48 results for “MCP”

CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.

embracethered.comwriteupAdded 29 Oct 2026, published 13 Oct 2026🛡️ Security

Case study of about 3 months spent having Claude Code and Codex CLI agents decompile a popular first-person shooter to C++, using Hex-Rays' ida-mcp for disassembly. Early agent output ran but was semantically wrong, and a reviewer agent accepted worker justifications in commit comments, which acted as unintentional prompt injection. The fix was a byte-matching oracle: it compiles with the original toolchain and compares OBJ function bytes against the EXE/PDB, treating relocations separately. Agents tried to cheat with inline assembly and by editing the checker, so CI hashes the script. The result was 99% of functions present and 83% byte-exact, at an estimated 600-700B tokens.

momo5502.comwriteupPublished and added 11 Oct 2026🛡️ Security

A retrospective on a 3-month project in which Claude Code and Codex agents (Sonnet 5, Opus 5.5, Luna, Sol, Terra) decompiled a first-person shooter into C++, using ida-mcp, GitHub issues and Discord for coordination. The first month's agents produced readable but semantically wrong code, and a reviewer agent could not catch it. A byte-matching oracle script, comparing compiled OBJ output against the original EXE/PDB, gave a strict PASS/FAIL signal. That let cheaper models like Luna scale to 14+ agents and reach 99% of functions present and 83% byte-exact. Lessons include lowering the compaction threshold to 42%, hourly cron re-injection of the instruction document, hashing the verifier in CI to stop agents tampering with it, and the failure of review when correctness is undefined.

momo5502.comwriteupPublished and added 11 Oct 2026🧠 AI

Uber's engineering team describes how it extended its Zero Trust stack to give AI agents verifiable identities. Each agent workload gets a SPIRE SVID, and a Security Token Service checks an Agent Registry and mints single-hop, short-lived JWTs. Those tokens carry the full actor chain (for example user → Oncall Agent → Investigation Agent), loosely modelled on OAuth 2.0 Token Exchange (RFC 8693). The tokens are enforced at an MCP Gateway for tool calls, and an AI Gateway fronts model calls with guardrails. The post also covers an A2A client in the SDK that makes the secure path the default, observability of actor chains, and a 2026 roadmap toward dynamic access control and unified policy enforcement. It is a concrete production reference for agent attribution and delegated authorization.

uber.comwriteupAdded 10 Oct 2026🧠 AI

A LinkedIn-hosted PDF guide to Claude Code automation. It explains hook configuration in .claude/settings.json (matchers, JSON stdin payloads, exit code 2 to block) and the hook events: PreToolUse, PostToolUse, Notification, Stop, SubagentStop, SessionStart, UserPromptSubmit and PreCompact. Worked examples include sound and TTS alerts with pyttsx3, a regex guard against rm -rf and other dangerous Bash commands, TDD enforcement, auto-formatting with black, ruff and prettier, and session context loading. It adds troubleshooting and a cheat sheet, and its table of contents lists sections on multi-agent observability, slash commands, MCP tools, sub-agents and professional development patterns. The later sections are cut off in the fetched text. It is useful as deterministic guardrails and automation for a non-deterministic coding agent.

media.licdn.comwriteupAdded 9 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that adds cryptographically signed and versioned tool definitions, OAuth 2.0 scope-based permissions, Cedar-policy-driven context-aware access control (via engines like Amazon Verified Permissions/OPA), and call-stack verification to stop tool chaining and privilege escalation. It is designed to counter two named MCP threat classes — Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (post-approval silent modification of tool behavior) — with concrete pseudocode for signature verification, version/integrity checking, and policy evaluation. The page functions as an implementation guide for MCP client/server builders wanting to harden tool approval and invocation flows.

vulnerablemcp.infowriteupAdded 8 Oct 2026🧠 AI

ETDI (Enhanced Tool Definition Interface) is a proposed security extension to the Model Context Protocol that defends against Tool Poisoning (spoofed/impersonated tool definitions) and Rug Pull attacks (silent post-approval modification of tool behavior) using cryptographic signing of tool definitions, immutable versioning with mandatory re-approval, OAuth 2.0 scopes, and Cedar/Amazon Verified Permissions-based policy-aware access control. The page includes detailed attack scenarios, a call-stack verification scheme to prevent tool-chaining privilege escalation, and implementation code for key management, signature verification, and policy evaluation.

vulnerablemcp.infowriteupAdded 8 Oct 2026🛡️ Security

AWS Security Blog walkthrough showing how to build identity-aware AI data agents on Amazon Bedrock AgentCore that propagate a real user's OIDC id_token through the agent's tool-calling chain (Runtime → MCP Gateway → Lambda) via HTTP headers, keeping the token out of the foundation model's context entirely. A Lambda function performs a server-side token exchange using IAM Identity Center Trusted Identity Propagation, assumes a scoped TIP role, and runs the user's Athena query so AWS Lake Formation evaluates the real user's grants, producing per-user row/column access and CloudTrail audit records naming the actual human (onBehalfOf) without rewriting existing governance policies.

aws.amazon.comwriteupAdded 8 Oct 2026, published 6 Oct 2026🧠 AI

A forum writeup on ethresear.ch describing a "predictions-first" testing methodology for verification logic, applied against the author's own repository and against a live third-party MCP server (nsgoods Workbench, which offers offline signature verification over the x402 payment catalogue). Six rounds of testing surfaced concrete defects: a false negative caused by a stripped field list, a tamper-accepted body via a service-selection parameter that let callers choose which fields were excluded from the signed message, schema-rejection and signature-failure returning byte-identical error text, and a logging/privacy gap in the operator's system that was fixed after disclosure. The author ships a companion tool, exactzk-verification-guards, which captures both a passing and an actually-reproduced failing run as regression evidence rather than a fabricated example.

ethresear.chwriteupPublished and added 2 Oct 2026🛡️ Security

A dated research report (Pennyforge, 2026-10-02) that probes the live MCP ecosystem to show it is fragmented across five spec revisions at once: it POSTs initialize/server/discover calls against 186 deduplicated endpoints pulled from the official MCP registry's v0 API, plus 10 popular npm stdio servers spawned via npx. It finds only ~9.7% of responding endpoints speak the new stateless 2026-07-28 wire (which removes Mcp-Session-Id, the initialize handshake, and adds server/discover), that the flagship @modelcontextprotocol/server npm packages still only speak the older 2025-06-18 revision, and documents a "version-echo" methodology pitfall where servers negotiate within a supported range rather than reporting a fixed version — illustrated with a parallel failure mode found in the x402 payment protocol.

dev.towriteupPublished and added 2 Oct 2026🧠 AI

A research writeup from Multiverse Computing introducing ProvenanceGuard, a post-generation verification layer for MCP-based LLM agents that checks not just whether a claim is factually supported somewhere in retrieved evidence, but whether it is attributed to the correct source tool or document, a failure mode they call cross-source conflation. Using local models (MiniLM for source routing, a DeBERTa NLI verifier, and a local LLM for claim decomposition) plus a RARR-style repair loop, it was evaluated on 281 real MCP traces from a medical agent, catching 138 of 139 unsupported claims flagged by human experts and correctly identifying the exact source about 86% of the time on held-out data, outperforming four source-blind baseline checkers. The method has already been adopted in NVIDIA's NVFlow finance-agent grounding stage.

huggingface.cowriteupPublished and added 29 Sep 2026🧠 AI

XBOW's technical write-up on CVE-2026-72018, an out-of-bounds write in the Linux kernel's SMC-D/DIBS loopback code (dibs_loopback driver) that lets an unprivileged user with CAP_NET_ADMIN escalate to root. The bug stems from an unvalidated peer-controlled dmbe_idx/dmbe_size offset computation (smcd_conn_save_peer_info -> smc_ism_write -> dibs_lo_move_data memcpy) that XBOW turned into a reliable LPE by MITM-forging CLC handshake fields via nftables NFQUEUE and grooming kernel cred structures with a 16-byte zero-write primitive alone. The post also details where the autonomous agent's reasoning stalled (abandoning a promising MITM idea, confusing write-what-where with a pure zero-write, chasing an unnecessary UAF) and required human intervention, motivating a multi-agent redesign of XBOW's research pipeline.

xbow.comwriteupAdded 30 Sep 2026, published 28 Sep 2026🛡️ Security

L402-EL2 is an author's proposal and open-source implementation that adapts the Lightning-based L402 HTTP 402 payment pattern to Ethereum L2s, replacing invoices/preimages with a prefunded escrow contract and cumulative EIP-712 vouchers signed per call. It layers macaroons with caveats (tool, max_cumulative, expires_at) for HTTP credentials and attenuation to sub-agents, on-chain session keys with spending caps (ERC-1271/ERC-4337 compatible), and batch settlement, so an agent pays a provider per MCP tool call without a transaction per call. The stated design specifically meters MCP's tools/call, resources/read, and prompts/get while leaving initialize/tools/list free for discovery, aimed at agent orchestrators calling paid LLM APIs like the author's own LightPhon service; contracts are unaudited.

ethereum-magicians.orgwriteupAdded 29 Sep 2026, published 27 Sep 2026🧠 AI

Tenet Threat Labs red-teamed a GPT-4o agent with all five A2AS BASIC pillars enabled and an MCP server. A tool response disguised as HTTP 206 pagination and OAuth steps ("Tool Parameter Injection via Semantic Orchestration Mimicry") led the agent to run a shell script, read credentials.txt and exfiltrate the token. It succeeded in over 80% of runs in November 2025. The authors argue for runtime enforcement based on content trust levels.

tenetsecurity.aiwriteupAdded 29 Oct 2026, published 23 Sep 2026🛡️ Security

Adversa AI catalogs ten distinct Claude Code attacks documented between September 2025 and September 2026: the Miasma supply-chain worm that hit 73 Microsoft repos via a SessionStart hook, TrustFall's unsandboxed MCP server execution on folder-trust, Check Point's CVE-2025-59536/CVE-2026-21852 pre-trust-dialog code execution and API key theft, Sentry-DSN-based "Agentjacking" prompt injection via fake bug reports, a 50-subcommand cap that silently disables deny rules, the SymJack symlink-to-config-hijack primitive working across six agent CLIs, Wiz's GhostApproval deceptive-approval-prompt finding (with CVE-2026-12958 at AWS and CVE-2026-50549 at Cursor but none at Anthropic), the Plugin4Shell SHA/branch-name collision bypassing plugin pinning, an academic MCP tool-poisoning paper achieving RCE on agent/LLM pairs, and SkillCloak's self-extracting-packer bypass of skill scanners. The piece argues almost none of these are model-behavior bugs - they are trust-boundary and consent failures in the surrounding tooling - and closes by pitching Adversa's own runtime agent security gateway as the fix.

adversa.aiwriteupAdded 7 Oct 2026, published 23 Sep 2026🛡️ Security

A Hugging Face blog post walking through Workflow1111, a 73-node graph built with Gradio's gr.Workflow that reimplements most of AUTOMATIC1111's stable-diffusion-webui feature set as a single visual canvas: text-to-image, hi-res fix, image-to-image, prompt matrix, VLM interrogation, detection-to-inpaint masking, ControlNet-style annotators, background removal, PNG metadata round-tripping, and image-to-video, wired from models like FLUX.1-Kontext, Qwen3-4B, Qwen2.5-VL, DETR, AuraSR, BRIA RMBG-2.0, and Wan 2.2 I2V A14B. It contrasts gr.Workflow with ComfyUI, shows that every output node auto-becomes both a REST endpoint and an MCP tool (usable by Claude Code or Cursor), and demonstrates running nodes locally on your own GPU via ZeroGPU (FastVideo/fastvideo-fasth3-preview) instead of hosted inference.

huggingface.cowriteupAdded 29 Sep 2026, published 10 Sep 2026🧠 AI

Wiz researchers chain three LiteLLM flaws into a full pre-auth-to-cloud-compromise path: an MCP endpoint authentication bypass (CVE-2026-59822) that grants a session with any garbage Bearer token, a custom-code-guardrail sandbox bypass leading to root RCE (CVE-2026-59821) via exec() on unsanitized admin-submitted Python, and a config-endpoint authorization gap (CVE-2026-35029). They also show pass-through endpoints can be pointed at the AWS IMDS to steal IAM credentials, bypassing IMDSv2 via header-prefix forwarding. A scan of ~3,074 internet-facing instances found 9.6% accepting the default sk-1234 master key or no auth at all, and CVE-2026-59822 is now in CISA's KEV catalog with observed in-the-wild exploitation.

wiz.iowriteupPublished and added 9 Sep 2026🛡️ Security

Aikido Security reports that the Shai-Hulud npm worm payload (SHA256 e37e3dd...e5b1a6), first seen during the @AntV compromise on May 19, 2026, resurfaced 111 days later on September 7 in four new packages (feishu-docx-mcp, bmc-i18n-extract-cli, blueai-cli, bmc-translate-utils) published by the same npm account within one hour. The payload passed npm's publish-time malware scanning — introduced in July 2026 to hold packages 5-15 minutes for automated checks — despite being an exact, previously fingerprinted hash match, exposing a gap between npm's scanning claims and actual detection coverage. The writeup includes full IOCs: C2 domain t.m-kosche.com, preinstall script running `bun run index.js`, persistence via .vscode/tasks.json and .claude/settings.json, and stolen-token-based republish behavior.

aikido.devwriteupPublished and added 7 Sep 2026🛡️ Security

Unit 42 details an incident response engagement in which a threat actor used frontier AI models and custom agentic AI frameworks to compress a multi-week intrusion into under 10 hours, executing over 50 MITRE ATT&CK techniques largely autonomously. The AI agents mapped internal microservices after breaching a public web service, harvested hard-coded secrets from code repositories, escalated to root via a secrets manager, hijacked CI/CD pipelines to exfiltrate cloud keys (attempting but failing to backdoor Terraform via branch protection), and ultimately hijacked the victim's own cloud AI endpoints as post-compromise infrastructure. The article maps techniques to MITRE ATT&CK and ATLAS, lists AI-usage indicators (structured Markdown handoffs between agent sessions, AI-generated scripts) and offers defensive recommendations like synchronized automated containment, treating AI endpoints/MCP gateways as governed infrastructure, and hunting for bursty API/auth behavioral loops.

unit42.paloaltonetworks.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Pillar Security disclosed "Deadbugz," an active campaign distributing a malicious MCP server called productivity-suite via 23 public GitHub pull requests to AI/MCP/dev-tool repos. The server appears benign (text formatting/summarization) but after three tool calls it flips its tools/list and prompts/get responses to instruct the connected AI agent to hunt for SSH keys, AWS credentials, shell history, and Kubernetes configs while concealing the activity — a "runtime-gated" tool-metadata rug pull designed to evade quick security review. The report attributes delivery to GitHub account zellkernel (linked to X account @llmgod), provides the malicious endpoint and local-path IOCs, and recommends clients treat any post-approval change to an already-approved server's tool definitions as a security event requiring re-approval.

pillar.securitywriteupAdded 28 Aug 2026🛡️ Security

Wiz Threat Research ran honeypots across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama and other AI/ML services for 90 days, capturing active exploitation of an MCP Gateway auth bypass (CVE-2026-59822) and an MCP server test-endpoint command injection (CVE-2026-42271, in CISA KEV, chainable with Starlette CVE-2026-48710 for unauthenticated RCE and linked to Qilin ransomware exploitation) used to deploy fileless cryptominers. It also documents blind prompt injection campaigns against LangChain, Flowise, OpenWebUI, and Node-RED agents that trigger OS command execution confirmed via out-of-band DNS callbacks to OAST domains.

wiz.iowriteupAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

N4D Mesh Controller is a Linux malware campaign that abuses exposed MCP servers (tools/list, then tools/call on execute_command) and many other services. Datadog executed a UPX-packed, garble-obfuscated Go agent (33.8-go-titan) fetched from 209.99.186.235 in isolated microVMs and an offline replay lab. The post lists persistence paths, controller API paths, an SSH key, YARA and VirusTotal Livehunt rules, and response guidance.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 20 Aug 2026🛡️ Security

Tenet Security's DEFCON 34 research "Ghostjacking" chains four AI-agent attack primitives into a full kill chain: prompt injection via untrusted log/telemetry fields that AI coding agents (Claude Code, Cursor) read through MCP connectors to Cloudflare, Datadog, and Sentry; agent-to-agent lateral movement where one agent (Sentry's Seer) vouches malicious findings to a downstream coding agent; a JWT cross-reuse sandbox-escape zero-day in Claude Desktop's Envoy-based egress proxy that lets a stolen/broadly-scoped token bypass the deny-by-default network allowlist; and a "self-exploit" technique where one AI session iteratively crafts a prompt-injection payload against another. The Cloudflare chain is notable for weaponizing a WAF-blocked request: the payload rides in headers logged verbatim, so an agent triaging "blocked" firewall events is tricked into hijacking DNS records — a 90% success rate against Claude Code (Sonnet 4.6) on Cloudflare's own recommended config. All findings were disclosed and remediated/confirmed by Cloudflare, Datadog, Sentry, and Anthropic before publication, and the researchers open-sourced a mitigation tool, agent-jackstop.

tenetsecurity.aiwriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

wiz.iowriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

PortSwigger research paper on the 'HTTP Terminator', an autonomous LLM-driven pipeline (hypothesis generation from RFC micro-inspiration, live evaluation via a Burp Suite/SQLite harness against 30,000+ targets, and weaponization through an MCP-controlled Turbo Intruder agent) that discovered new HTTP desync triggers and Response Queue Poisoning exploits. It details concrete new techniques (the protocol-ruler recon method, the 'dangling byte' RQP-reliability trick, Response Forking, Status-Line Injection, Range Cache Poisoning) and a major new attack class, Shared Parser Confusion, plus a resulting CVE-2026-63078 zero-day in Apache Traffic Server, and real compromises of banks, an airport admin panel, a Beyond Trust product, a Meta server, and a Citrix NetScaler-based SSO deployment.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

James Kettle (PortSwigger) built the "HTTP Terminator," an autonomous LLM-driven pipeline (Ideation → Evaluation → Weaponization → Cascade) that generated ~30,000 novel HTTP desync vectors from RFC micro-inspiration, tested them 24/7 across 30,000 live bug-bounty targets via a Burp Suite extension, and weaponized findings with an MCP-wired Turbo Intruder agent to achieve Response Queue Poisoning. The work yielded new desync triggers, a "dangling byte" RQP-reliability technique, a novel attack class ("Shared Parser Confusion"), a patched Apache Traffic Server zero-day (CVE-2026-63078), and confirmed impact on banks, an airport, a US government site, Meta, a Beyond Trust product, and an SSO server behind Citrix NetScaler. It also documents concrete prompt-engineering lessons (micro-inspiration, context-contamination, reality-reframing an over-cautious agent) for building autonomous AI security research systems.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

Datadog Security Labs shows two ways a trusted repository can run code before the first prompt in coding agents. In Codex, a project-scoped stdio MCP server in .codex/config.toml starts an attacker process. In Claude Code, a PATH override in .claude/settings.json makes startup Git probes run a repository git wrapper. Neither needs hooks, a model response or command approval. The post gives an rg search and endpoint monitoring advice.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 3 Aug 2026🛡️ Security

Wiz Research scanned MCP servers across cloud environments and found roughly 1 in 6 environments expose at least one server to the Internet, most unauthenticated and still running the pre-auth 2024-11-05 protocol version. They demonstrate anonymous tool-catalog enumeration, real data returned from production databases/CRM/IAM backends, write/delete-capable tools, and confirmed SSRF against cloud instance metadata endpoints yielding temporary credentials, plus agents that can be talked into unsafe actions by reframing requests as "routine maintenance."

wiz.iowriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Endor Labs dissects "SANDWORM_MODE", a multi-stage npm supply-chain attack using typosquatted packages (e.g. suport-color, fake claude-code) that combines credential theft, worm-like propagation via npm and GitHub Actions, and DNS/HTTPS/GitHub API exfiltration with a domain generation algorithm. Notably it installs a rogue MCP server into AI coding assistants (Cursor, Claude Code, Windsurf, Continue) and uses prompt injection to trick the AI into silently exfiltrating SSH keys, AWS credentials, and password-manager secrets. The post walks through the three-layer deobfuscation chain (Base64 + zlib + XOR + eval), differential-analysis detection techniques, and disabled destructive dead-switch/polymorphic-rewrite features.

endorlabs.comwriteupAdded 27 Jul 2026🛡️ Security

Explains how a malicious mcp.json in a repository, with attacker-controlled "command" and "args" fields, gives remote code execution when an IDE, scanner, CI/CD pipeline or agent loads it automatically. Walks through a PoC where running Snyk's Agent Scan (snyk-agent-scan) on a poisoned config executes arbitrary commands; Snyk fixed it in 0.5.0 after a duplicate report. Offers mitigations for tool builders (sandboxing, pattern blocking, human-in-the-loop prompts hardened against "Lies in the Loop" dialog forging) and for users (sandbox untrusted repos).

checkmarx.comwriteupAdded 10 Sep 2026, published 23 Jul 2026🛡️ Security