AI Agent Threats

A server-side request forgery (SSRF) vulnerability exists in the aerostack-mcp project's mcp-whatsapp component, specifically in the upload_media function's media_url argument. A remote attacker can supply a malicious URL to force the MCP server to make unintended requests, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.

Updated Jul 9, 2026 · CVSS 6.3

A vulnerability in n8n's AI Agents feature allowed a low-privilege user with only 'use' access to a shared credential to bypass the configured Allowed HTTP Request Domains restriction by pointing an MCP tool at an arbitrary attacker-controlled URL. This let the attacker exfiltrate the credential's secret value to an external server, effectively escalating from use-only access to full credential disclosure. The issue is fixed in n8n 2.27.4 and 2.28.1.

Updated Jul 9, 2026

Researchers found that six popular AI coding assistants can be tricked by a malicious repository containing symlinks: the agent asks the user to approve an edit to what looks like a harmless file, but the actual write lands on a sensitive system file instead. This allows an attacker who convinces a developer to open a booby-trapped project to gain code execution or persistence on the developer's machine, bypassing the intended human-approval safety check.

Updated Jul 9, 2026

Researchers at the AI Now Institute demonstrated an attack called 'Friendly Fire' where malicious source code, submitted for automated security review, tricks AI coding agents like Claude Code and OpenAI Codex into executing the attacker's payload on the host machine. This occurs when the agents run in autonomous modes that self-approve actions, turning a defensive scanning tool into a code execution vector.

Updated Jul 9, 2026

This is a blog post by Simon Willison describing how Bun's developer used AI coding agents (Claude) to rewrite the Bun JavaScript runtime from Zig to Rust, validated against a TypeScript conformance test suite. There is no security vulnerability, exploit, prompt injection, or agent threat described in this content; it is a case study in large-scale agentic software engineering.

Updated Jul 9, 2026

Cline's local Hub dashboard server fails to validate the Origin header on its WebSocket /browser endpoint, allowing any malicious website visited by a user to connect and issue commands. When ROOM_SECRET is unset (the default for local binds), attackers can read workspace state, tamper with MCP and provider settings, and trigger arbitrary command execution if a model provider is configured. This is a critical, fully remotely exploitable vulnerability via drive-by browser interaction with no user awareness required.

Updated Jul 9, 2026 · CVSS 8.8

LiteLLM's MCP Streamable HTTP endpoint prior to version 1.84.0 could be tricked into skipping key validation by sending a fabricated Authorization header, causing the server to fall back to an empty, effectively unauthenticated user context. This let attackers reach MCP tooling and any downstream tools/agents exposed through the proxy without holding a valid LiteLLM API key. The vulnerability is fixed in 1.84.0.

Updated Jul 9, 2026

Composio SDK versions before 0.2.32-beta.283 fail to validate file paths in a file-upload tool, allowing an attacker who controls untrusted input (e.g., via prompt injection) to redirect the agent into reading and uploading sensitive local files such as SSH private keys to attacker-controlled storage. This is a realistic and impactful supply-chain/tool-layer vulnerability, not a speculative or low-severity issue.

Updated Jul 9, 2026 · CVSS 6.8

This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.

Updated Jul 8, 2026

Researchers demonstrate a structural flaw in the Model Context Protocol: the metadata a human approves in a tool-installation dialog is not guaranteed to match the bytes actually sent to the model. Using invisible Unicode TAG-block characters embedded in tool descriptions, an attacker can smuggle hidden instructions that a human reviewer never sees but that reach the LLM verbatim on every turn, and this was confirmed across three independent MCP server implementations. This is a research proof-of-concept, not an observed active exploit, but it identifies a reproducible, protocol-level weakness rather than a one-off bug.

Updated Jul 8, 2026

CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-55255, an authorization bypass in Langflow, a popular framework for building AI/LLM agent workflows. This is relevant to AI agent security because Langflow is used to construct agentic pipelines, and an authorization bypass could let attackers manipulate or hijack agent flows, credentials, or connected tools. The other two CVEs (JoomShaper and Joomlack) are unrelated CMS plugin vulnerabilities with no agentic relevance.

Updated Jul 8, 2026

Langflow, a popular visual builder for LLM/agent workflows, has an authorization bypass that lets an authenticated user execute any other user's flow simply by supplying that victim's flow ID. This is a classic insecure direct object reference (IDOR) that fails to verify flow ownership before execution, allowing cross-tenant abuse in multi-user deployments. CISA has added it to the Known Exploited Vulnerabilities catalog, indicating active exploitation and urgency to patch.

Updated Jul 8, 2026

This raw data is a routine blog post by Simon Willison announcing the release of sqlite-utils 4.0, describing new features like schema migrations, nested transactions, and compound foreign keys. There is no indication of any security vulnerability, prompt injection, agent compromise, or threat to AI agents or agent frameworks in this content.

Updated Jul 8, 2026

9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.

Updated Jul 8, 2026 · CVSS 9.8

This is an academic research paper benchmarking how well LLM agents orchestrate a large suite of security tools (HexStrikeAI, 150+ tools over MCP) against CTF challenges, not a report of an active vulnerability or attack. The study analyzes factors affecting agent capability (client vs. model, tool access, reasoning limits) and reports improved solve rates after fixes; it describes no new attack technique, exploit, or in-the-wild threat.

Updated Jul 7, 2026

This is an academic defense paper, not an active exploit report. It describes and mitigates 'stored IPI', a known weakness in Dual-LLM prompt injection defenses where untrusted data written to disk/environment and later reread loses its 'untrusted symbol' tagging and becomes trusted again. The paper's proposed solution, DualView, is presented as fully blocking this class of attack in benchmarks, so the actual residual risk described here is low and mainly relevant to agents using prior, incomplete Dual-LLM protections.

Updated Jul 7, 2026

Researchers identify a new class of indirect prompt injection called Agent Data Injection (ADI), where attackers disguise malicious payloads as trusted metadata or tool-call context rather than as explicit instructions, causing agents to take unintended actions. This bypasses existing instruction-injection defenses and was demonstrated against real web agents (Claude in Chrome, Antigravity, Nanobrowser) and coding agents (Claude Code, Codex, Gemini CLI), leading to arbitrary clicks, remote code execution, and supply-chain risks. This is a credible, well-documented research finding with proof-of-concept impact against widely used production agents.

Updated Jul 7, 2026

This is a defensive research paper, not a description of an active threat or exploit. It proposes a method (UCM) to protect web-browsing AI agents from prompt injection by redacting untrusted DOM regions before the agent sees them and routing interactions through a sandboxed, privilege-separated interface. Severity is low because no vulnerability is being disclosed here — the paper describes a mitigation, though it implicitly confirms that web agents remain broadly susceptible to prompt injection absent such defenses.

Updated Jul 7, 2026

The OpenAI Codex desktop app for macOS automatically fetched remote images referenced in Markdown model output, which an attacker could exploit via indirect prompt injection to leak sensitive session data (API keys, source code, tool outputs) to an attacker-controlled server. No user click was required, making exfiltration silent and automatic. This is a genuine, credible vulnerability with clear exploitation mechanics, though no in-the-wild exploitation has been observed.

Updated Jul 7, 2026

SUSE Rancher AI Agent versions before 1.0.2 write API keys and raw LLM response text to log files when DEBUG loglevel is enabled, exposing sensitive data to anyone with local log access. This is a configuration/logging hygiene flaw rather than a novel agentic attack technique, and requires local access plus DEBUG mode to be exploitable. Severity is moderate because it enables credential theft and downstream misuse, but exploitation requires elevated local access and a non-default log setting.

Updated Jul 6, 2026