First reported · updated · 9 reports adversa.ai
Analysis · latest
First reported zitadel.com
How AI Agents Get Impersonated (and How to Stop It)
ZITADEL's explainer on AI agent impersonation walks through six ways an agent's identity can be exploited—credential theft, fake agent registration via OAuth Dynamic Client Registration, and others—and the mitigations that close each. It cites GitGuardian data on nearly 29 million hardcoded secrets and 24,008 unique secrets in MCP-related config files on public GitHub in 2025, and points to MCP's November 2025 authorization update favoring Client ID Metadata Documents over DCR. Details →First reported · updated · 6 reports thehackernews.com
How MCP Servers Can Expose Enterprise Secrets
An explainer on Model Context Protocol (MCP) security describes how ungoverned MCP servers expand the enterprise attack surface, cataloging five vectors — confused deputy, token passthrough, tool poisoning, SSRF via tool connectors, and rogue server registration — and noting MCP grants LLM runtimes ambient authority across multi-hop trust chains that identity and perimeter controls miss. The piece frames shadow AI and pre-production MCP deployments bypassing security review as the core governance gap, referencing the September 2025 Postmark malicious MCP server incident and control domains like OAuth 2.1 token exchange and server attestation. Details →First reported encryptionconsulting.com
Shadow AI Agents: How to Discover and Govern Unmanaged Autonomous Agents
Encryption Consulting explains "shadow AI agents" — autonomous agents running in an enterprise without a named owner, scoped identity, or inventory entry — outlining four common origination paths (internal scripts/automation, SaaS copilot features enabled by default, low-code/RPA workflows, and MCP integrations) and proposing a discovery, risk-scoring, ownership, and credential-governance program to manage them. Details →First reported · updated · 4 reports edgelabs.ai
AI Agent Security Risks: Mitigation for Enterprises
Sweet Security's "AI Agent Security Risks" guide is an enterprise-focused explainer describing how AI agent workflows can be attacked and how to mitigate them, covering prompt injection via untrusted context, poisoned documents and memory, over-broad credentials, action logging, and human approval for high-impact actions. The reference page synthesizes mitigation guidance and cites external frameworks (OWASP LLM Top 10, NIST, MITRE ATLAS) and research such as the AgentPoison memory/knowledge-base poisoning paper. Details →First reported jfrog.com
Agent Immunization is Key for Building Trusted AI Agents
JFrog's blog introduces "Agent Immunization and Control," a vendor concept for securing AI coding agents by embedding layered protections into the software supply chain rather than bolting guardrails, scanners, or sandboxes on from the outside. The piece frames the core risk as agents consuming unverified packages, plugins, and MCP servers that may carry hidden prompt-injection instructions or known vulnerabilities the agent cannot distinguish. Details →First reported · updated · 4 reports simonwillison.net
The lethal trifecta for AI agents: private data, untrusted content, and external communication
An explainer on stopping prompt injection in MCP servers frames the problem as the 'lethal trifecta' (private-data access, exposure to untrusted content, and external communication) coined by Simon Willison, using the Invariant Labs demonstration against GitHub's official MCP server as its central case. In that attack a malicious GitHub issue embedded agent-directed instructions that caused a coding agent to leak private repo details into a public pull request, with no exploited code or CVE. The piece argues the fix is architectural rather than prompt-based. Details →First reported nhimg.org
AI agent risk frameworks: is the rule of two already broken?
An NHIMG editorial, based on Noma Security's analysis, argues that the 'Rule of Two' agent risk framework breaks down in real deployments because two-of-three conditions (capability, autonomy, privilege) can still yield destructive outcomes such as prompt injection in developer tools or autonomous agents deleting production data. It proposes governing AI agents as non-human identities with scoped privileges, discoverability, and action-level auditing. Details →First reported · updated · 3 reports arxiv.org
Securing the Model Context Protocol (MCP): Risks, Controls, and Governance
An analysis piece synthesizing MCP (Model Context Protocol) security risks for CISOs, drawing on a Darktrace blog and an arXiv paper (arXiv:2511.20920) by Errico, Ngiam, and Sojan. It categorizes threats such as content-injection attackers embedding malicious instructions into agent-consumed data, supply-chain attackers distributing compromised MCP servers, and over-privileged agents enabling data-driven exfiltration, tool poisoning, and cross-system privilege escalation, and proposes controls including scoped per-user authentication, sandboxing, provenance tracking, DLP, and centralized governance. Details →First reported thehackernews.com
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Analysis of the security challenges posed by local AI coding agents like Anthropic's Claude Code, which reads files, runs shell commands, and invokes MCP tools using a developer's machine credentials. The piece covers Anthropic's new Compliance API endpoints for activity visibility while arguing that logs alone cannot determine whether an agent's access is legitimate, citing Token Security data that local agents make up 68.6% of AI agents found in customer environments. Details →First reported microsoft.com
AI agent shared responsibility model - Microsoft Azure | Microsoft Learn
Microsoft's Azure documentation presents an "AI agent shared responsibility model" that describes how autonomous agents differ from request/response LLMs—acting autonomously via tools and APIs, holding persistent memory, carrying distinct identities, and composing with other agents—and maps the resulting governance responsibilities. It flags top agentic risks such as prompt injection that drives actions, excessive agency, and confused-deputy scenarios across SaaS and self-hosted deployment models. Details →First reported · updated · 4 reports barndoor.ai
MCP Gateway Benchmark: Latency & Security of 6 Gateways
Akto's blog explains the concept of AI security gateways as a policy layer in front of LLM, agent, and MCP tool traffic, describing how they inspect requests for prompt injection, sensitive data exfiltration, and cost overruns before reaching production. It contrasts AI security gateways with traditional API gateways and single-protocol MCP gateways and discusses agentic AI risks driving their adoption in 2026. Details →First reported substack.com
Going Deeper: The MCP Inventory Gap - by Rod Trent
Rod Trent's post examines the 'MCP inventory gap' in Microsoft environments, where different consoles report wildly different counts of MCP servers/connections — 122 Copilot connectors in the M365 admin center versus 5 MCP servers shown in the Security Dashboard for AI and Defender Applications. The piece argues each console answers a different governance question rather than being reconcilable views of one list, and offers guidance on how defenders should interpret and assess MCP visibility for Copilot governance. Details →First reported langguard.ai
Least-Privilege Agent Permissions: Scoping AI Agents | LangGuard - Deterministic Runtime AI Governance Platform
LangGuard's article explains least-privilege permission scoping for AI agents, arguing that agents inherit the full action surface of every MCP tool they connect to and must be scoped per operation rather than per system. It maps OWASP LLM06:2025 Excessive Agency's three causes (excessive functionality, permissions, and autonomy) onto scoping decisions and describes its SCOPE-MCP feature that enumerates and classifies operations against segregation-of-duties rules. Details →First reported infernalcode.com
Your AI Agent Has Root | Volatile Testimony
An explainer titled "Your AI Agent Has Root" describes how an unsandboxed MCP (Model Context Protocol) shell server invoked by a coding agent runs with the full permissions of the user's own account, giving it access to SSH keys, cloud credentials, browser cookies, git remotes, and the entire home directory with no audit trail. The author frames this as POSIX working as designed rather than an exploit, warning that a malicious or compromised MCP server could exfiltrate credentials and pivot to authenticated services. Details →First reported google.com
Best practices for securing agent interactions with Model Context Protocol | AlloyDB for PostgreSQL | Google Cloud Documentation
Google Cloud documentation lays out best practices for securing AI agent interactions with AlloyDB for PostgreSQL over the Model Context Protocol (MCP), covering least-privilege access, database-native granular controls, treating data and user inputs as untrusted, preventing unauthorized tool chaining, limiting access in multi-tenant databases, and enabling Model Armor safety thresholds plus auditing. Details →First reported · updated · 2 reports escape.tech
LLM security testing: how to pentest LLMs and MCP servers
Escape.tech publishes a methodology for pentesting LLM applications and MCP servers, mapping attacks to the OWASP Top 10 for LLM Applications 2025 (prompt injection, improper output handling, excessive agency, system-prompt leakage) and demonstrating them against a self-built vulnerable FastMCP lab. The guide explains why LLM testing breaks the web-app playbook — no parser boundary, non-deterministic interpreter, no sanitization line — and notes MCP tool descriptions and tool responses both reach the model as trusted injection channels, referencing tool poisoning and rug-pull attacks. Details →First reported · updated · 4 reports nhimg.org
MCP's Broken Trust Model: Tool Poisoning, Rug Pulls, and the New Threat Landscape
An analysis of the Model Context Protocol's (MCP) trust model examines tool poisoning, rug pulls, and other attack paths where malicious instructions embedded in tool metadata can subvert AI agents. Drawing on NSA MCP guidance, an arXiv STRIDE/DREAD threat-modeling paper, OWASP, and Invariant Labs research, it argues that MCP implementations frequently skip authentication and re-authorization, letting approved agents reach sensitive resources without review. Details →First reported · updated · 2 reports aaif.io
The Anatomy of MCP Authorization: How the Hardened Flow Actually Runs - Agentic AI Foundation (AAIF)
An explainer from the Agentic AI Foundation walks through the MCP authorization flow under the 2026-07-28 spec revision, framed as a security-hardening pass that codifies fixes for audience confusion and confused-deputy failures. It maps the OAuth 2.1 roles (MCP client, MCP server as resource server, authorization server, and resource owner) and traces a cold-start token flow step by step against the hardened spec requirements. Details →First reported · updated · 22 reports medium.com
Prompt Injection: How to Protect AI Agents and LLM Apps
An educational guide, "Prompt Injection: How to Protect AI Agents and LLM Apps," explains the instruction-vs-data trust problem underlying direct and indirect prompt injection and lays out a layered defense model (least privilege, tool access controls, approvals for consequential actions, structured tool arguments, validation, sandboxing, monitoring, and adversarial evals). The piece synthesizes framing from OWASP LLM Top 10 (LLM01), OpenAI, and Anthropic, using examples such as malicious instructions hidden in emails, webpages, RAG chunks, and MCP resources. Details →First reported snyk.io
Why Your AI Application Is Exposed Snyk
Snyk's blog explains how modern AI applications remain exploitable through 'chained risk' where prompt templates, RAG, tool calls, and MCP endpoints combine to bridge untrusted prompts to backend execution sinks, even when individual scanners report no isolated vulnerabilities. The piece argues that DAST, AI penetration testing, and AI red teaming address three distinct lenses, and that no single tool covers cross-layer behavioral emergence. Details →First reported qabash.com
AI Supply Chain Security: Why Every AI Tool Expands Your Attack Surface
QA Bash analyzes how AI development tools—MCP servers, AI coding assistants, GitHub Apps, CLI agents, and local LLM runtimes—expand the developer workstation attack surface by requiring broad permissions to source code, credentials, and cloud resources. The piece cites a reported malicious VS Code extension, "Markdown All Pro," that allegedly impersonated a trusted extension, fingerprinted hosts, and opened a channel to receive future instructions, arguing the next supply-chain attack may come from a voluntarily installed AI tool. Details →First reported pipelab.org
Denial of Wallet
PipeLab's explainer defines "denial of wallet" as a cost-abuse attack against metered AI-agent systems, where a hijacked, prompt-injected, or looping agent repeatedly calls paid surfaces (model tokens, tool calls, MCP servers, SaaS APIs) until the bill or quota is exhausted. The page argues that per-session budget caps fail because agents can reset the session lifecycle to mint fresh allowances, and pitches Pipelock v3.3, which keys budgets to a derived identity subject rather than an MCP session id. Details →First reported · updated · 3 reports google.com
Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation
Google Cloud documentation for the Data Agent Kit extension (VS Code and Antigravity IDE) warns that coding agents connected via Google Cloud MCP can be hijacked through indirect prompt injection, where malicious instructions hidden in data sources such as Cloud Storage, BigQuery, email, or calendars are interpreted as commands. The guidance recommends mitigations including running agents in constrained environments like Cloud Workstations with disabled internet access and no root privileges. Details →First reported · updated · 2 reports yahoo.com
The Structural Cost of the MCP Security Crisis
An analysis of the escalating Model Context Protocol (MCP) security crisis synthesizes recent disclosures: over 21,000 internet-facing MCP servers, 91.8% of audited production servers lacking OAuth, hundreds of instances exposing unrestricted shell access, and 10+ critical CVEs, drawing on the arXiv 'Exposed by Design' assessment, OX Security's 'Mother of All AI Supply Chains' report, the OWASP MCP Top 10, and NSA design guidance. The piece frames the STDIO transport architectural dispute between the security community and Anthropic ahead of the MCP Dev Summit in Seoul, and the protocol's governance shift to the Linux Foundation. Details →First reported · updated · 4 reports salt.security
Agentic AI Security - Best Practices for Enterprise Teams | Fidelis Security
An explainer on securing agentic AI in the enterprise outlines risks unique to autonomous agents, including unrestricted API/tool access, indirect prompt injection and workflow hijacking via RAG pipelines, data exfiltration, privilege escalation, and supply-chain attacks through misconfigured Model Context Protocol (MCP) servers, alongside best-practice mitigations. Details →First reported aifreeup.com
Shadow MCP Servers: The AI Tools Nobody Vetted
An explainer on "shadow MCP servers" argues that developers connect AI assistants to real systems (Google Drive, Notion, browser extensions) via config files that skip normal SaaS vetting, leaving organizations with no inventory of what their AI agents can reach. The piece discusses why standard discovery tools miss these connectors and offers practices for finding and governing them, citing Check Point research on Claude Code MCP vulnerabilities (CVE-2025-59536, CVE-2026-21852). Details →First reported pushsecurity.com
How to discover AI, enforce policies, and prevent data loss
A Push Security blog argues that blocking AI tools at the network level drives shadow AI underground, and outlines a governance approach for discovering unapproved AI apps, browser extensions, OAuth integrations, and MCP connections, plus enforcing data-flow controls (blocking uploads/downloads/clipboard pastes and monitoring AI chat transcripts). The piece cites telemetry claiming the average organization runs 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in a typical week, most unapproved. Details →First reported · updated · 4 reports cybersecpentesting.com
Tool call poisoning in agentic AI: A technical guide to attack mechanics and defenses
A technical guide explains MCP tool poisoning, an indirect prompt injection attack in which a malicious Model Context Protocol server hides instructions in tool metadata (such as the tool's description field) so that when an AI agent calls the tool, injected instructions enter the LLM context and are treated as trusted input, enabling restricted tool calls, data leakage, or system-prompt bypass. The guide draws on an arXiv STRIDE/DREAD threat model that found tool poisoning to be the most impactful client-side MCP vulnerability across seven major MCP clients, and proposes multi-layered defenses including static metadata analysis, decision-path tracking, behavioral anomaly detection, and user transparency. Details →First reported substack.com
Coding Agent Security: Lessons from Claude Code, Cowork, Codex, and Copilot in the Wild
Ken Huang's survey "Coding Agent Security" reviews documented 2025-2026 incidents involving AI coding agents (Claude Code, Cowork, Codex, Copilot, Amazon Q), including agents that deleted databases, leaked credentials, and merged malicious code after indirect prompt injection via GitHub Issues, source-code comments, or MCP tool results. The piece maps a four-stage risk chain (untrusted text enters context, model can't separate instruction from data, model issues a tool call, tool call has real-world effect) and argues policy enforcement must live at the action boundary. Supporting evidence includes embracethered's Amazon Q Developer VS Code extension RCE via prompt injection abusing the readonly-classified find -exec flag. Details →First reported github.com
mcp-context-forge/SECURITY.md at main · IBM/mcp-context-forge
IBM's mcp-context-forge (MCP Context Forge, an MCP gateway/proxy) publishes a SECURITY.md security policy laying out hardening guidance for deploying the gateway, including keeping the Admin UI development-only, disabling it and unused features in production, requiring authenticated REST-API-only access, and using feature flags to reduce attack surface. Details →First reported · updated · 4 reports deepinspect.ai
MCP Server Security: How Malicious Tools Attack AI Agents | Precursor Security
An analysis of Model Context Protocol (MCP) server security synthesizes research showing publicly exposed, unauthenticated MCP servers nearly tripled from 492 (July 2025) to 1,467 (April 2026) per Trend Micro, that 33% of scanned servers carry critical vulnerabilities (Enkrypt AI), that static long-lived secrets dominate authentication (Astrix), and that 24,008 secrets leaked in MCP config files (GitGuardian). It frames these exposures against attack classes such as tool poisoning, credential theft via prompt injection, lateral movement, and full cloud compromise, referencing the OWASP MCP Top 10. Details →First reported · updated · 13 reports senthex.com
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
Analysis piece on securing agentic AI systems, synthesizing prompt injection attack patterns, Simon Willison's 'lethal trifecta' (private data, untrusted content, external communication), the EchoLeak zero-click exploit (CVE-2025-32711) against Microsoft 365 Copilot, and A2A protocol risks, arguing for defense-in-depth moving from per-action checks to trajectory-level assurance. Draws on OWASP LLM Top 10, arXiv research, and vendor threat writeups to map defenses for LLM- and agent-based applications. Details →First reported bitsight.com
Shadow AI and the Expanding Attack Surface
A Bitsight analysis argues that Shadow AI—unapproved AI apps, browser extensions, coding assistants, and autonomous agents adopted without security review—silently expands an organization's third-party attack surface. It highlights how the Model Context Protocol (MCP) connects AI applications to repositories, email, and business systems, and how weak authorization, excessive permissions, and untrusted content can create new exploitation pathways for threat actors. Details →First reported paragmali.com
When Prompts Become Shells: How Prompt Injection Turned AI Agents Into Remote Code Execution
An analytical deep-dive, "When Prompts Become Shells," reframes prompt injection as an injection-class vulnerability in the AI layer that can escalate to remote code execution when agent frameworks route model-parsed arguments into execution sinks. The piece traces a single structural failure through several real CVEs (including Microsoft's Semantic Kernel demonstration launching calc.exe and GitHub Copilot RCE), arguing the model behaves as designed while the surrounding software creates the vulnerability. Details →First reported s2w.inc
"As agentic AI raises jailbreak risk, defend by priority"
In an interview reported by S2W, TALON lead Yang Jong-heon argues that agentic AI dramatically raises the cost of a successful jailbreak because models now connect to real systems via MCP and APIs, letting a jailbroken agent read files, run code, and send emails rather than merely leak a forbidden answer. Citing reported jailbreak success rates (GPT-4o 61%, Gemini 2.5 Flash 71%, DeepSeek-V3 90%), Yang urges defenders to prioritize the highest-impact exposures rather than chase perfect prevention. Details →First reported forcepoint.com
MCP Security: Data Exposure Risks and Controls [2026]
Forcepoint's blog argues that MCP security discussions overlook data exposure risks, noting that a single compromised MCP server can expose every credentialed system it connects to (Salesforce, M365, Slack, code repos, finance DBs). It cites 30+ CVEs filed against MCP servers between January and February 2026, command-injection prevalence, and the postmark-mcp package that silently added a hidden recipient to exfiltrate copies of AI-agent emails. Details →First reported dev.to
How I vet MCP servers before trusting them in my agent
A practitioner explainer describes how MCP tool descriptions, names, and input schemas are injected directly into an agent's context and are read by the model as instructions, enabling indirect prompt injection such as a tool description that tells the agent to email the conversation to an outside address. The author outlines four vetting checks: scanning tool descriptions and schemas for injection, scanning every tool result, watching tool arguments, and enforcing tenant isolation. Details →First reported cyberscoop.com
Why transparent AI agents matter more than you think
A CyberScoop op-ed argues that transparent, governed AI agents are essential to defend against prompt injection and other agentic-AI threats, citing Snyk's ToxicSkills audit (36% of Agent Skills contained critical issues) and a Mozilla indirect prompt-injection PoC that spawned a reverse shell via Claude Code. The piece recommends layered defenses including MCP-based governed access, bounded tenant isolation, strict access controls, standardized telemetry, and UEBA/NDR detection. Details →First reported silentrobots.com
MCP list caching and tool poisoning
An analysis of MCP tool poisoning explains how a malicious or compromised MCP server can change a tool's description after the user has approved it, embedding hidden instructions the model follows while the UI still shows the friendly approved name. The piece discusses how the 2026-07-28 MCP spec's new cacheable list fields (ttlMs and cacheScope) could blunt sudden catalog swaps and recommends clients hash approved catalogs, honor TTLs, show full descriptions, and pin versions. Details →First reported medium.com
3 Hops to RCE. | MCP Security Part 4
Part 4 of an MCP security series by Abhishek meena walks through the full takeover chain behind CVE-2025-53773, a remote code execution flaw in GitHub Copilot and VS Code patched in August 2025 and originally documented by researcher Johann Rehberger. The write-up explains how a single prompt injection writes one line to a settings file, flips the agent into auto-approve mode, then executes shell commands for full RCE on the developer's machine. Details →First reported · updated · 43 reports ulad.net
Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service
A Microsoft App Service blog reports that only 8.5% of Model Context Protocol (MCP) servers implement OAuth, leaving the large majority exposed without proper client authentication, and provides guidance on hosting an MCP server securely on Azure App Service with OAuth-based access controls. The piece frames unauthenticated MCP servers — the connectors that bridge AI agents to tools and data — as a widespread security gap and walks through hardening recommendations. Details →First reported medium.com
SSRF Explained: The Vulnerability Quietly Behind Some of 2026’s Biggest AI Agent Breaches | by Raj Namdev | CodeToDeploy
A Medium explainer by Raj Namdev breaks down Server-Side Request Forgery (SSRF) and argues it is resurging as a major risk because AI agent servers and tool integrations fetch, forward, and act on URLs supplied by users or by the AI model itself. The piece describes what SSRF is, why the growth of AI agent servers creates a larger attack surface, and how to remediate it. Details →First reported sandboxreview.com
AI Sandbox Requirements for Code Interpreter Agents
Sandbox Review's analysis surveys the attack surface of code-interpreter AI agents, covering prompt injection into processed content, malicious MCP tools that inherit agent permissions, the late-2025 npm supply-chain campaign (including the Cline VS Code extension compromise), Pillar Security's mid-2026 'indirect sandbox escape' disclosures against Cursor, Codex, Gemini CLI and Antigravity, and the CIRCLE benchmark of 1,260 resource-exhaustion prompts. The piece synthesizes these existing findings to argue that sandboxes must enforce unconditional limits and treat any agent-writable input a host later trusts as part of the blast radius. Details →First reported · updated · 2 reports atlan.com
Multi-Agent AI Security: 5 Compositional Risks and Fixes [2026]
An analysis piece on multi-agent AI security surveys compositional risks in agentic deployments — control-plane and orchestration-layer compromise, non-human identity gaps, credential persistence and scope creep, MCP server exposure, and static-permission failures — and proposes fixes like just-in-time least privilege and verification gates. The related arXiv paper systematically characterizes 193 MAS threat items across nine categories and evaluates 16 AI security frameworks, finding none achieves majority coverage of any single category and that Non-Determinism and Data Leakage are the most under-addressed. Details →First reported visualstudio.com
AI security in VS Code
VS Code documentation describes built-in security controls for AI-powered agentic development, including Workspace Trust restricted mode, agent sandboxing to limit file system and network access, mandatory review of file edits, protection of sensitive files, session-scoped auto-approval, and vetting of MCP servers before trusting them. The page frames these as trust boundaries to limit the impact of autonomous agent actions on untrusted projects. Details →First reported darkreading.com
The Real AI Agent Attack Surface
A BeyondTrust Phantom Labs Partner Perspectives piece argues that the primary attack surface for AI agents is not the model but the toolsets and permissions agents receive after deployment, exposed via the MCP protocol. Researcher Tyler Jespersen uses examples such as Bash toolsets (which can expose container credentials and enable container breakout) and email toolsets (weaponizable for phishing) to show how privilege and access broaden an agent's risk. Details →First reported · updated · 6 reports aquilax.ai
Shadow MCP: Find and Lock Down Rogue MCP Servers | PipeLab
"Shadow MCP" describes the emerging risk of employees deploying unvetted Model Context Protocol servers without IT oversight, granting AI agents direct access to production databases, file systems, and internal APIs. The article, from AquilaX/PipeLab, frames this as 2026's shadow-IT problem and discusses discovering and locking down rogue MCP servers. Details →First reported iluxav.com
AI Agent Security: The Missing Authorization Boundary
An analysis piece by Ilya Vinokurov argues that AI agents holding bearer credentials (e.g. for GitHub or MCP servers) create a missing authorization boundary: downstream services can verify a caller is permitted but cannot verify the human actually intended the action. The article invokes Simon Willison's 'lethal trifecta' (private data, untrusted content, external communication) to explain how prompt injection can turn authorized agent actions into data exfiltration, and argues that model-level guardrails should not be the final authorization boundary. Details →First reported modelcontextprotocol.io
Understanding Authorization in MCP
Official Model Context Protocol documentation explains how authorization works for MCP servers, describing standardized OAuth 2.1-based flows, Protected Resource Metadata discovery, and 401/WWW-Authenticate handshakes used to secure access to sensitive resources and operations exposed by MCP servers. The tutorial covers when authorization is recommended and how local (STDIO) versus remote (HTTP) transports differ in credential handling. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector