First reported arxiv.org
Research · latest
First reported arxiv.org
Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)
Researchers from Ben-Gurion University and Intuit present a systematic security analysis of Google's Agent Payments Protocol (AP2) v0.2, which lets LLM-driven shopping agents authorize and execute payments. Using the MAESTRO framework they model threat actors, attack surfaces, and adversary capabilities, cataloging 48 threats across five attack families, scoring them with AIVSS, building a testbed across five deployment architectures, and developing proof-of-concept demonstrations for eight High-risk threats plus a deployment-aware scanner. Their key finding: valid mandate signatures alone do not guarantee an agent-mediated transaction reflects user intent when pre-authorization context (A2A messages, MCP tool calls) is manipulated. Details →First reported checkpoint.com
Black Hat 2026: AI Agent Framework Flaws Expose Secrets
Check Point researchers Shahar Tal and Yarden Porat presented at Black Hat 2026 an audit of major AI agent frameworks — LangChain, CrewAI, Microsoft Agent Framework and Google's ADK — uncovering 21 findings across eight codebases including 12 CVEs. The flaws are classic vulnerability classes (unsafe deserialization, SSRF, SQL injection, sandbox escape, arbitrary file read, memory corruption, PDF-parser RCE) reachable via post-injection exploitation, where attacker-controlled content poisons an agent's memory and triggers the framework's own internal plumbing to steal credentials and data without calling dangerous functions directly. Details →First reported arxiv.org
TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers
TrustShiftProbe is a research framework characterizing 'TrustShift', a server-side attack where a compromised MCP server behaves benignly during a conditioning phase to build agent reliance before switching to an adversarial payload once a trust threshold is reached, evading pre-deployment static analysis. The paper introduces a temporal threat model, a language-agnostic attack engine instantiating nine variants across four domains, and 'Shield', a runtime defense at the MCP transport boundary; attacks reach a 69.5% mean success rate that Shield reduces to 42.7%. Details →First reported ieee.org
When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents
The paper "When the Manual Lies" presents MCP-TDP, a realistic security benchmark to evaluate tool-description poisoning attacks against LLM agents that use the Model Context Protocol. The authors describe a covert attack surface targeting the agent's cognitive planning layer via poisoned MCP tool manuals/descriptions, and systematically evaluate agent behavior and defensive responses. Details →First reported medium.com
MCP Tool Poisoning: $500 Stolen via a Tool Description
A red-team write-up by Safiullah Khan demonstrates MCP (Model Context Protocol) tool poisoning, where malicious instructions embedded in a tool's description manipulate an AI agent into taking unauthorized actions — in this lab case, moving $500. The piece is Part 6 of an AI security series and highlights that MCP tool metadata is an attack surface controlled by whoever runs the MCP server. Details →First reported daily.dev
Otto Support - The Confused Deputy
Bishop Fox's otto-support CTF demonstrates confused deputy attacks against AI agents, where an agent reads attacker-controlled content (a poisoned support ticket, email, or calendar invite) and executes hidden instructions using its own legitimate privileges. The write-up reproduces the scenario via IDOR-based ticket poisoning and metadata service abuse to escalate into a support-agent role, referencing real-world cases like EchoLeak, ConfusedPilot, and Copilot calendar exploits, and proposes mitigations such as data/instruction separation, per-task tool registration, least privilege, human-in-the-loop, and egress controls. Details →First reported arxiv.org
Model Context Protocol (MCP) at First Glance:Studying the Security and Maintainability of MCP Servers
An empirical study (arXiv:2506.13538) analyzes 1,899 open-source Model Context Protocol (MCP) servers using a hybrid static-analysis and MCP-specific scanning pipeline, finding eight distinct vulnerability types with 7.2% of servers containing general vulnerabilities and 5.5% exhibiting MCP-specific tool poisoning. The authors argue for MCP-specific vulnerability detection, standardized vulnerability databases, and automated scanning within MCP registries. Details →First reported asset-group.github.io
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
ASSET Research Group's GhostSplice research shows a malicious MCP (Model Context Protocol) server can exfiltrate SSH keys, environment secrets, source code, and customer data from AI coding assistants by splitting a malicious request into individually benign fragments placed across tool descriptions, tool results, and server-initiated sampling. Because the agent combines instructions across these channels in a shared working context, no single fragment carries the whole malicious request, allowing the attack to succeed even after a blunt version of the same theft is refused. Details →First reported · updated · 3 reports arxiv.org
Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale
An arXiv paper by Nicolás Padilla presents the first dynamic behavioral security assessment of internet-facing Model Context Protocol (MCP) servers, discovering over 21,000 instances, confirming 640 production servers, and dynamically auditing 414 using Corvus, a purpose-built framework with 34 test modules across 10 MCP-specific vulnerability classes. The study uncovered 68 reportable vulnerabilities including SQL injection, SSRF targeting cloud metadata, prompt template injection, and path traversal, and found 91.8% of audited servers lack OAuth authentication and 687 tool instances exposing shell execution without access controls. The authors release Corvus as an open-source MCP security evaluation framework. Details →First reported cyera.com
The Hidden Attack Surface of Agentic AI: Securing AI Agent Integration Platforms
Cyera researchers examined the AI agent integration layer across hundreds of organizations and found thousands of exposed credentials—API keys for platforms like Composio, Arcade, Nango, Tavily, Exa, LlamaIndex, and Firecrawl that connect LLMs and autonomous agents to enterprise systems. In one case a VP of Engineering committed a Composio API key to a public repository, which could give an attacker visibility into and possibly execution control over the organization's AI agent ecosystem. Details →First reported nhimg.org
AI agent attacks are bypassing legacy controls and leaving no trace
Straiker's STAR Labs research report, summarized by NHIMG, describes more than 1,700 successful adversarial scenarios against coding, productivity, and first-party AI agents (including Cursor, Claude Code, and GitHub Copilot). It found 36% of successful coding-agent attacks reached remote code execution on developer machines, 91% of successful productivity-agent attacks ended in silent data exfiltration, and 24% of 17,651+ tracked Model Context Protocol servers carry at least one vulnerability. Details →First reported datadoghq.com
Before the first prompt: Code execution paths in trusted coding-agent projects | Datadog Security Labs
Datadog Security Labs demonstrates that trusting a repository in coding agents such as OpenAI Codex and Claude Code can trigger repository-controlled code execution before the first prompt, without a model response or shell-command approval. In Codex, project-scoped MCP configurations start an attacker-controlled process, and in Claude Code a project-controlled PATH causes Claude's automatic Git probes to run a tracked repository wrapper — bypassing hook-approval controls. Details →First reported · updated · 2 reports arxiv.org
Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability
A large-scale study, "Rethinking MCP Security" (arXiv:2607.11086), presents MCPZoo, the largest collection of MCP servers for dynamic analysis (64,611 unique servers, 37,288+ runnable), and measures the reliability of MCP security scanners. While existing scanners flag 96.89% of servers as risky, the authors find fewer than 50% of sampled alerts are true positives and that scanner outputs are inconsistent across tools. Details →First reported darkreading.com
AI Harnesses Burst With Potential Exploit Opps
Researchers at AI penetration-testing firm Novee Security demonstrated that trust misalignments between the components of AI 'harnesses' (the software frameworks providing tools, memory, and guardrails around LLMs) can be exploited, including using Google's AI agent to execute a supply-chain attack and write to its own GitHub repository, per Dark Reading. The team also reported finding exploitable trust issues in Anthropic's and OpenAI's AI agents. Details →First reported arxiv.org
MCP Pitfall Lab: Exposing Developer Pitfalls in MCP Tool Server Security under Multi-Vector Attacks
MCP Pitfall Lab is a protocol-aware security testing framework that models developer pitfalls in Model Context Protocol tool servers as reproducible scenarios and validates outcomes with MCP traces rather than agent self-report. Across 2,579 validator-completed runs over four models, it observed a 31.9% overall attack success rate (with multi-modal injection strongest at 38.7%) and introduces a Semantic MCP Bill-of-Materials to inventory tool semantics, trust boundaries, and audit support for hardening. Details →First reported · updated · 4 reports arxiv.org
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
An arXiv paper (arXiv:2607.07461) systematically analyzes taint-style vulnerabilities in Model Context Protocol (MCP) servers, finding they constitute a substantial fraction of MCP flaws, are hard to remediate, and receive slow community responses. The authors propose SPELLSMITH, which embeds behavioral guidance into MCP tool Descriptions and uses LLM self-reflection to identify and mitigate taint-style vulnerability exploitation at the tool-description level rather than via code fixes. Details →First reported arxiv.org
ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP
ShareLock is a research framework that performs a stealthy multi-tool threshold poisoning attack against the Model Context Protocol (MCP), using Shamir's secret-sharing scheme to distribute a malicious instruction as benign-looking shares across multiple tool descriptions that reconstruct into a hidden instruction only after a covert trigger is planted during a server update. Experiments across mainstream LLMs and two MCP clients report an average attack success rate exceeding 90% while evading tool-description-based detectors. Details →First reported arxiv.org
FlowGuard: From Signals to Evidence for MCP Security Detection
FlowGuard is an evidence-grounded MCP security detection system that verifies execution-related risks (like command injection and file system access) through runtime evidence rather than suspicious semantic signals alone, and detects semantic risks in tool metadata and returned content. Evaluated on a 1,880-case executable benchmark across five vulnerability categories, it achieves F1 scores of 0.879 and 0.942 on Command Injection and File System Access, reduces latency up to 2.23x versus existing dynamic scanners, and reported 523 findings across 326 real-world servers. Details →First reported aicerts.ai
New MCP Benchmark Highlights Server Drift Dangers
An MCP Benchmark study scanned 10,831 Model Context Protocol servers and linked poor tool-description quality ("description smells" like missing return fields, wrong parameter semantics, and duplicate tool names) to measurably higher exploitation rates, with servers rated 'poor' tripling successful-attack probability. The research characterizes 'MCP drift' — unreviewed post-deployment changes to tool descriptions, parameters, or capabilities — as a live supply-chain threat, sometimes via benign onboarding followed by malicious rewrites weeks later, and notes simple 27-line mitigations eliminated high-severity findings in lab tests. Details →First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported promptarmor.com
Connecting AI agents to outside services explodes the risk radius
The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa's AI Red Teaming Agent was pointed at GitHub's open-source Secure Code Game 'ProdBot' challenge (Season 4, agentic AI track), an intentionally vulnerable teaching target where the flag lives in ../password.txt outside the agent's sandbox. The agent autonomously cleared the first three levels (Sandbox, Web, MCP) at 100/100 in a 57-second run, relying not on jailbreak vocabulary but on 'context seeding' — fabricating a plausible prior workflow in which authentication had already occurred. The write-up frames each added agent capability (sandbox, web, MCP, skills/memory, multi-agent) as a new attack surface enabling prompt injection, indirect injection, poisoned tool chains, over-scoped skills, and confused-deputy trust. Details →First reported arxiv.org
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported aminrj.com
Deleting the Malicious MCP Server Doesn't Save You | Amine Raji, PhD
A lab-built demonstration (mcp-attack-labs, Lab 08) chains MCP tool-description poisoning into an Agent-to-Agent (A2A) intrusion: a poisoned tool instructs the compromised agent to register a rogue A2A agent, hijack routing via shadowing, exfiltrate data, and persist even after the malicious MCP server is deleted. Each stage maps to a named vulnerability class (OWASP MCP Top 10 MCP03, ASI10, ASI07) and is paired with a detection that fires on it. Details →First reported · updated · 2 reports canopii.dev
State of MCP Security 2026 v2
Canopii's "State of MCP Security 2026" report scanned more than 11,000 published Model Context Protocol servers and found 830 graded D or F, 232 with confirmed dangerous code sinks (eval, shell injection, unsafe deserialization) that can turn prompt injection into host code execution, 184 versions that silently altered tool definitions after publication ("rug pulls"), 1,617 servers shipping dependencies with known vulnerabilities, 260 running install-time scripts, and 7 confirmed typosquats. Popular servers with 1,000+ GitHub stars were over 5x more likely to be high-risk. Details →First reported mcpexplorer.com
We Ran a Live Handshake Against 995 MCP Servers. Only 39 Are Verified.
MCPExplorer ran a live MCP `tools/list` handshake against all 995 servers in its index on July 4, 2026; only 277 answered and just 39 met their verification bar. The scan found 59% of reachable servers expose at least one write tool, 67 expose destructive tools (e.g. `delete_instance`, `revoke_api_key`, `wipeLogs`), 467 have unknown provenance, and 30 different servers expose an identically-named `search` tool creating tool-name collision risks for agents. Details →First reported openaca.dev
Your Agent Risk Isn't in One Plugin. It's in the Composition.
OpenACA analyzes how agentic AI risk emerges from the composition of plugins, MCP servers, skills, and npm dependencies rather than any single component, using the Claude Code 'imessage' plugin as an example (a local MCP server reading chat.db, sending iMessages, with skills that rewrite access policy). They scanned the official Claude plugin marketplace (62 manifests, 530 components) and found all 124 known-vulnerability advisories clustered in the four message-channel plugins (discord, telegram, fakechat, imessage) that ingest untrusted input and can exfiltrate local files, arguing SCA and runtime monitoring miss this composition-level exposure. Details →First reported snyk.io
What nearly 10,000 developer environments reveal about agentic development risk
Snyk analyzed nearly 10,000 developer environments to examine risks introduced by AI coding agents as a new layer in the software supply chain, highlighting issues around tools, instructions, and permissions in agentic development. Details →First reported lateos.ai
GPT-5 Nano IPI Assessment — LLM Vulnerability Research
A black-box prompt injection susceptibility assessment of GPT-5 Nano using the IPI Taxonomy v0.13 across 201 analyzed test cases, reporting a 38.3% overall susceptibility rate. The model was fully resistant to surface-level attacks (CSS concealment, HTML cloaking, SEO phishing, RAG corpus poisoning) but highly vulnerable to recursive instruction framing (100%) and MCP tool description poisoning (80%). Details →First reported trendmicro.com
Pwning Agentic AI Part I: Your AI Agent Is Already Compromised | Trend Micro (US)
Trend Micro's TrendAI Research describes a new agentic-AI exploitation pattern they call return-to-tool (RTT) exploits, where embedded instructions in benign-looking untrusted input cause an AI agent to invoke its authorized tools to perform attacker-intended actions such as exfiltrating production database credentials. The research notes a vulnerable PostgreSQL MCP server image pulled over 100,000 times from Docker Hub as a realistic exposure vector. Details →First reported originhq.com
When Background AI Agents Become a Security Boundary Problem | Origin
Origin researchers demonstrate how Claude Code's background sessions and undocumented supervisor daemon (introduced in recent versions) can be repurposed into a mostly invisible, persistent C2-like agent using only Markdown and JSON files after a one-time local code execution. They reverse-engineered the daemon's local IPC channel (named pipes on Windows, Unix sockets on macOS/Unix) that manages worker processes independently of the terminal lifecycle. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector