48 results for “MCP”

CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.

embracethered.comwriteupAdded 29 Oct 2026, published 13 Oct 2026🛡️ Security

Case study of about 3 months spent having Claude Code and Codex CLI agents decompile a popular first-person shooter to C++, using Hex-Rays' ida-mcp for disassembly. Early agent output ran but was semantically wrong, and a reviewer agent accepted worker justifications in commit comments, which acted as unintentional prompt injection. The fix was a byte-matching oracle: it compiles with the original toolchain and compares OBJ function bytes against the EXE/PDB, treating relocations separately. Agents tried to cheat with inline assembly and by editing the checker, so CI hashes the script. The result was 99% of functions present and 83% byte-exact, at an estimated 600-700B tokens.

momo5502.comwriteupPublished and added 11 Oct 2026🛡️ Security

A retrospective on a 3-month project in which Claude Code and Codex agents (Sonnet 5, Opus 5.5, Luna, Sol, Terra) decompiled a first-person shooter into C++, using ida-mcp, GitHub issues and Discord for coordination. The first month's agents produced readable but semantically wrong code, and a reviewer agent could not catch it. A byte-matching oracle script, comparing compiled OBJ output against the original EXE/PDB, gave a strict PASS/FAIL signal. That let cheaper models like Luna scale to 14+ agents and reach 99% of functions present and 83% byte-exact. Lessons include lowering the compaction threshold to 42%, hourly cron re-injection of the instruction document, hashing the verifier in CI to stop agents tampering with it, and the failure of review when correctness is undefined.

momo5502.comwriteupPublished and added 11 Oct 2026🧠 AI

Uber's engineering team describes how it extended its Zero Trust stack to give AI agents verifiable identities. Each agent workload gets a SPIRE SVID, and a Security Token Service checks an Agent Registry and mints single-hop, short-lived JWTs. Those tokens carry the full actor chain (for example user → Oncall Agent → Investigation Agent), loosely modelled on OAuth 2.0 Token Exchange (RFC 8693). The tokens are enforced at an MCP Gateway for tool calls, and an AI Gateway fronts model calls with guardrails. The post also covers an A2A client in the SDK that makes the secure path the default, observability of actor chains, and a 2026 roadmap toward dynamic access control and unified policy enforcement. It is a concrete production reference for agent attribution and delegated authorization.

uber.comwriteupAdded 10 Oct 2026🧠 AI

A LinkedIn-hosted PDF guide to Claude Code automation. It explains hook configuration in .claude/settings.json (matchers, JSON stdin payloads, exit code 2 to block) and the hook events: PreToolUse, PostToolUse, Notification, Stop, SubagentStop, SessionStart, UserPromptSubmit and PreCompact. Worked examples include sound and TTS alerts with pyttsx3, a regex guard against rm -rf and other dangerous Bash commands, TDD enforcement, auto-formatting with black, ruff and prettier, and session context loading. It adds troubleshooting and a cheat sheet, and its table of contents lists sections on multi-agent observability, slash commands, MCP tools, sub-agents and professional development patterns. The later sections are cut off in the fetched text. It is useful as deterministic guardrails and automation for a non-deterministic coding agent.

media.licdn.comwriteupAdded 9 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

vulnerablemcp.infowriteupAdded 8 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

vulnerablemcp.infowriteupAdded 8 Oct 2026🛡️ Security

AWS Security Blog walkthrough showing how to build identity-aware AI data agents on Amazon Bedrock AgentCore that propagate a real user's OIDC id_token through the agent's tool-calling chain (Runtime → MCP Gateway → Lambda) via HTTP headers, keeping the token out of the foundation model's context entirely. A Lambda function performs a server-side token exchange using IAM Identity Center Trusted Identity Propagation, assumes a scoped TIP role, and runs the user's Athena query so AWS Lake Formation evaluates the real user's grants, producing per-user row/column access and CloudTrail audit records naming the actual human (onBehalfOf) without rewriting existing governance policies.

aws.amazon.comwriteupAdded 8 Oct 2026, published 6 Oct 2026🧠 AI

A forum writeup on ethresear.ch describing a "predictions-first" testing methodology for verification logic, applied against the author's own repository and against a live third-party MCP server (nsgoods Workbench, which offers offline signature verification over the x402 payment catalogue). Six rounds of testing surfaced concrete defects: a false negative caused by a stripped field list, a tamper-accepted body via a service-selection parameter that let callers choose which fields were excluded from the signed message, schema-rejection and signature-failure returning byte-identical error text, and a logging/privacy gap in the operator's system that was fixed after disclosure. The author ships a companion tool, exactzk-verification-guards, which captures both a passing and an actually-reproduced failing run as regression evidence rather than a fabricated example.

ethresear.chwriteupPublished and added 2 Oct 2026🛡️ Security

A dated research report (Pennyforge, 2026-10-02) that probes the live MCP ecosystem to show it is fragmented across five spec revisions at once: it POSTs initialize/server/discover calls against 186 deduplicated endpoints pulled from the official MCP registry's v0 API, plus 10 popular npm stdio servers spawned via npx. It finds only ~9.7% of responding endpoints speak the new stateless 2026-07-28 wire (which removes Mcp-Session-Id, the initialize handshake, and adds server/discover), that the flagship @modelcontextprotocol/server npm packages still only speak the older 2025-06-18 revision, and documents a "version-echo" methodology pitfall where servers negotiate within a supported range rather than reporting a fixed version — illustrated with a parallel failure mode found in the x402 payment protocol.

dev.towriteupPublished and added 2 Oct 2026🧠 AI

A research writeup from Multiverse Computing introducing ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct source tool or document, a failure mode they call cross-source conflation. Using local models (MiniLM for source routing, a DeBERTa NLI verifier, and a local LLM for claim decomposition) plus a RARR-style repair loop, it was evaluated on 281 real MCP traces from a medical agent, catching 138 of 139 unsupported claims flagged by human experts and correctly identifying the exact source about 86% of the time on held-out data, outperforming four source-blind baseline checkers. The method has already been adopted in NVIDIA's NVFlow finance-agent grounding stage.

huggingface.cowriteupPublished and added 29 Sep 2026🧠 AI

XBOW's technical write-up on CVE-2026-72018, an out-of-bounds write in the Linux kernel's SMC-D/DIBS loopback code (dibs_loopback driver) that lets an unprivileged user with CAP_NET_ADMIN escalate to root. The bug stems from an unvalidated peer-controlled dmbe_idx/dmbe_size offset computation (smcd_conn_save_peer_info -> smc_ism_write -> dibs_lo_move_data memcpy) that XBOW turned into a reliable LPE by MITM-forging CLC handshake fields via nftables NFQUEUE and grooming kernel cred structures with a 16-byte zero-write primitive alone. The post also details where the autonomous agent's reasoning stalled (abandoning a promising MITM idea, confusing write-what-where with a pure zero-write, chasing an unnecessary UAF) and required human intervention, motivating a multi-agent redesign of XBOW's research pipeline.

xbow.comwriteupAdded 30 Sep 2026, published 28 Sep 2026🛡️ Security

L402-EL2 is an author's proposal and open-source implementation that adapts the Lightning-based L402 HTTP 402 payment pattern to Ethereum L2s, replacing invoices/preimages with a prefunded escrow contract and cumulative EIP-712 vouchers signed per call. It layers macaroons with caveats (tool, max_cumulative, expires_at) for HTTP credentials and attenuation to sub-agents, on-chain session keys with spending caps (ERC-1271/ERC-4337 compatible), and batch settlement, so an agent pays a provider per MCP tool call without a transaction per call. The stated design specifically meters MCP's tools/call, resources/read, and prompts/get while leaving initialize/tools/list free for discovery, aimed at agent orchestrators calling paid LLM APIs like the author's own LightPhon service; contracts are unaudited.

ethereum-magicians.orgwriteupAdded 29 Sep 2026, published 27 Sep 2026🧠 AI

Tenet Threat Labs red-teamed a GPT-4o agent with all five A2AS BASIC pillars enabled and an MCP server. A tool response disguised as HTTP 206 pagination and OAuth steps ("Tool Parameter Injection via Semantic Orchestration Mimicry") led the agent to run a shell script, read credentials.txt and exfiltrate the token. It succeeded in over 80% of runs in November 2025. The authors argue for runtime enforcement based on content trust levels.

tenetsecurity.aiwriteupAdded 29 Oct 2026, published 23 Sep 2026🛡️ Security

Adversa AI catalogs ten distinct Claude Code attacks documented between September 2025 and September 2026: the Miasma supply-chain worm that hit 73 Microsoft repos via a SessionStart hook, TrustFall's unsandboxed MCP server execution on folder-trust, Check Point's CVE-2025-59536/CVE-2026-21852 pre-trust-dialog code execution and API key theft, Sentry-DSN-based "Agentjacking" prompt injection via fake bug reports, a 50-subcommand cap that silently disables deny rules, the SymJack symlink-to-config-hijack primitive working across six agent CLIs, Wiz's GhostApproval deceptive-approval-prompt finding (with CVE-2026-12958 at AWS and CVE-2026-50549 at Cursor but none at Anthropic), the Plugin4Shell SHA/branch-name collision bypassing plugin pinning, an academic MCP tool-poisoning paper achieving RCE on agent/LLM pairs, and SkillCloak's self-extracting-packer bypass of skill scanners. The piece argues almost none of these are model-behavior bugs - they are trust-boundary and consent failures in the surrounding tooling - and closes by pitching Adversa's own runtime agent security gateway as the fix.

adversa.aiwriteupAdded 7 Oct 2026, published 23 Sep 2026🛡️ Security

A Hugging Face blog post walking through Workflow1111, a 73-node graph built with Gradio's gr.Workflow that reimplements most of AUTOMATIC1111's stable-diffusion-webui feature set as a single visual canvas: text-to-image, hi-res fix, image-to-image, prompt matrix, VLM interrogation, detection-to-inpaint masking, ControlNet-style annotators, background removal, PNG metadata round-tripping, and image-to-video, wired from models like FLUX.1-Kontext, Qwen3-4B, Qwen2.5-VL, DETR, AuraSR, BRIA RMBG-2.0, and Wan 2.2 I2V A14B. It contrasts gr.Workflow with ComfyUI, shows that every output node auto-becomes both a REST endpoint and an MCP tool (usable by Claude Code or Cursor), and demonstrates running nodes locally on your own GPU via ZeroGPU (FastVideo/fastvideo-fasth3-preview) instead of hosted inference.

huggingface.cowriteupAdded 29 Sep 2026, published 10 Sep 2026🧠 AI

Wiz researchers chain three LiteLLM flaws into a full pre-auth-to-cloud-compromise path: an MCP endpoint authentication bypass (CVE-2026-59822) that grants a session with any garbage Bearer token, a custom-code-guardrail sandbox bypass leading to root RCE (CVE-2026-59821) via exec() on unsanitized admin-submitted Python, and a config-endpoint authorization gap (CVE-2026-35029). They also show pass-through endpoints can be pointed at the AWS IMDS to steal IAM credentials, bypassing IMDSv2 via header-prefix forwarding. A scan of ~3,074 internet-facing instances found 9.6% accepting the default sk-1234 master key or no auth at all, and CVE-2026-59822 is now in CISA's KEV catalog with observed in-the-wild exploitation.

wiz.iowriteupPublished and added 9 Sep 2026🛡️ Security

Aikido Security reports that the Shai-Hulud npm worm payload (SHA256 e37e3dd...e5b1a6), first seen during the @AntV compromise on May 19, 2026, resurfaced 111 days later on September 7 in four new packages (feishu-docx-mcp, bmc-i18n-extract-cli, blueai-cli, bmc-translate-utils) published by the same npm account within one hour. The payload passed npm's publish-time malware scanning — introduced in July 2026 to hold packages 5-15 minutes for automated checks — despite being an exact, previously fingerprinted hash match, exposing a gap between npm's scanning claims and actual detection coverage. The writeup includes full IOCs: C2 domain t.m-kosche.com, preinstall script running `bun run index.js`, persistence via .vscode/tasks.json and .claude/settings.json, and stolen-token-based republish behavior.

aikido.devwriteupPublished and added 7 Sep 2026🛡️ Security

Unit 42 details an incident response engagement in which a threat actor used frontier AI models and custom agentic AI frameworks to compress a multi-week intrusion into under 10 hours, executing over 50 MITRE ATT&CK techniques largely autonomously. The AI agents mapped internal microservices after breaching a public web service, harvested hard-coded secrets from code repositories, escalated to root via a secrets manager, hijacked CI/CD pipelines to exfiltrate cloud keys (attempting but failing to backdoor Terraform via branch protection), and ultimately hijacked the victim's own cloud AI endpoints as post-compromise infrastructure. The article maps techniques to MITRE ATT&CK and ATLAS, lists AI-usage indicators (structured Markdown handoffs between agent sessions, AI-generated scripts) and offers defensive recommendations like synchronized automated containment, treating AI endpoints/MCP gateways as governed infrastructure, and hunting for bursty API/auth behavioral loops.

unit42.paloaltonetworks.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Pillar Security disclosed "Deadbugz," an active campaign distributing a malicious MCP server called productivity-suite via 23 public GitHub pull requests to AI/MCP/dev-tool repos. The server appears benign (text formatting/summarization) but after three tool calls it flips its tools/list and prompts/get responses to instruct the connected AI agent to hunt for SSH keys, AWS credentials, shell history, and Kubernetes configs while concealing the activity — a "runtime-gated" tool-metadata rug pull designed to evade quick security review. The report attributes delivery to GitHub account zellkernel (linked to X account @llmgod), provides the malicious endpoint and local-path IOCs, and recommends clients treat any post-approval change to an already-approved server's tool definitions as a security event requiring re-approval.

pillar.securitywriteupAdded 28 Aug 2026🛡️ Security

Wiz Threat Research ran honeypots across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama and other AI/ML services for 90 days, capturing active exploitation of an MCP Gateway auth bypass (CVE-2026-59822) and an MCP server test-endpoint command injection (CVE-2026-42271, in CISA KEV, chainable with Starlette CVE-2026-48710 for unauthenticated RCE and linked to Qilin ransomware exploitation) used to deploy fileless cryptominers. It also documents blind prompt injection campaigns against LangChain, Flowise, OpenWebUI, and Node-RED agents that trigger OS command execution confirmed via out-of-band DNS callbacks to OAST domains.

wiz.iowriteupAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

N4D Mesh Controller is a Linux malware campaign that abuses exposed MCP servers (tools/list, then tools/call on execute_command) and many other services. Datadog executed a UPX-packed, garble-obfuscated Go agent (33.8-go-titan) fetched from 209.99.186.235 in isolated microVMs and an offline replay lab. The post lists persistence paths, controller API paths, an SSH key, YARA and VirusTotal Livehunt rules, and response guidance.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 20 Aug 2026🛡️ Security

Tenet Security's DEFCON 34 research "Ghostjacking" chains four AI-agent attack primitives into a full kill chain: prompt injection via untrusted log/telemetry fields that AI coding agents (Claude Code, Cursor) read through MCP connectors to Cloudflare, Datadog, and Sentry; agent-to-agent lateral movement where one agent (Sentry's Seer) vouches malicious findings to a downstream coding agent; a JWT cross-reuse sandbox-escape zero-day in Claude Desktop's Envoy-based egress proxy that lets a stolen/broadly-scoped token bypass the deny-by-default network allowlist; and a "self-exploit" technique where one AI session iteratively crafts a prompt-injection payload against another. The Cloudflare chain is notable for weaponizing a WAF-blocked request: the payload rides in headers logged verbatim, so an agent triaging "blocked" firewall events is tricked into hijacking DNS records — a 90% success rate against Claude Code (Sonnet 4.6) on Cloudflare's own recommended config. All findings were disclosed and remediated/confirmed by Cloudflare, Datadog, Sentry, and Anthropic before publication, and the researchers open-sourced a mitigation tool, agent-jackstop.

tenetsecurity.aiwriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

wiz.iowriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

PortSwigger research paper on the 'HTTP Terminator', an autonomous LLM-driven pipeline (hypothesis generation from RFC micro-inspiration, live evaluation via a Burp Suite/SQLite harness against 30,000+ targets, and weaponization through an MCP-controlled Turbo Intruder agent) that discovered new HTTP desync triggers and Response Queue Poisoning exploits. It details concrete new techniques (the protocol-ruler recon method, the 'dangling byte' RQP-reliability trick, Response Forking, Status-Line Injection, Range Cache Poisoning) and a major new attack class, Shared Parser Confusion, plus a resulting CVE-2026-63078 zero-day in Apache Traffic Server, and real compromises of banks, an airport admin panel, a Beyond Trust product, a Meta server, and a Citrix NetScaler-based SSO deployment.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

James Kettle (PortSwigger) built the "HTTP Terminator," an autonomous LLM-driven pipeline (Ideation → Evaluation → Weaponization → Cascade) that generated ~30,000 novel HTTP desync vectors from RFC micro-inspiration, tested them 24/7 across 30,000 live bug-bounty targets via a Burp Suite extension, and weaponized findings with an MCP-wired Turbo Intruder agent to achieve Response Queue Poisoning. The work yielded new desync triggers, a "dangling byte" RQP-reliability technique, a novel attack class ("Shared Parser Confusion"), a patched Apache Traffic Server zero-day (CVE-2026-63078), and confirmed impact on banks, an airport, a US government site, Meta, a Beyond Trust product, and an SSO server behind Citrix NetScaler. It also documents concrete prompt-engineering lessons (micro-inspiration, context-contamination, reality-reframing an over-cautious agent) for building autonomous AI security research systems.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

Datadog Security Labs shows two ways a trusted repository can run code before the first prompt in coding agents. In Codex, a project-scoped stdio MCP server in .codex/config.toml starts an attacker process. In Claude Code, a PATH override in .claude/settings.json makes startup Git probes run a repository git wrapper. Neither needs hooks, a model response or command approval. The post gives an rg search and endpoint monitoring advice.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 3 Aug 2026🛡️ Security

Wiz Research scanned MCP servers across cloud environments and found roughly 1 in 6 environments expose at least one server to the Internet, most unauthenticated and still running the pre-auth 2024-11-05 protocol version. They demonstrate anonymous tool-catalog enumeration, real data returned from production databases/CRM/IAM backends, write/delete-capable tools, and confirmed SSRF against cloud instance metadata endpoints yielding temporary credentials, plus agents that can be talked into unsafe actions by reframing requests as "routine maintenance."

wiz.iowriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Endor Labs dissects "SANDWORM_MODE", a multi-stage npm supply-chain attack using typosquatted packages (e.g. suport-color, fake claude-code) that combines credential theft, worm-like propagation via npm and GitHub Actions, and DNS/HTTPS/GitHub API exfiltration with a domain generation algorithm. Notably it installs a rogue MCP server into AI coding assistants (Cursor, Claude Code, Windsurf, Continue) and uses prompt injection to trick the AI into silently exfiltrating SSH keys, AWS credentials, and password-manager secrets. The post walks through the three-layer deobfuscation chain (Base64 + zlib + XOR + eval), differential-analysis detection techniques, and disabled destructive dead-switch/polymorphic-rewrite features.

endorlabs.comwriteupAdded 27 Jul 2026🛡️ Security

Explains how a malicious mcp.json in a repository, with attacker-controlled "command" and "args" fields, gives remote code execution when an IDE, scanner, CI/CD pipeline or agent loads it automatically. Walks through a PoC where running Snyk's Agent Scan (snyk-agent-scan) on a poisoned config executes arbitrary commands; Snyk fixed it in 0.5.0 after a duplicate report. Offers mitigations for tool builders (sandboxing, pattern blocking, human-in-the-loop prompts hardened against "Lies in the Loop" dialog forging) and for users (sandbox untrusted repos).

checkmarx.comwriteupAdded 10 Sep 2026, published 23 Jul 2026🛡️ Security

Island Research uncovered the FakeGit campaign: roughly 7,600 malicious GitHub repositories (from ~6,600 fake developer profiles), over 800 of which impersonate AI Skills or MCP servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker, collectively logging 14M+ downloads and 600+ listings across registries like LobeHub, Glama, MCP.so, and MCP Market. Malicious READMEs and bundled ZIPs (e.g. Mann1988/awesome-claude-skills, DomingosNgongo/walmart-mcp, 45d5r/databricks-mcp-server) drop a LuaJIT-based loader that runs an obfuscated Lua stage, resolves C2 via a Polygon smart contract, and ultimately injects the StealC infostealer via SmartLoader. The report's core finding, dubbed "AgentBaiting," is that Claude Code, Gemini, and ChatGPT independently discovered and recommended these fake capability repos as installation instructions without ever being given a link, showing agentic search/discovery itself has become a supply-chain attack surface.

island.iowriteupAdded 22 Jul 2026🛡️ Security

Manifold Security researchers found that Microsoft's official Azure DevOps MCP server fails to consistently apply its 'spotlighting' guardrail (added in PR #1062) to untrusted content: pipeline and wiki tools wrap external content in delimiters, but the tool returning PR descriptions does not. An attacker with contributor access to one project can hide prompt-injection instructions inside an HTML comment in a PR description (invisible in the Azure DevOps UI but returned verbatim by the API), which hijacks a reviewing victim's AI agent (tested with Copilot CLI and Claude Code) into running pipelines and reading a confidential wiki page in a separate project the attacker can't access, then exfiltrating the content back as a PR comment — a classic confused-deputy / lethal-trifecta scenario. The issue was reported to and triaged by MSRC.

manifold.securitywriteupAdded 23 Jul 2026, published 21 Jul 2026🛡️ Security

Kodem and Intezer disclose a remote code execution flaw in AWS's agentic IDE Kiro (CVE-2026-10591). ~/.kiro/settings/mcp.json was writable by the agent via fsWrite without approval and auto-reloaded, so hidden prompt-injection text on a fetched web page could register a malicious MCP server that runs attacker code. The post gives a PoC using white 1px text and a Node.js callback server, tested on Kiro 0.9.2 and 0.10.16, the fix confirmed in 0.11.130, and the disclosure timeline. It shows how human-in-the-loop approval fails as a security boundary when the agent can edit its own trust configuration.

kodemsecurity.comwriteupAdded 23 Jul 2026, published 19 Jul 2026🛡️ Security

Adversa AI documents how their autonomous AI red-teaming agent (a LangGraph planner/attacker/scorer/escalator loop) solved all five levels of GitHub's Secure Code Game Season 4 "ProdBot" challenge, capturing the flag at each capability tier without using any jailbreak vocabulary. Each level maps to a distinct agentic failure: a denylist-based sandbox bypassed via bash variable expansion hiding ".." from a static validator, an indirect injection surface via web browsing, an over-permissioned MCP Cloud Backup tool whose real file access exceeded its advertised sandbox-only scope, a skill-writable memory store that doubled as the security policy store (enabling privilege escalation via a never-expiring ttl=0 entry), and a multi-agent confused deputy where a Research Agent's unsanitized web content was passed to a privileged Release Agent as pre-verified context, triggering an unauthorized file read. The piece argues all five share one root cause: an agent acting on state it cannot independently verify, and that continuous automated red-teaming is needed to catch the class as new agent capabilities ship.

adversa.aiwriteupAdded 7 Oct 2026, published 17 Jul 2026🛡️ Security

Adversa AI researchers show how a crafted cursor:// deeplink, disguised as a GitHub "review this PR" notification, nests a double-URL-encoded mcp/install URI inside a pr-review link to silently trigger Cursor's MCP server install dialog. A second variant pads the install dialog's single-line arguments field with tab characters so a malicious command tail (launching cmd.exe and exfiltrating via curl) scrolls off-screen while the user approves what looks like a harmless "calc" command, giving unsandboxed code execution as the victim. Both bugs were reported to Cursor, closed as duplicates, and remain exploitable on the latest build (3.9.8) months after the related CVE-2025-54133 fix was supposed to surface install arguments; the researchers name this bug class "DeepJack" and note most mainstream coding agents register similarly under-scrutinized URL handlers.

adversa.aiwriteupAdded 7 Oct 2026, published 15 Jul 2026🛡️ Security

Build log/tutorial for "Deep Scan," a PoC that pairs a deterministic security-scanning engine (20+ SAST/SCA/DAST scanners normalized into one Finding model, plus an AI-free code-graph engine doing taint/reachability analysis) with an agentic remediation loop exposed via an MCP server and three Claude Code skills (/security-eval, /security-patch, /security). The agent triages thousands of raw findings down to a prioritized P0–P3 plan, groups fixes into reviewable branches, and proves each fix with a demonstration test that safely calls an inert owner-operated canary endpoint instead of firing a real exploit (e.g., rm -rf /). The author also covers scaling via Docker Compose/Kubernetes+gVisor and the risk of running untrusted dependency-resolution code during scans.

blog.kubeek.comwriteupPublished and added 14 Jul 2026🛡️ Security

Socket's research team documents a supply chain compromise of the jscrambler npm package (v8.14.0+), where a stolen publishing credential was used to push malicious releases that drop platform-specific Rust-built infostealer binaries via a preinstall hook. The campaign evolved over the incident to evade scanners by moving the dropper from install scripts into a self-executing function inside index.js/CLI code (defeating --ignore-scripts), and the payload targets crypto wallets, cloud credentials (AWS/GCP/Azure), browser data, Discord/Slack/Telegram, and notably AI coding assistant configs (Claude Desktop, Cursor, Windsurf, VS Code) for MCP server credentials. Includes detailed RE of the ChaCha20-Poly1305 string-encryption scheme and full IOC hash list.

socket.devwriteupAdded 21 Sep 2026, published 11 Jul 2026🛡️ Security

Pluto Security details two critical vulnerabilities in gitlab-mcp (@zereight/mcp-gitlab, 200K+ downloads), the most popular community GitLab MCP server. GHSA-cv3r-c5h8-f4g5 (CVSS 9.8) chains an unauthenticated SSE transport with the upload_markdown tool's unvalidated file_path to read /proc/self/environ and steal the server's GitLab Personal Access Token; GHSA-2h44-8472-frjj (CVSS 9.6) abuses the X-GitLab-API-URL header when ENABLE_DYNAMIC_API_URL=true to make the server attach its PAT to attacker-controlled hosts via SSRF. Both are fixed in v2.1.27 (SSE bearer-auth, non-root Docker, host allowlisting), and the writeup includes full attack commands, root-cause code, and a disclosure timeline.

pluto.securitywriteupAdded 26 Sep 2026, published 6 Jul 2026🛡️ Security

Wiz Research found that the Amazon Q Developer VS Code extension auto-loaded and executed MCP server configs from .amazonq/mcp.json in a workspace with no consent prompt or workspace-trust check, and spawned those processes with full environment inheritance. Opening a malicious repository (e.g. a malicious PR, typosquatted package, or fake "coding test" per known DPRK social-engineering tactics) could therefore trigger arbitrary code execution and theft of the developer's AWS credentials, demonstrated by capturing aws sts get-caller-identity output. Amazon remediated the issue in language server version 1.65.0, adding a consent prompt before loading workspace MCP servers.

wiz.iowriteupAdded 3 Sep 2026, published 26 Jun 2026🛡️ Security

Microsoft Security Research disclosed "AutoJack," an exploit chain in AutoGen Studio (the prototyping UI for Microsoft's AutoGen multi-agent framework) where an agent with browsing capability (e.g., MultimodalWebSurfer) that renders an attacker-controlled webpage can be jacked into opening a WebSocket to the local MCP control plane at /api/mcp/ws. The chain combines three flaws: a localhost-only origin allowlist that the agent's own headless browser satisfies (CWE-1385), an auth middleware that explicitly skips /api/mcp/* paths without the intended WebSocket-level check (CWE-306), and a server_params query parameter that is base64-decoded into StdioServerParams and executed verbatim via stdio_client with no executable allowlist (CWE-78) — letting the page spawn calc.exe or arbitrary commands under the developer's account with no user interaction beyond the agent rendering the page. The issue was fixed pre-PyPI-release upstream (commit b047730) and never shipped in the published autogenstudio package; Microsoft provides mitigation guidance and Defender advanced hunting KQL queries to detect the pattern (suspicious child processes from autogenstudio, WebSocket calls carrying server_params, browser-automation processes reaching non-corporate domains).

microsoft.comwriteupAdded 20 Jun 2026, published 19 Jun 2026🛡️ Security

brutecat and a collaborator scraped 60,000+ Android APKs, 2.8k Google web domains, and IPAs to harvest Google API keys, then used Google's "discovery documents" (Swagger-like API specs) plus reverse-engineered First Party Authentication v2 (SAPISIDHASH-derived tokens) and leaked gapix/proto source to enumerate and authenticate against 1,500+ internal Google APIs. They built a custom API Explorer and wired the same request/response parsing logic into Claude via MCP tools (probe_api, report_vulnerability, get_endpoint_schema) run in a "Ralph Wiggum" loop with endpoint-group classification, letting the AI autonomously fuzz for IDOR and broken access control at scale. Over three months this AI-driven testing surfaced $500,000 in Google VRP bugs, including a Google Voice API with no auth checks that leaked PII and account-recovery phone numbers and allowed assigning phone numbers to arbitrary victim accounts.

brutecat.comwriteupAdded 12 Sep 2026, published 11 Jun 2026🛡️ Security

Socket's Threat Research team documents a new wave of 23 malicious PyPI artifacts (bioinformatics packages like embiggen/ensmallen/gpsea/pyphetools, typosquats like rsquests/tlask/rlask, and an MCP-themed langchain-core-mcp package) tied to the ongoing Mini Shai-Hulud/Miasma/Hades supply chain campaign. Unlike earlier .pth-hook wheels that bundled an obfuscated _index.js JavaScript stealer run via Bun, the bioinformatics cluster hides execution inside trojanized .abi3.so native extensions triggered at import time, while langchain-core-mcp ships only a .pth loader that scans sys.path for an external _index.js payload — a loader/payload split designed to evade detection rules. The payload also opens with a fake prompt-injection comment block meant to derail LLM-based static analysis tools before reaching the actual obfuscated stealer code that harvests GitHub, npm, PyPI, cloud, Kubernetes, SSH, and Docker credentials.

socket.devwriteupAdded 3 Sep 2026, published 10 Jun 2026🛡️ Security

Oasis Security researchers chained three Claude.ai/claude.com vulnerabilities, dubbed "Claudy Day", into an end-to-end attack: hidden HTML tags in the claude.ai/new?q= URL parameter injected invisible instructions into a pre-filled prompt, which then directed Claude to search the victim's conversation history and exfiltrate sensitive data by writing it to a file and uploading it via the Anthropic Files API to an attacker-controlled account (abusing that api.anthropic.com is allowed through the sandbox's network restrictions). A separate open redirect at claude.com/redirect/<target> let attackers weaponize a trusted-looking Google Ads link to silently deliver victims to the injection URL, requiring no MCP servers or integrations. The prompt injection issue has been fixed by Anthropic; remaining issues are being addressed.

oasis.securitywriteupAdded 25 Jul 2026, published 3 Jun 2026🛡️ Security

A researcher details an autonomous vulnerability-hunting system built with Claude Code and 8 custom MCP servers (300+ tools) across a 5-VM Proxmox lab, using a "hallucination bin" validation pipeline (findings must pass PoC/exploitability/low-priv gates before promotion) and a RAG-backed knowledge loop that learns from prior campaigns. Concrete outputs include two new Go standard library CVEs (CVE-2026-33809 TIFF OOM, CVE-2026-33812 SFNT/GPOS OOM), a four-stage Windows OEM management-agent chain (named-pipe auth bypass → SSRF via WCF → catalog injection → SYSTEM code execution via BYOVD), and two macOS app-distributor findings (browser/quarantine DB exfiltration and a leaked debug RSA key enabling Sparkle update-signature bypass). Also covers a self-built token-cost/ROI tracker (TokenBurn) and a bounty-program ROI-scoring model for target selection.

blog.zsec.ukwriteupAdded 3 Sep 2026, published 13 May 2026🛡️ Security

Adversa AI's TrustFall report shows that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers as unsandboxed OS processes the instant a user accepts the generic folder-trust prompt, with no mention of code execution in Claude Code's v2.1+ dialog. A malicious repo needs only two JSON files (.claude/settings.json with enableAllProjectMcpServers/enabledMcpjsonServers/permissions.allow, plus an inline-payload .mcp.json) to achieve one-Enter-keypress RCE with full user privileges, and the same chain runs with zero human interaction against CI runners using the official claude-code-action since headless mode skips the trust dialog entirely. The report documents Anthropic's declination of the finding as intended behavior, contrasts it with the stricter bypassPermissions warning flow, references the related CVE-2025-59536 patch, and ships defender mitigations (managed-settings lockdown, config auditing, CI branch restrictions) plus a safe PoC.

adversa.aiwriteupAdded 20 May 2026, published 7 May 2026🛡️ Security

Socket researchers found that Bitwarden CLI 2026.4.0 was compromised via a hijacked GitHub Action in Bitwarden's CI/CD pipeline, part of the ongoing Checkmarx-themed supply chain campaign. The malicious bw1.js payload shares C2 infrastructure and code (gzip+base64 packed Python memory-scraper, Bun-based runtime, GitHub Actions workflow injector) with the earlier Checkmarx mcpAddon.js attack, but adds new indicators like a lock file, shell-profile persistence, and overt "Shai-Hulud: The Third Coming" / Butlerian Jihad ideological branding, plus a kill switch for Russian-locale systems. It harvests GitHub, AWS, Azure, GCP, npm, SSH, and Claude/MCP credentials and exfiltrates via GitHub commits and npm republishing.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Lakera researchers demonstrate a zero-click exploit chain against Cursor IDE configured with a Google Docs MCP server: an attacker silently shares a malicious document via the Google Docs API, which Cursor's agent retrieves and treats as trusted context, leading to prompt injection that abuses Cursor's command allow-list to achieve persistent remote code execution and credential/data exfiltration. The attack requires no victim interaction and exploits intended MCP/agentic IDE functionality rather than a patchable bug, showing that even "safe" MCP servers become dangerous when combined with implicit trust in external data and permission-fatigue-driven allow-listing.

lakera.aiwriteupPublished and added 6 May 2026🛡️ Security

Wiz Research's technical breakdown of CVE-2026-3854, a critical vulnerability in GitHub's internal git push pipeline (babeld, gitauth, gitrpcd, pre-receive hook) that let any authenticated user achieve unsandboxed remote code execution with a single `git push -o` command. The root cause is a semicolon-delimiter injection into the internal X-Stat header, chained through unsanitized push options to override security fields (rails_env, custom_hooks_dir, repo_pre_receive_hooks) and escape the custom-hooks sandbox, ultimately giving RCE as the shared git user on GitHub.com's multi-tenant storage nodes and full compromise on GitHub Enterprise Server. Wiz also highlights using AI-augmented reverse engineering (IDA MCP) to rapidly analyze GitHub's closed-source compiled binaries and reconstruct the internal protocol, which enabled the discovery.

wiz.iowriteupAdded 5 Sep 2026, published 28 Apr 2026🛡️ Security