AI Agent Threats

A vulnerability in GitLab's AI Gateway allowed an authenticated user with access to the Duo Agent Platform to redirect model inference requests to an attacker-controlled endpoint by crafting model metadata. This could leak sensitive Google Vertex AI or AWS Bedrock cloud service credentials to the attacker's server. GitLab has already remediated the issue in patched versions.

Updated Aug 27, 2026 · CVSS 8.2

This CVE describes a conventional SQL injection vulnerability in the ServiceNow AI platform, not a prompt injection or agentic AI-specific threat despite being surfaced by a 'prompt injection' keyword search. It allowed unauthenticated attackers to execute arbitrary SQL against the underlying database in certain circumstances, potentially exposing or modifying instance data. ServiceNow has already patched the issue and reports no known exploitation in the wild.

Updated Aug 27, 2026

Agno versions up to 2.5.8 allow an unauthenticated attacker to achieve remote code execution by embedding malicious instructions in content the agent processes, such as a web page or document. Because LLM-generated arguments are passed unsanitized into exec(), runpy.run_path(), and subprocess.run(), the agent itself becomes the execution vector for attacker-controlled code. This is a critical, actively exploitable framework vulnerability with no authentication required.

Updated Aug 27, 2026

ServiceNow patched a code injection vulnerability in its AI platform that could have let an unauthenticated attacker run arbitrary code and access or modify instance data beyond intended scope. The vendor has already shipped fixes and states no known active exploitation, but the flaw's unauthenticated nature and broad impact on instance data make it significant. This is a legitimate, remediated vulnerability rather than an emerging in-the-wild campaign.

Updated Aug 27, 2026

A vulnerability in gpt-researcher (v0.14.7 and earlier) allows an unauthenticated remote attacker to achieve code execution by sending malicious Model Context Protocol configurations through the application's WebSocket endpoint. Because the endpoint lacks authentication, any network-reachable attacker can trigger this without valid credentials, making it a high-impact, low-effort exploitation path.

Updated Aug 27, 2026

Researchers demonstrated that a simple malicious website summary request can hijack Claude Code Opus 5's 'Auto Mode' and achieve remote code execution with a 60-80% success rate. This directly contradicts Anthropic-commissioned third-party evaluations that reported a 0.00% prompt injection success rate, showing the safety classifier that replaced human approval prompts is far more bypassable in practice than claimed.

Updated Aug 27, 2026

This is a defensive research paper, not an active exploit. It quantifies how LLM agents habitually over-share privacy-sensitive data in tool call arguments (81-88% of calls) and proposes ToolMinimize, a middleware that rewrites arguments to the minimum necessary data. The finding highlights a systemic data-hygiene weakness in agent-to-tool interactions rather than describing a novel attack technique.

Updated Aug 27, 2026

Google's langfun library (versions before 0.1.2) evaluates Python expressions generated by an LLM in response to lf.query prompts without any sandboxing. A remote unauthenticated attacker who can influence prompt input can cause the model to emit malicious Python code that gets executed directly in the host application, resulting in full arbitrary code execution.

Updated Aug 26, 2026

This raw data is a blog post quoting commentary about AI's ability to write and refine large amounts of code over time. It contains no information about vulnerabilities, attacks, or security issues involving AI agents, tools, or protocols. This is not a security threat.

Updated Aug 26, 2026

This is an academic research paper (not an active exploit) describing 'TrustShift', a class of attacks where a malicious MCP tool server behaves benignly during an initial conditioning period to build trust, then switches to adversarial behavior once agents rely on it heavily. The researchers built an attack taxonomy and a benchmark showing ~69.5% attack success rate against frontier agents, plus a runtime defense (SHIELD) that reduces this to ~42.7%.

Updated Aug 26, 2026

This is an academic security analysis (not an active exploit) of Google's Agent Payments Protocol v0.2, which is used by LLM-driven shopping agents to authorize payments. The researchers show that while signed Checkout and Payment Mandates protect transaction integrity after signing, the A2A and MCP interactions that shape the transaction beforehand are unprotected, enabling an agent to be manipulated into signing a mandate that does not reflect the user's true intent. The paper identifies 48 catalogued threats across five attack families, with eight rated High severity, and provides proof-of-concept demonstrations plus a deployment-aware scanner.

Updated Aug 26, 2026

This is a defensive research paper, not an active threat or exploit. It proposes 'Semantic Overlays,' a technique using learned adapters on a model's residual stream to help LLMs distinguish trusted instructions from untrusted content (e.g., tool outputs, user input), thereby mitigating prompt injection. The paper reports strong benchmark improvements against known prompt injection attack suites, and severity is low since it describes a mitigation, not a vulnerability or attack.

Updated Aug 26, 2026

This is a defensive research paper, not an active exploit: it identifies real trust-boundary gaps in the emerging W3C WebMCP proposal that let malicious web pages spoof tool ownership, manipulate tool lifecycles, and inject prompts via tool metadata/descriptions into browser-integrated LLM agents. The authors propose and empirically validate a dual-layer runtime (cryptographic tool provenance plus a quarantine/privileged agent split) that reduces these attack classes to near-zero success, while also disclosing a residual bypass via malicious tool names invoked before inspection.

Updated Aug 26, 2026

This is a defensive research paper, not an active exploit or vulnerability disclosure. It proposes Attnlocate, a runtime framework that analyzes LLM attention patterns to pinpoint which parts of external/tool-provided context are actually driving an agent's tool-calling decisions, helping detect indirect prompt injection and tool poisoning attacks. Since this describes a mitigation technique rather than a new threat, severity is low from a threat standpoint, though the underlying attack classes it addresses (indirect prompt injection, tool poisoning) remain real risks for agentic systems.

Updated Aug 26, 2026

Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.

Updated Aug 26, 2026

AnonyMousKIT is a phishing-as-a-service platform that uses voice AI agents to impersonate Apple support and trick victims into revealing codes needed to unlock stolen iPhones and disable Activation Lock. This is primarily a human-facing social engineering threat that leverages AI voice generation to scale traditional vishing rather than an attack on agent infrastructure or protocols. Severity is high due to real-world financial and privacy harm to victims and the commoditization of AI-driven fraud tooling.

Updated Aug 26, 2026

MCP tools in the sublinear-time-solver and consciousness-explorer packages accept a user-supplied file path parameter and pass it directly to filesystem operations without validating or restricting the destination. This allows any client able to invoke these MCP tools to read, write, or overwrite arbitrary files accessible to the server process, leading to data exposure, tampering, or service disruption. The issue is fixed in later versions of both packages.

Updated Aug 26, 2026 · CVSS 7.1

The genieacs-mcp MCP server, prior to version 0.3.2, exposes an unauthenticated HTTP listener on localhost by default and fails to validate Host/Origin headers, making it vulnerable to DNS rebinding attacks from malicious websites. An attacker who lures a victim to a malicious webpage can pivot through the victim's browser into the local MCP server and issue commands against the GenieACS TR-069 ACS backend, potentially rebooting devices, altering firmware tasks, or changing CPE configuration. This is a genuine, well-documented vulnerability with a clear exploitation path and meaningful impact on managed device fleets.

Updated Aug 26, 2026

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

Updated Aug 26, 2026 · CVSS 7.1

A vulnerability in Amazon Strands Agents Tools' python_repl tool allows attackers to craft prompts that bypass the human-in-the-loop consent gate by forwarding a non_interactive_mode keyword argument through the batch tool. This can lead to arbitrary Python code execution on the agent's host without human approval, effectively defeating a key safety control. Upgrading to version 0.8.5 or later remediates the issue.

Updated Aug 26, 2026 · CVSS 8.1