Analysis · latest

More filters

How MCP Servers Can Expose Enterprise Secrets

An explainer on Model Context Protocol (MCP) security describes how ungoverned MCP servers expand the enterprise attack surface, cataloging five vectors — confused deputy, token passthrough, tool poisoning, SSRF via tool connectors, and rogue server registration — and noting MCP grants LLM runtimes ambient authority across multi-hop trust chains that identity and perimeter controls miss. The piece frames shadow AI and pre-production MCP deployments bypassing security review as the core governance gap, referencing the September 2025 Postmark malicious MCP server incident and control domains like OAuth 2.1 token exchange and server attestation. Details →

The lethal trifecta for AI agents: private data, untrusted content, and external communication

An explainer on stopping prompt injection in MCP servers frames the problem as the 'lethal trifecta' (private-data access, exposure to untrusted content, and external communication) coined by Simon Willison, using the Invariant Labs demonstration against GitHub's official MCP server as its central case. In that attack a malicious GitHub issue embedded agent-directed instructions that caused a coding agent to leak private repo details into a public pull request, with no exploited code or CVE. The piece argues the fix is architectural rather than prompt-based. Details →

Securing the Model Context Protocol (MCP): Risks, Controls, and Governance

An analysis piece synthesizing MCP (Model Context Protocol) security risks for CISOs, drawing on a Darktrace blog and an arXiv paper (arXiv:2511.20920) by Errico, Ngiam, and Sojan. It categorizes threats such as content-injection attackers embedding malicious instructions into agent-consumed data, supply-chain attackers distributing compromised MCP servers, and over-privileged agents enabling data-driven exfiltration, tool poisoning, and cross-system privilege escalation, and proposes controls including scoped per-user authentication, sandboxing, provenance tracking, DLP, and centralized governance. Details →

LLM security testing: how to pentest LLMs and MCP servers

Escape.tech publishes a methodology for pentesting LLM applications and MCP servers, mapping attacks to the OWASP Top 10 for LLM Applications 2025 (prompt injection, improper output handling, excessive agency, system-prompt leakage) and demonstrating them against a self-built vulnerable FastMCP lab. The guide explains why LLM testing breaks the web-app playbook — no parser boundary, non-deterministic interpreter, no sanitization line — and notes MCP tool descriptions and tool responses both reach the model as trusted injection channels, referencing tool poisoning and rug-pull attacks. Details →

Prompt Injection: How to Protect AI Agents and LLM Apps

An educational guide, "Prompt Injection: How to Protect AI Agents and LLM Apps," explains the instruction-vs-data trust problem underlying direct and indirect prompt injection and lays out a layered defense model (least privilege, tool access controls, approvals for consequential actions, structured tool arguments, validation, sandboxing, monitoring, and adversarial evals). The piece synthesizes framing from OWASP LLM Top 10 (LLM01), OpenAI, and Anthropic, using examples such as malicious instructions hidden in emails, webpages, RAG chunks, and MCP resources. Details →

Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation

Google Cloud documentation for the Data Agent Kit extension (VS Code and Antigravity IDE) warns that coding agents connected via Google Cloud MCP can be hijacked through indirect prompt injection, where malicious instructions hidden in data sources such as Cloud Storage, BigQuery, email, or calendars are interpreted as commands. The guidance recommends mitigations including running agents in constrained environments like Cloud Workstations with disabled internet access and no root privileges. Details →

The Structural Cost of the MCP Security Crisis

An analysis of the escalating Model Context Protocol (MCP) security crisis synthesizes recent disclosures: over 21,000 internet-facing MCP servers, 91.8% of audited production servers lacking OAuth, hundreds of instances exposing unrestricted shell access, and 10+ critical CVEs, drawing on the arXiv 'Exposed by Design' assessment, OX Security's 'Mother of All AI Supply Chains' report, the OWASP MCP Top 10, and NSA design guidance. The piece frames the STDIO transport architectural dispute between the security community and Anthropic ahead of the MCP Dev Summit in Seoul, and the protocol's governance shift to the Linux Foundation. Details →

Tool call poisoning in agentic AI: A technical guide to attack mechanics and defenses

A technical guide explains MCP tool poisoning, an indirect prompt injection attack in which a malicious Model Context Protocol server hides instructions in tool metadata (such as the tool's description field) so that when an AI agent calls the tool, injected instructions enter the LLM context and are treated as trusted input, enabling restricted tool calls, data leakage, or system-prompt bypass. The guide draws on an arXiv STRIDE/DREAD threat model that found tool poisoning to be the most impactful client-side MCP vulnerability across seven major MCP clients, and proposes multi-layered defenses including static metadata analysis, decision-path tracking, behavioral anomaly detection, and user transparency. Details →

Coding Agent Security: Lessons from Claude Code, Cowork, Codex, and Copilot in the Wild

Ken Huang's survey "Coding Agent Security" reviews documented 2025-2026 incidents involving AI coding agents (Claude Code, Cowork, Codex, Copilot, Amazon Q), including agents that deleted databases, leaked credentials, and merged malicious code after indirect prompt injection via GitHub Issues, source-code comments, or MCP tool results. The piece maps a four-stage risk chain (untrusted text enters context, model can't separate instruction from data, model issues a tool call, tool call has real-world effect) and argues policy enforcement must live at the action boundary. Supporting evidence includes embracethered's Amazon Q Developer VS Code extension RCE via prompt injection abusing the readonly-classified find -exec flag. Details →

MCP Server Security: How Malicious Tools Attack AI Agents | Precursor Security

An analysis of Model Context Protocol (MCP) server security synthesizes research showing publicly exposed, unauthenticated MCP servers nearly tripled from 492 (July 2025) to 1,467 (April 2026) per Trend Micro, that 33% of scanned servers carry critical vulnerabilities (Enkrypt AI), that static long-lived secrets dominate authentication (Astrix), and that 24,008 secrets leaked in MCP config files (GitGuardian). It frames these exposures against attack classes such as tool poisoning, credential theft via prompt injection, lateral movement, and full cloud compromise, referencing the OWASP MCP Top 10. Details →

AI Sandbox Requirements for Code Interpreter Agents

Sandbox Review's analysis surveys the attack surface of code-interpreter AI agents, covering prompt injection into processed content, malicious MCP tools that inherit agent permissions, the late-2025 npm supply-chain campaign (including the Cline VS Code extension compromise), Pillar Security's mid-2026 'indirect sandbox escape' disclosures against Cursor, Codex, Gemini CLI and Antigravity, and the CIRCLE benchmark of 1,260 resource-exhaustion prompts. The piece synthesizes these existing findings to argue that sandboxes must enforce unconditional limits and treat any agent-writable input a host later trusts as part of the blast radius. Details →

Multi-Agent AI Security: 5 Compositional Risks and Fixes [2026]

An analysis piece on multi-agent AI security surveys compositional risks in agentic deployments — control-plane and orchestration-layer compromise, non-human identity gaps, credential persistence and scope creep, MCP server exposure, and static-permission failures — and proposes fixes like just-in-time least privilege and verification gates. The related arXiv paper systematically characterizes 193 MAS threat items across nine categories and evaluates 16 AI security frameworks, finding none achieves majority coverage of any single category and that Non-Determinism and Data Leakage are the most under-addressed. Details →
See the API docs to pull all 954 items →

How the wire is made

Poll & cluster

Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.

Curate

AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.

Read the full methodology →

Every item here is one machine-curated intelligence object, not a headline.

Read the wire for free. There is a small charge to ask the index questions.

The wire, open

The complete curated feed, no key required.

Subscribe to the RSS feed

The vector desk

Query the index by meaning, not just keyword.

  • GET /api/items?tags=&minSeverity=&itemType=
  • GET /api/search?q= — keyword
  • GET /api/semantic?q= — vector
Preview semantic search