Showing 541–560 of 568 threats, newest first
A low-severity vulnerability was identified in LangGraph's Task Result Cache where the internal _freeze function uses a weak hash for generating default cache keys. Exploitation requires high attack complexity and remote access, with a CVSS score of 3.1, making practical exploitation difficult. A fix is pending via an open pull request.
Updated Jul 5, 2026 · CVSS 3.1
A server-side request forgery flaw exists in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server, where the 'url' argument passed to an MCP tool is not validated before the server fetches it. A remote attacker can supply this MCP-exposed tool with an internal or attacker-controlled URL to make the server issue requests on their behalf, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.
Updated Jul 5, 2026 · CVSS 6.3
This is a brief opinion/commentary post observing that AI agents are becoming effective at finding software vulnerabilities at scale, referencing a tweet and a prior LinkedIn post about a coming 'AI Vulnerability Cataclysm.' It does not describe a specific vulnerability, exploit, attack technique, or affected system, so it does not constitute a genuine, actionable security threat in itself.
Updated Jul 5, 2026
A researcher demonstrated that an image generated by ChatGPT could act as a carrier for an indirect prompt injection that hijacked Claude Opus 4.7's memory tool, causing it to persist false memories into future conversations. This shows that even hardened, reasoning-heavy models remain vulnerable to multimodal adversarial inputs crafted using puzzle-like framing to bypass safety reasoning.
Updated Jul 5, 2026
This research describes a time-of-check-to-time-of-use (TOCTOU) attack against computer-use AI agents like ChatGPT Operator, where a malicious page or element changes between the moment the agent evaluates it and the moment it acts, causing the agent (and a supervising human) to click or execute something different from what was reviewed. The author reproduced a previously disclosed Google-reported vulnerability and demonstrated it live at a security conference. This is a legitimate and impactful vulnerability class for autonomous browser/UI-driving agents.
Updated Jul 5, 2026
This is a Simon Willison blog post announcing an experimental alpha release of a Python coding agent library (llm-coding-agent) built on his LLM framework. It describes an AI-generated coding agent with file editing, shell execution, and file search tools, but the content is purely a release announcement with no evidence of a vulnerability, exploit, or malicious activity. The presence of powerful tools like execute_command and edit_file is inherent to any coding agent design and is explicitly disclosed by the author (including a --yolo flag), not a hidden threat.
Updated Jul 5, 2026
This is a benign blog post by Simon Willison describing a legitimate workflow tip for Claude Code: instructing the agent to use its own judgement to delegate coding subtasks to cheaper/lower-power models via subagents, and how Claude persisted this preference as a memory file. There is no evidence of prompt injection, malicious payloads, or exploitation here; it simply illustrates that coding agents can write persistent memory files based on user instructions.
Updated Jul 5, 2026
This report describes a reliability/compatibility quirk, not a security threat: newer Claude models (Opus 4.8, Sonnet 5) sometimes emit malformed tool call arguments with invented fields when used with third-party coding harnesses like Pi, likely due to RL training tuned specifically for Anthropic's own Claude Code edit tool. There is no malicious actor, injection, or exploitation involved—this is a model behavior/engineering problem causing failed tool calls and retries.
Updated Jul 5, 2026
This is a blog post by Simon Willison describing how he used an AI coding assistant (Claude, referred to as 'Fable') to review and improve the sqlite-utils library ahead of a 4.0 stable release. The AI identified real software bugs, including a transaction-commit bug causing data loss, but this is a legitimate development workflow with no indication of prompt injection, tool poisoning, or any adversarial agent behavior.
Updated Jul 5, 2026
This is an academic red-teaming paper (not an active exploit) introducing MIRROR, a search-based framework that automatically generates diverse, non-duplicated attacks against multimodal agentic RAG systems across text poisoning, image injection, direct-query, and orchestrator-manipulation surfaces. It demonstrates high attack success rates, notably 97% against orchestrator-level tool manipulation, highlighting that current agentic RAG defenses are weak across multiple input modalities and pipeline stages. Because it is a research disclosure with an accompanying benchmark rather than an in-the-wild campaign, it is rated medium severity as a forward-looking risk indicator rather than an active incident.
Updated Jul 5, 2026
Researchers demonstrate ShareLock, a proof-of-concept attack that hides a malicious instruction by splitting it into innocuous-looking secret shares distributed across multiple MCP tool descriptions using Shamir's threshold scheme. When triggered by a covert reconstruction event (planted during a server update), the shares recombine into a working malicious prompt, achieving over 90% attack success while evading current tool-description auditing. This is a disclosed research finding, not an observed in-the-wild exploit, but it demonstrates a realistic and highly evasive supply-chain vector against MCP-based agent ecosystems.
Updated Jul 5, 2026
This is an academic arXiv paper, not an active exploit or observed attack, that formally proves prompt injection cannot be fully solved by in-pipeline defenses in current shared-embedding LLM architectures. It frames this as a structural, mathematical limitation analogous to code-data confusion in classical computing (e.g., buffer overflows), arguing that only architectural separation of instruction and data channels can meaningfully address it. Severity is assessed as medium because it is foundational research explaining why existing prompt-injection defenses fail, rather than describing a new exploit technique or active threat.
Updated Jul 5, 2026
Researchers demonstrate that LLM-controlled ROS 2 robots can be hijacked via prompt injections delivered through non-text sensory channels: vision (OCR), audio (Whisper STT), and fabricated LiDAR obstacle data injected at the system-prompt level. Several tested models show up to 100% attack success rates, and a proposed semantic firewall defense can still be bypassed roughly 10% of the time using obfuscated payloads, indicating a serious and only partially mitigated real-world safety risk for physical robotic systems.
Updated Jul 5, 2026
This is an academic research paper (not an active exploit) that identifies a structural weakness in MCP-style agent runtimes: security is typically enforced only at the connection layer (auth, session checks, approval dialogs) while execution-time actions lack consistent, testable invariants like principal binding and data-flow authorization. The authors demonstrate that naive and even 'practice-informed' mitigation baselines still permit most modeled attacks, and propose a reference runtime (HCP) that blocks all 10 benchmark attack cases by enforcing explicit execution-layer controls.
Updated Jul 5, 2026
This is a defensive research paper, not an active threat or exploit disclosure. It presents a detection method that identifies memory-poisoning attacks in LLM agents by analyzing tool-call ordering patterns (specifically, a memory-recall call preceding an email-send call), achieving very high classification accuracy. Since it describes a detection technique rather than a vulnerability or attack, severity is low from a threat standpoint, though the underlying attack class it detects (memory poisoning leading to data exfiltration) remains a legitimate concern.
Updated Jul 5, 2026
This is an academic research paper (not an active exploit) introducing SafeClawArena, a benchmark that systematically measures security failures in always-on 'Claw-like' agents such as OpenClaw, which hold persistent credentials, files, and tool access. The findings show alarmingly high attack success rates (up to 70%, and 100% for malicious plugins), indicating that current agent platforms lack the isolation and mediation protections found in traditional OS design. Because this is a controlled research disclosure rather than an in-the-wild attack, severity is rated high (not critical) but warrants urgent defensive attention given the demonstrated real-world exploitability.
Updated Jul 5, 2026
This is an academic/research announcement of an open-source defensive security tool (AI-Infra-Guard) designed to red-team and audit AI agent infrastructure, MCP servers, and agent-skill packages across multiple layers. It is not an active exploit, vulnerability disclosure, or attack in progress, but rather a proposed testing framework for defenders. No specific CVE, active campaign, or exploited vulnerability is described.
Updated Jul 5, 2026
Kong Konnect's Model Context Protocol server prior to version 1.0.0 is vulnerable to indirect prompt injection, allowing a remote attacker to manipulate an LLM agent into executing unintended API requests. This effectively lets an attacker who controls untrusted content processed by the MCP server hijack the agent's actions against Kong-managed APIs, with a CVSS score of 7.4 indicating high severity.
Updated Jul 5, 2026 · CVSS 7.4
Researchers reported what they describe as the first documented ransomware campaign, dubbed JadePuffer, allegedly executed end-to-end by an autonomous LLM agent rather than human operators. The article provides limited technical detail, so key claims (full autonomy, novelty, actual impact) cannot be independently verified from the source alone.
Updated Jul 5, 2026
This is a blog post by Simon Willison describing benign research into using DSPy to evaluate and improve system prompts for Datasette Agent's SQL query feature. There is no security vulnerability, attack, or malicious activity described; it is purely a prompt-engineering optimization exercise.
Updated Jul 5, 2026