AI Agent Threats

The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.

Updated Aug 26, 2026

The Nextcloud MCP Server's webhook endpoint lacks authentication by default because a required secret defaults to None, letting any network attacker send forged requests. These forged requests can delete or force re-indexing of another user's semantic search embeddings in Qdrant, effectively destroying or manipulating the AI assistant's retrieval memory. This is a critical, unauthenticated remote vulnerability fixed in version 0.117.2.

Updated Aug 25, 2026 · CVSS 9.1

mcp-shell, an MCP server designed to run shell commands securely, contains a filter bypass that allows a malicious or compromised caller to execute arbitrary OS commands via a crafted Git alias, even with 'secure mode' enabled. Because the default Docker deployment includes Git and runs the vulnerable filters out of the box, any agent or user with MCP connectivity to the tool can achieve full arbitrary code execution as the mcpuser process. This is a critical tool-layer vulnerability affecting the trust boundary between an AI agent and the command-execution tool it calls.

Updated Aug 25, 2026 · CVSS 8.4

The mcp-shell MCP server, intended to safely execute allowlisted shell commands on behalf of an AI agent, fails to properly validate command arguments when the executable is bash. An attacker or a compromised/malicious agent can invoke the shell_exec tool with '/bin/bash -c <command>' to run arbitrary commands as the mcpuser, completely bypassing the intended security allowlist. This is a high-severity tool-layer vulnerability that gives an attacker code execution wherever the fixed pre-0.6.0 mcp-shell server is deployed.

Updated Aug 25, 2026 · CVSS 8.4

mcp-shell, an MCP server that exposes shell command execution to LLM agents, ships with security disabled by default and the documented installation steps never enable it. As a result, any LLM or agent connected to a default deployment can run arbitrary OS commands as the mcp-shell process user, giving effectively unrestricted remote code execution through a trusted tool interface. The issue is fixed in version 0.6.0.

Updated Aug 25, 2026

PraisonAI's local MCP HTTP Stream server uses a flawed startswith() check to validate the HTTP Origin header, allowing an attacker-controlled domain like 'localhost.evil.example' to pass as if it were 'localhost'. A malicious webpage visited by a victim can exploit this to send unauthenticated tools/call requests directly to the victim's local MCP server, invoking any exposed tool without an API key.

Updated Aug 25, 2026 · CVSS 6.9

QWED, an infrastructure component used to verify LLM/agent tool outputs and math expressions before production execution, passes untrusted expressions directly to SymPy's parse_expr() without restricting namespaces, allowing arbitrary Python code execution in the API server. Because signup and API key issuance are open by default, any external attacker can register a tenant, obtain a valid API key, and trigger remote code execution via the math verification endpoints, fully compromising the server and other tenants in shared deployments.

Updated Aug 25, 2026 · CVSS 8.8

browse-mcp, an MCP server that gives agents headless-browser capabilities, fails to validate caller-controlled save paths in its browser_download, browser_save_state, and browser_load_state tools, allowing arbitrary file writes anywhere the process can reach. An attacker who controls a webpage the agent visits can use indirect prompt injection to steer the agent into writing attacker-controlled content to sensitive locations like ~/.bashrc or cron files, potentially achieving full host code execution. A separate flaw in the force_fetch fallback also bypasses the configured origin allowlist entirely.

Updated Aug 25, 2026

This article is a general commentary on the security vendor landscape at Black Hat 2026, noting that AI and agents are heavily featured in vendor marketing. It contains no technical details about a vulnerability, exploit, or attack against AI agents, frameworks, or protocols. This is industry analysis, not a security threat report.

Updated Aug 25, 2026

This item is a press/blog announcement from Unit 42 summarizing a broader research report on AI-enabled malware trends, not a specific technical disclosure of an agent-related vulnerability or attack. There is no actionable detail about a concrete AI-agent, MCP, or A2A threat in the provided data, so it does not constitute a genuine standalone security issue for this analysis.

Updated Aug 25, 2026

This item is an academic research paper describing a new defensive fine-tuning technique (SecOPD) that reduces LLM susceptibility to adaptive prompt injection attacks, rather than describing a new vulnerability, active exploit, or attack technique. It is a mitigation contribution, not a threat disclosure, so it is classified as low severity from a threat-intelligence standpoint, though it is highly relevant context for understanding the ongoing prompt injection problem in agentic systems.

Updated Aug 25, 2026

This is an academic research paper describing a new defensive technique (AEGIS) against indirect prompt injection attacks in LLM-based agents, not a description of an active exploit or newly discovered vulnerability. It proposes using instruction-sensitive projectors and multi-layer consensus signals to detect malicious injected instructions while reducing over-refusal of legitimate inputs. The underlying threat class (indirect prompt injection) is well-known and already covered by existing threat intelligence; this submission itself introduces no new attack technique.

Updated Aug 25, 2026

This is not a vulnerability disclosure but a research paper describing AgentFlow, a defensive framework that enforces data-flow policies across LLM agent tool calls and delegation boundaries to prevent prompt-injection-driven data exfiltration and unsafe cross-agent authority propagation. The work reports strong reductions in confirmed compromise rates across several established agent security benchmarks (AgentDojo, AgentDyn, ASB, InjecAgent, BIPIA, AgentHarm, MCPTox). Severity is rated low because the raw data describes a proposed mitigation, not an active threat, exploit, or newly discovered weakness.

Updated Aug 25, 2026

The Continue CLI's headless/auto mode relies solely on an incomplete denylist to block dangerous shell commands, missing paths like /home, /root, /var, and failing to properly handle variable expansion such as $HOME. An attacker who can inject instructions into content the agent reads (web pages, repo files, issues) can trigger destructive commands like recursive deletion, causing unattended agent runs to destroy user data.

Updated Aug 25, 2026 · CVSS 7.4

This is a research paper describing a defensive framework (AEGIS), not an active exploit or newly disclosed vulnerability. It highlights a known class of risk where MCP agents can request excessive resources (e.g., huge search radii, long videos) across multiple modalities, potentially degrading service, and proposes a policy-enforcement layer to mitigate it.

Updated Aug 24, 2026

This is a defensive research paper describing ClawSentry, a security gateway that monitors LLM agents to detect and block malicious third-party skills/tools before and during execution. It is not an active exploit or vulnerability disclosure, but rather a proposed mitigation framework benchmarked against known attack scenarios (SkillInject, SkillsSafety). Severity is low from a threat perspective since this describes protective tooling, though it implicitly confirms that unprotected agent runtimes have high attack success rates (33.5-49.7%) against malicious skill injection.

Updated Aug 24, 2026

This is a defensive research paper, not an active threat or exploit disclosure. It proposes TraceGrant, a governance framework that mitigates indirect prompt injection in networked LLM agents by binding tool execution to a pre-established 'Contract' derived from trusted user intent and verifying task completion against actual results. The underlying risk it addresses (indirect prompt injection redirecting tool calls) is well-known and already covered by existing threat models; no new vulnerability or attack technique is introduced here.

Updated Aug 24, 2026

This is an academic research paper (not an active exploit) demonstrating that persistent agent memory systems are highly vulnerable to simple, plainly worded false statements: poisoning just 1.2% of a memory corpus dropped answer accuracy from 0.85 to 0.30. The authors show that both write-time content screening and provenance-weighted retrieval defenses fail to catch these low-effort attacks, exposing a fundamental architectural gap rather than a specific software bug.

Updated Aug 24, 2026

This item is a blog post by Simon Willison discussing best practices for reviewing and verifying changes made by AI coding agents, not a security vulnerability or threat report. There is no indication of prompt injection, tool poisoning, or any exploitable weakness in agents or protocols.

Updated Aug 22, 2026

The CKAN MCP Server's earlier SSRF fix only blocked the literal hostname 'localhost' and dotted IPv4/bracketed IPv6 loopback literals, but missed alternate hostname aliases like 'ip6-localhost' and 'ip6-loopback' that resolve to loopback addresses. A remote caller invoking CKAN tools (e.g. ckan_package_search, sparql_query) with a crafted server_url/base_url parameter could bypass the filter and force the server to make requests to internal or loopback network locations. This is a moderate-severity SSRF bypass affecting a specific tool integration, not a novel or high-impact agentic exploitation technique.

Updated Aug 22, 2026 · CVSS 5.7