirect content ingested through RAG—can manipulate the LLM into generating destructive or data-exfiltrating Cypher queries, and potentially achieve OS command execution if APOC or dbms.security procedures are enabled on the server. This mirrors a previously patched SQLChatAgent vulnerability (CVE-2026-25879) whose fix was never extended to the Neo4j module.

Updated Jul 10, 2026

This is a routine blog post from Simon Willison announcing Meta's Muse Spark 1.1 model API release, including an evaluation report and a new CLI plugin for accessing the model. There is no security vulnerability, attack, or agent threat described in this content; it is purely informational product coverage.

Updated Jul 9, 2026

Researchers demonstrate that LLM agents frequently hallucinate plausible-sounding resource names (repos, skills, packages) when performing tasks like cloning or installation, and these hallucinations are predictable and transferable across models. Attackers can preemptively register these hallucinated resource names to host malicious payloads, causing agents that autonomously fetch and execute them to become compromised at scale, effectively forming a botnet without needing any direct prompt injection channel.

Updated Jul 9, 2026

This is a defensive research paper (not an active exploit) analyzing taint-style vulnerabilities in MCP server implementations, where untrusted input flows into dangerous sinks like command execution or file access. The authors propose SPELLSMITH, a mitigation that uses enhanced tool descriptions and LLM self-reflection to reduce exploitation risk without requiring code-level fixes. Severity is medium since it documents a real and underexplored class of vulnerabilities in deployed MCP servers, but the source itself is a proactive defense proposal rather than a disclosed active attack.

Updated Jul 9, 2026