AI Agent Threats

MLflow versions 3.13.0 through 3.14.x are missing an authorization check on the log-inputs API endpoint, letting any authenticated user inject fabricated dataset lineage records into another user's ML run without holding UPDATE permission. This undermines trust in experiment metadata and lineage tracking, which many AI agent pipelines rely on for provenance and reproducibility, but it does not itself provide remote code execution or full account takeover. The issue is fixed in MLflow 3.15.0.

Updated Aug 18, 2026 · CVSS 6.5

An unauthenticated SSRF vulnerability exists in MLflow's webhook test endpoint that allows attackers to bypass URL validation using HTTP redirects. Attackers can craft a webhook pointing to a benign-looking URL that redirects to internal services or cloud metadata endpoints, then retrieve the response including sensitive credentials. This affects any AI agent or ML pipeline built on vulnerable MLflow versions, exposing cloud infrastructure secrets.

Updated Aug 18, 2026 · CVSS 9.3

MemOS, a memory operating system for LLM agents, contains a critical authentication bypass where an unset internal-service secret causes the system to treat any unauthenticated request as a trusted internal caller with full privileges. This allows remote attackers to mint admin API keys, generate master keys, and access all data and memory endpoints without credentials. The flaw is trivially exploitable and results in complete compromise of the memory layer underlying dependent AI agents.

Updated Aug 18, 2026 · CVSS 9.8

The mcp-florence2 MCP server contains a server-side request forgery vulnerability in its get_images function, allowing a remote attacker to supply a malicious 'src' argument that causes the server to make unauthorized HTTP requests. This could be used to probe internal networks, access cloud metadata endpoints, or interact with internal services reachable by the MCP server. A public exploit exists, increasing the urgency of remediation.

Updated Aug 17, 2026 · CVSS 6.3

This raw data is a blog post by Simon Willison reviewing the Qwen 3.8 27B model, noting that its default 'xhigh' reasoning effort setting causes excessive token usage and long generation times on consumer hardware. This is a usability/performance observation about model configuration defaults, not a security vulnerability, prompt injection, or agent-to-agent threat.

Updated Aug 17, 2026

This is a blog post by Simon Willison describing a personal web tool that renders SVG embedded in Markdown, adds export tabs (PNG/JPEG/MP4), and uses ffmpeg.wasm in the browser to compile animation frames into video. There is no mention of AI agents, prompt injection, tool poisoning, or any inter-agent communication in this content, and no security vulnerability is described.

Updated Aug 17, 2026

mcp-memory-service, a semantic memory backend used by AI agents, exposes all /api/documents/* routes without any authentication check even when an API key or OAuth is configured. This lets an unauthenticated remote attacker read, write, or delete an agent's persistent memory store, enabling memory poisoning and data theft. The flaw is fixed in version 10.67.1.

Updated Aug 16, 2026 · CVSS 9.8

The CKAN MCP Server had a flaw where request parameters were serialized into cache keys using unescaped delimiter characters (&, =, |), allowing different logical queries to produce identical cache keys. An attacker could exploit this collision to poison the shared cache with attacker-controlled data that gets served back to a victim making a distinct, legitimate query.

Updated Aug 15, 2026 · CVSS 6.5

The CKAN MCP Server's data quality tools validate the server_url parameter using a prefix-only regular expression intended to restrict requests to dati.gov.it, but the check can be bypassed with suffix-host or userinfo tricks in the URL. This allows an attacker to redirect the MCP tool's outbound request to an attacker-controlled host and return spoofed data to the agent as if it came from the trusted source.

Updated Aug 15, 2026 · CVSS 5.3

Trigger.dev, a platform for managing AI agent workflows, contains a path traversal vulnerability in its packet/object-store signing logic that lets an authenticated caller with any valid environment API key generate presigned URLs pointing into other tenants' storage. This allows reading or overwriting another tenant's task payloads, breaking tenant isolation. The vendor has fixed this in 4.5.0-rc.5.

Updated Aug 15, 2026 · CVSS 8.2

Trigger.dev's run replay API looks up task runs by a friendly ID without checking that the run belongs to the caller's environment/tenant, allowing any valid API key holder to replay another tenant's agent task run. This lets an attacker consume victim compute resources and repeat side effects of that run, and in combination with a separate object-store path-traversal bug, potentially inject attacker-controlled payload bytes into the victim's replayed task. The issue is fixed in 4.5.0-rc.4.

Updated Aug 15, 2026 · CVSS 4.2

MindsDB Minds Platform (v26.1.0 and earlier) has an unauthenticated remote code execution vulnerability where attackers can configure their own LLM key via an unprotected settings endpoint, then submit a crafted prompt that directs the 'Anton' agent to invoke its scratchpad tool, which calls exec() on attacker-controlled Python code without sandboxing. This grants full OS command execution as the user running the application, exposing SSH keys, credentials, and environment secrets. This is a critical, fully unauthenticated, trivially exploitable vulnerability warranting immediate patching.

Updated Aug 15, 2026 · CVSS 10

The CKAN MCP Server, prior to version 0.4.112, leaks raw upstream response bodies and internal exception details (hostnames, internal IPs, DB errors, stack fragments) to callers when errors occur or when the server is redirected to a non-CKAN host. This is a low-severity information disclosure issue rather than a direct compromise vector, but it can aid reconnaissance for further attacks, especially if combined with SSRF-style redirection. The vendor has already released a fix.

Updated Aug 14, 2026 · CVSS 3.7

The Cortex MCP server incorrectly trusts the CLAUDE_PROJECT_DIR environment variable to identify a legitimate Cortex source checkout, using only two file-presence checks as validation. An attacker who convinces a victim to open a malicious repository as their active project in Claude Code can plant these marker files and cause Cortex's open_visualization tool to execute an arbitrary attacker-controlled Python script with the victim's local user privileges.

Updated Aug 14, 2026

Langflow, an open-source framework used to visually build LLM/agent workflows, contains a flaw allowing unlimited authentication attempts, enabling remote attackers to brute-force user credentials. Given a 9.1 CVSS score, successful exploitation could grant unauthorized access to accounts controlling agent pipelines, connected tools, and stored credentials/secrets.

Updated Aug 14, 2026 · CVSS 9.1

An MCP server (mcp-dominican-layer) exposes a PDF-parsing tool that accepts a remote URL without adequate validation, allowing an attacker to force the server to make arbitrary outbound requests (SSRF). This could be used to probe internal networks, hit cloud metadata endpoints, or interact with internal services reachable from the MCP host. The vendor has not responded to the disclosure and a public exploit exists, increasing near-term risk for any deployment using this component.

Updated Aug 14, 2026 · CVSS 6.3

An MCP server tool called parse-csv accepts a user-supplied URL (csvUrl) and fetches it with axios.get without validating the destination, allowing an attacker to force the server to make requests to arbitrary internal or external endpoints. This is a classic server-side request forgery (SSRF) vulnerability exposed through an agent tool interface, remotely exploitable, with a public exploit and no vendor response yet. Severity is moderate given CVSS 6.3, but the risk is amplified in agent contexts where the MCP server may have network access to internal services, cloud metadata endpoints, or other agents.

Updated Aug 14, 2026 · CVSS 6.3

Trigger.dev, a platform used to build and deploy AI agents and workflows, had a critical authorization flaw where the deployment lookup did not verify that a deployment belonged to the caller's own project. Any authenticated user with a valid API key for one project could reference another project's deployment ID and hijack it by linking an attacker-controlled background worker, altering its deployment state. This allows cross-tenant compromise of AI agent deployments, potentially letting an attacker inject their own worker code into a victim's production agent pipeline.

Updated Aug 14, 2026 · CVSS 9.9

Trigger.dev, a platform for managing AI agent workflows, fails to check Google's email_verified flag during OAuth login, allowing an attacker to create a Google account with an email matching an existing victim's account and take it over. Because Trigger.dev orchestrates AI agent deployments, compromising an account gives an attacker control over that user's agents, workflows, secrets, and API keys. This is a classic identity-spoofing/authentication flaw rather than a novel agentic attack, but it has serious downstream impact on agent supply-chain trust.

Updated Aug 14, 2026 · CVSS 7.4

A vulnerability in Trigger.dev, a platform for orchestrating managed AI agents and workflows, allows any authenticated tenant to pollute Object.prototype in the shared webapp process via a metadata update API. This corrupts database queries and metrics across all tenants and can break worker authentication or crash the process, resulting in a cross-tenant denial-of-service condition. The issue is fixed in version 4.5.6.

Updated Aug 14, 2026 · CVSS 8.5