AI Agent Threats

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other content channels. Using a controlled benchmark of 14,560 executions, researchers found meaningful but bounded attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but not universal susceptibility. The study is defensive/evaluative in nature and provides a methodology and dataset rather than a live threat.

Updated Aug 20, 2026

IBM Langflow versions 1.0.0 through 1.10.0 expose a registration endpoint without proper authentication, allowing a remote attacker to overwrite the administrator's email address and abuse the server to send outbound mail as a relay. Because Langflow is widely used to build and orchestrate LLM agent flows, compromising its admin identity could give an attacker control over flow configuration, credentials, and connected tools.

Updated Aug 20, 2026 · CVSS 7.5

A vulnerability in the Splunk MCP Server app (versions below 1.2.1) allows a user with the admin Splunk role to execute arbitrary operating system commands. The flaw stems from unsafe deserialization of stored credential data without type validation. This gives an already-privileged user a path to full host compromise via the MCP integration layer.

Updated Aug 20, 2026 · CVSS 9.1

A critical vulnerability in the marimo notebook application allows an attacker to achieve arbitrary command execution simply by getting a victim to open a malicious notebook file in edit mode. The malicious payload is hidden inside an MCP server configuration entry and is launched as a subprocess automatically, with no authentication and no need to run any notebook cell.

Updated Aug 20, 2026 · CVSS 8.8

The Splunk AI Toolkit's Agent Run History feature improperly swaps a user's session token for a system-level authentication token when executing searches, letting low-privileged users run searches and access data as if they were admins. This also lets unprivileged users read or delete other users' search jobs. It is a classic broken access control flaw in an AI agent management feature rather than a novel agentic-AI attack technique.

Updated Aug 20, 2026 · CVSS 8.3

Agno's PythonTools contains a path traversal flaw that lets an attacker escape the intended sandboxed base_dir by supplying '../' sequences in file arguments to read_file, save_to_file, or run_python_file. This can be triggered either through direct tool calls or by embedding traversal payloads in content the agent processes (prompt injection), resulting in arbitrary file read, write, or code execution at the privilege level of the agent process. Given the high CVSS score and ease of exploitation, this is a critical, actively exploitable vulnerability rather than a theoretical concern.

Updated Aug 20, 2026 · CVSS 8.8

This is an academic security assessment (not an active exploit) measuring how susceptible the DeepSeek Harness agent is to indirect prompt injection delivered through tool outputs, files, and other untrusted content channels. Using the AI-Infra-Guard testing framework, researchers found measurable but moderate attack success rates (up to ~25.5% for hidden Unicode payloads in file mode), indicating real but partial resistance gaps rather than a fully broken system. The findings are useful for hardening DSH's handling of tool results and untrusted content before it reaches model context or triggers actions.

Updated Aug 19, 2026

This is an academic defensive framework, not an active threat or exploit. PACE proposes a way to cryptographically bind LLM-approved DeFi transaction intents to what actually executes on-chain, mitigating prompt-injection and plan-tampering risks in autonomous trading agents. It reduces risk rather than introducing it; severity is set to low because the raw data describes a mitigation, not a vulnerability being exploited in the wild.

Updated Aug 19, 2026

This is an academic survey (not an active exploit) analyzing how existing agent-security weaknesses become far more dangerous when AI agents use MCP tools and skills to sign and execute transactions on public blockchains. The authors argue that irreversibility, private-key signing authority, autonomous operation, and multi-step transaction composition turn normally recoverable agent failures into permanent financial loss, and find current defenses stop fewer than 30% of attacks. Since this is a research synthesis rather than a disclosed vulnerability or in-the-wild attack, severity is rated medium/informational for defenders rather than critical.

Updated Aug 19, 2026

This is an academic research paper (not an active exploit) introducing a benchmark, MobileWorldSafety, that measures how susceptible LLM-powered Android GUI agents are to environmental/indirect prompt injection embedded in app content. The study found attack success rates of 40.4%-66.9% across six agents, indicating a real and significant class of vulnerability, though the artifact itself is a defensive research tool rather than a live threat.

Updated Aug 19, 2026

A vulnerability in the Apify MCP server allowed a malicious Actor publisher to craft a URL that redirected the MCP client to an attacker-controlled server while the victim's Apify API bearer token was still attached to the request. Simply invoking or inspecting the malicious Actor via the MCP tool-loading paths caused the victim's credentials to be exfiltrated to a third-party host. This is a classic MCP tool-poisoning/SSRF hybrid where untrusted actor metadata influences a trusted connection's destination.

Updated Aug 19, 2026 · CVSS 8.1

Context7 (through version 2.1.2) contains a critical prompt injection vulnerability in its Custom AI Instructions feature, served via its MCP server, that lets attackers plant malicious instructions which connected coding agents automatically execute. During a routine library documentation lookup, an unsuspecting agent can be hijacked to exfiltrate credentials from environment files and delete files on the victim's machine.

Updated Aug 19, 2026 · CVSS 9

ArcadeDB's MCP server tool set_server_setting only checks a global allowAdmin flag rather than the calling user's actual role, allowing any authenticated read-only user to modify server-wide configuration when allowAdmin is enabled. This lets a low-privileged user tamper with GlobalConfiguration or trigger denial of service. The fix in 26.8.1 adds proper per-caller role enforcement.

Updated Aug 18, 2026 · CVSS 6.3

A flaw in the CodeWhale agent framework causes the exec_shell_interact tool to skip the mandatory human-approval step for code execution, defaulting it to auto-approved. This lets attacker-controlled content ingested by the agent (e.g., a malicious web page, MCP tool result, or repo file) inject commands that execute silently inside an already-approved privileged shell session such as sudo, ssh, or a database console. Fixed in version 0.8.64.

Updated Aug 18, 2026 · CVSS 7

CodeWhale's git_show tool passes an LLM-controlled 'rev' parameter directly into git's command line without sanitization, allowing a value like '--output=~/.ssh/authorized_keys' to be interpreted as a git flag rather than a revision. Because the tool is auto-approved and marketed as read-only, a malicious repository combined with prompt injection can trick the agent into silently overwriting sensitive files with attacker-controlled content, effectively achieving persistence or account takeover at the user's privilege level. This is a critical, easily exploitable vulnerability with a working fix already available in version 0.8.64.

Updated Aug 18, 2026 · CVSS 9.3

CodeWhale's rlm_eval tool is misconfigured to always auto-approve code execution, bypassing the user's approval policy entirely. An attacker who can plant instructions in content the agent reads (a webpage, repo file, or MCP tool result) can trigger arbitrary Python execution on the user's machine at the user's privilege level, with no prompt or audit trail. This is a straightforward and highly exploitable prompt-injection-to-RCE chain fixed in version 0.8.64.

Updated Aug 18, 2026 · CVSS 7.8

This is an academic research paper (not an active exploit) empirically studying how the structure of a code workspace -- directory depth, file modularity, injection location, and surrounding context -- affects the success rate of indirect prompt injection attacks against agentic coding assistants. The findings are useful defensively: they show that highly modular codebases and certain security-cue framing reduce attack success, informing how organizations should test and harden coding agents that ingest third-party code.

Updated Aug 18, 2026

This is a defensive research paper describing TwinGridShield, a proposed runtime authorization system that validates LLM-proposed power grid commands against a physical network twin before execution. It is not an active exploit or vulnerability disclosure; it demonstrates a mitigation approach and honestly reports its own limitations under model mismatch conditions. Severity is low because this raw data describes protective research, not a threat.

Updated Aug 18, 2026

This is an academic research paper describing a defensive authorization architecture (Agentic Principal Chain) for multi-agent LLM systems, not an active exploit or newly disclosed vulnerability. It identifies a real architectural weakness class in agent systems—static, per-request permission checks that ignore session history—and proposes and validates a mitigation. No new attack technique, tool, or malicious campaign is disclosed here.

Updated Aug 18, 2026

MLflow's model registry fails to properly validate ownership when creating a model version linked to a run_id or model_id, only checking path containment rather than authorization. This lets any authenticated user reference another user's artifact directory and read private files via the artifact-get API, bypassing READ permission checks.

Updated Aug 18, 2026 · CVSS 7.1