First reported · updated · 3 reports redhat.com
Lead dispatch
First reported · updated · 2 reports island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
The FakeGit campaign, detailed by Island security researcher Oleg Zaytsev, uses roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware, which establishes persistence and installs the StealC information stealer. Researchers coined the technique 'AgentBaiting,' where AI agents like Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious READMEs as legitimate documentation, and hand installation instructions to users; the operation recorded over 14 million downloads and peaked in April 2026.supply-chain · tool-abuse · malware-distribution · agent-baiting
mcp · ai-agents · llm · github
Severity
0.78
The wire · latest
First reported etheon.ai
AI Secrets Management for AI Agents | Etheon
Etheon's guide on AI secrets management argues that as AI agents move from answering questions to taking actions—calling tools, querying databases, triggering workflows—exposed credentials become a major risk, and that the model should never see, store, log, or handle production secrets. Drawing on OWASP's LLM and Agentic Top 10 lists, Microsoft research on MCP tool poisoning, and Cloud Security Alliance guidance, it recommends deterministic infrastructure outside the model to handle credential retrieval, dedicated agent identities, and least-privilege access. Details →First reported obot.ai
MCP Observability Explained: Monitoring AI Agent Tool Access
An Obot explainer defines "MCP observability" as the ability to monitor, inspect, and audit AI agent activity across Model Context Protocol server connections, covering tool invocations, policy decisions, authentication, sensitive-data handling, and audit trails. The piece argues normal application monitoring is insufficient once agents can reach Slack, GitHub, Snowflake, databases and internal APIs, and outlines what enterprises should log for accountability. Details →First reported · updated · 2 reports manifold.security
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
Manifold Security disclosed a confused-deputy vulnerability in Microsoft's official Azure DevOps MCP server where a pull request description tool returned PR text without the prompt-injection guardrail applied to other tools. An attacker can embed an invisible HTML comment in a PR description that renders as nothing in the web UI but is passed verbatim to a reviewer's AI coding agent, hijacking it to access projects the attacker cannot reach and exfiltrate what it finds. Microsoft addressed the issue in a subsequent release (v2.8.0). Details →First reported embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
AWS Kiro, an agentic coding IDE, was vulnerable to arbitrary command execution via indirect prompt injection: hidden text on a web page (or a comment in a source file) processed by the agent could make Kiro use its no-approval fsWrite tool to rewrite ~/.kiro/settings/mcp.json (or allowlist all Bash commands in .vscode/settings.json), causing it to launch attacker-specified MCP servers/commands and achieve RCE on the developer's machine, bypassing the human 'allow' approval boundary. Discovered by Intezer with Kodem Security and independently by Embrace The Red (Johann Rehberger); AWS has patched the issue. Details →First reported mitiga.io
Modern Malware — Spyware Skills, Hijacked Base URLs, and 1,230+ Leaking API Keys in AI Instruction Files
Mitiga Labs details malware hidden in AI agent instruction files — Cursor rules, Anthropic Skills, Claude Hooks, AGENTS.md/CLAUDE.md context files, MCP server configs, and .pyc droppers — that AI agents follow with near-zero validation. The research found prompt-exfiltration tradecraft caught in the wild, attacker-controlled ANTHROPIC_BASE_URL overrides routing Claude traffic through MITM proxies, permission-bypass defaults, and over 1,230 hardcoded API keys and JWT tokens across tens of services. Mitiga also released a free scanner, Skillgate, built during the investigation. Details →First reported youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP
A recorded EC-Council CyberTalks webinar by Salesforce Product Security Principal Jason Ross covers data poisoning attacks against machine learning and agentic AI systems, walking through the ML lifecycle attack surface, AI supply-chain risks (including Hugging Face attacks and sleeper-agent backdoors), RAG embedding-database poisoning, cascading poisoning, and MCP exploitation examples such as GitHub and WhatsApp MCP abuse. The session also outlines mitigation strategies including secure data sourcing, validation, monitoring, and governance frameworks. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported deepinspect.ai
MCP Server Supply Chain Security: The Install Path Nobody Reviews
A DeepInspect analysis lays out five review gates for securing the MCP server supply chain, arguing that adding a third-party MCP server grants code execution, credential access, and text injection with far less scrutiny than an npm dependency. It cites CSA/OX Security research finding 9 of 11 MCP marketplaces affected by a STDIO-interface design flaw, 40+ MCP CVEs in early 2026 (including CVE-2026-33032 in nginx-ui MCP and CVE-2026-0755 in gemini-mcp-tool, both CVSS 9.8), and details tool-description poisoning as indirect prompt injection (MITRE ATLAS AML.T0051.001). Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported keycard.ai
The Agent Security Stack: Transport, Identity, Policy, Runtime
A Keycard explainer maps the "agent security stack" into distinct layers — transport (MCP/OAuth 2.1 authorization), identity, policy, and runtime guardrails that watch for prompt injection — arguing that agent security cannot be collapsed into a single control surface. The piece frames how multi-agent call chains multiply control surfaces (LLM tool invocation, transport, credential, authorization) and argues identity/authorization is the most under-served layer, citing recent CrowdStrike/SGNL and Palo Alto/CyberArk acquisitions. Details →First reported · updated · 3 reports appsentinels.ai
One Poisoned MCP Server Can Hijack All the Others — Coograph
MCP tool poisoning hides malicious instructions inside a Model Context Protocol server's tool descriptions, parameter schemas, or return values — invisible to human reviewers but fully read by the LLM, which then selects and executes the poisoned tool, enabling data exfiltration, credential theft, or lateral movement. The technique spans schema poisoning, tool shadowing, and rug pulls, and is catalogued as OWASP MCP03:2025; a single malicious server can influence an agent's decisions across all connected tools (cross-tool poisoning). Details →First reported · updated · 25 reports ulad.net
Only 8.5% of MCP Servers Use OAuth — Here's How to Host One Securely on App Service | Microsoft Community Hub
A Microsoft App Service blog reports that only 8.5% of Model Context Protocol (MCP) servers implement OAuth, leaving the vast majority without client authentication, and provides guidance on hosting an MCP server securely with OAuth on Azure App Service. The piece frames unauthenticated MCP servers as an exposed gateway for AI agents to sensitive data and offers hardening recommendations. Details →First reported · updated · 2 reports arxiv.org
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
The paper 'Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions' systematically analyzes vulnerabilities in Model Context Protocol (MCP) servers, finding that taint-style vulnerabilities (e.g., SSRF as in the Markdownify server, CVE-2025-5276) make up a substantial fraction and are slow to be remediated. It proposes SpellSmith, which builds tool-level risk profiles and embeds behavioral guidance into MCP tool descriptions plus LLM self-reflection to mitigate exploitation without code-level fixes. Details →First reported asana.com
Breaking the Lethal Trifecta: How Asana Thinks About Agentic AI Security • Asana
Asana engineering explains how it approaches agentic AI security using Simon Willison's "lethal trifecta" framework — the convergence of access to sensitive data, exposure to untrusted content, and the ability to externally communicate (create side effects) that together enable prompt-injection attacks. The piece argues that since prompt injection cannot be reliably solved, defenders should break at least one leg of the trifecta, citing demonstrated attacks against Microsoft 365 Copilot (EchoLeak), GitHub's MCP server, and Slack AI. Details →First reported barndoor.ai
MCP Gateway Requirements for Enterprise Security Teams
Barndoor's blog outlines security requirements for enterprise MCP (Model Context Protocol) gateways, arguing that most MCP deployments lack access controls and identifying five gaps: all-or-nothing tool permissions, no user scoping, silent vendor-side changes, fragmented policy across AI clients, and unfiltered sensitive data. It recommends per-tool policy enforcement, IdP-driven identity, change management, and a default-deny posture. Details →First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported medium.com
The Last Patch. The MCP Attack Surface We’re Building… | by Zac | Jul, 2026
An opinion piece by Zac on Medium argues that the rush to expose MCP endpoints and build agent-to-agent (A2A) orchestration is creating a large new attack surface, where every MCP endpoint is an agent-callable function and every A2A handoff is a traversable trust boundary. The article draws on Anthropic's report mapping 832 accounts banned for malicious cyber activity (March 2025–March 2026) against MITRE ATT&CK, noting medium-or-higher-risk actors rose from 33% to 56% and that AI is increasingly used deeper in the attack lifecycle. Details →First reported medium.com
Prompt Injection Is Just SSRF for Text | MCP Security → Part 3 | by Abhishek meena | Jul, 2026
Part 3 of an MCP bug bounty guide by Abhishek meena frames MCP prompt injection as analogous to SSRF: tool outputs (URLs, files, emails, API responses) are attacker-controlled text that the model reads and treats as instructions. The write-up explains how to find, exploit, and argue indirect prompt injection via tool output, with sanitized PoCs referenced. Details →First reported traefik.io
MCP Gateway Best Practices | Traefik Hub Documentation
Traefik Hub documentation outlines security best practices for deploying an MCP Gateway in production, covering On-Behalf-Of (OBO) token delegation per RFC 8693, Task-Based Access Control (TBAC) for AI agents, and a defense-in-depth 'Triple Gate' pattern. The guidance emphasizes least-privilege access so that a compromised MCP server does not grant an attacker access to all backend resources. Details →First reported promptarmor.com
Connecting AI agents to outside services explodes the risk radius
The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →First reported swarmnetics.com
Agentjacking and MCP trust: are AI coding agents too easy to steer?
Agentjacking, described by Swarmnetics and Tenet Security, abuses trusted error-report inputs in AI coding agents: an attacker with a publicly exposed Sentry DSN can inject malicious instructions into telemetry that the agent processes, steering it to exfiltrate secrets such as cloud keys, Git credentials, and private repo URLs. The root flaw is that these systems treat source trust as if it equals action trust, letting external report text become executable guidance. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →First reported · updated · 3 reports medium.com
Your AI Agent Trusts Every Tool It's Ever Been Introduced To
An analysis piece, 'The MCP paradox,' argues that the Model Context Protocol standardized not only how agents reach tools but also how attackers reach agents, walking through concrete vectors like tool poisoning attacks where a malicious tool description instructs an agent to exfiltrate secrets (e.g. SSH keys) via text the user never sees. The article cites Invariant Labs' April 2025 tool-poisoning proof of concept and MCP's own design choices, and proposes defensive controls to harden MCP servers. Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol | ACM Transactions on Software Engineering and Methodology
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported qianxin.com
NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era
NadMesh is a Go-based botnet observed in early July 2026 by QiAnXin's XLab that autonomously scans for and exploits exposed AI services — ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — using a Shodan harvester (ai_harvest.py) to prioritize AI infrastructure and the MCP ecosystem. It folds scanning, 20+ RCE exploitation vectors (Redis, Docker, MCP, Kubernetes), credential/AI-service intelligence harvesting, polymorphic builds, and redundant persistence into a single productized platform; the operator's dashboard claims 3,811 unique AWS keys plus model inventories tagged as cloud services. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported · updated · 4 reports reversinglabs.com
MCP Supply Chain Attacks: Why Better Models Make It Worse
A dope.security blog post argues that the Model Context Protocol (MCP) has become a new shadow-IT and supply-chain risk because MCP servers create outbound HTTPS connections that read files, hit APIs, and move data on an agent's behalf while looking indistinguishable from ordinary encrypted traffic. It contends DNS filters and cloud proxies cannot see the URL paths, payloads, or tool calls inside MCP sessions, and promotes the vendor's device-level SWG and DLP as a means to name, allow, or block MCP servers at egress. Details →First reported clawsecure.ai
AI Agent Security: The Complete 2026 Guide
ClawSecure's blog post is a 2026 explainer guide on AI agent security, describing why autonomous agents break traditional security (broad access, autonomy, and treating data as instructions) and cataloging risks like prompt injection, tool poisoning, credential theft, and data exfiltration mapped to the OWASP Top 10 for Agentic Applications. It cites ClawSecure's finding that 41% of popular OpenClaw skills carry security vulnerabilities and promotes the company's runtime monitoring and integrity-layer product. Details →First reported · updated · 3 reports theregister.com
Red teamers turned Claude Desktop into a double agent to do their evil bidding
Oasis Security disclosed "PromptFiction," a vulnerability in Anthropic's Claude Desktop where a single click on a trusted-looking claude:// URL silently submitted attacker-controlled prompts to the assistant with no user confirmation. Chained with the earlier "Claudy Day" trio of flaws, it could enable silent exfiltration of prior conversations and — when Anthropic's official Filesystem MCP server is installed — file read/write, persistence, and remote code execution. Anthropic has fixed the flaw. Details →First reported github.com
GitHub - AlwaysReadyAllies/warden: Drop-in security proxy for MCP — policy, tamper-evident audit, human approval, prompt-injection & secret-exfil defense. One line of config, zero code.
Warden is an open-source drop-in security proxy for the Model Context Protocol (MCP) that adds policy enforcement, tamper-evident audit logging, human approval gates, and defenses against prompt injection and secret exfiltration. The GitHub repository includes policies, examples, a SECURITY.md threat model, and a CI test matrix, and is configured via one line of config with no code changes. Details →First reported github.com
GitHub - gaur-avvv/wormxgpt: No limits. No filters. No restrictions. WormXGPT is a unified AI tooling suite containing both a premium Hacker-themed React Web Dashboard and an advanced Unfiltered CLI agent. It features 150+ tools, multi-server MCP integration, auto-fallback across 30+ providers, and local workspace integration.
WormXGPT is a GitHub-published "unfiltered" AI tooling suite (repo gaur-avvv/wormxgpt) marketed with the tagline "No limits. No filters. No restrictions," combining a hacker-themed web dashboard and a CLI agent with 150+ tools, multi-server MCP integration, and auto-fallback across 30+ AI providers. The project is presented as an unrestricted, jailbroken AI agent framework echoing WormGPT-style malicious LLM tooling. Details →First reported mitiga.io
MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain
Mitiga Labs research details a man-in-the-middle attack chain against Claude Code in which a user-level post-install hook rewrites MCP server endpoints in ~/.claude.json to route MCP traffic through attacker-controlled infrastructure and steal OAuth tokens for connected SaaS (Jira, Confluence, GitHub, etc.). Because provider-side audit logs still show valid OAuth traffic from Anthropic's trusted egress range, the malicious activity blends in as legitimate user actions, and token rotation fails to break the chain while the hook keeps reseeding the config. Details →First reported · updated · 2 reports adversa.ai
The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
Adversa AI researcher Rony Utevsky details a Cursor IDE vulnerability (dubbed DeepJack) where a crafted `cursor://` deeplink installs an attacker-controlled MCP server that runs arbitrary, unsandboxed commands under the victim's account after one click and one confirmation. The install dialog renders the command in a single-line field so a malicious tail is pushed off-screen, and double-URL encoding disguises the `mcp/install` URI as a routine `pr-review` link. Cursor acknowledged the root cause but closed the reports as duplicates, and build 3.9.8 reportedly remains vulnerable. Details →First reported google.com
Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation
Google Cloud documentation for the Data Agent Kit extension in the Antigravity IDE describes indirect prompt injection risks from Google Cloud MCP, where locally deployed coding agents running with a user's full privileges can misinterpret attacker-planted data (e.g., in email, calendar, Cloud Storage, or BigQuery) as instructions. The guidance recommends guardrails such as running agents in constrained environments to reduce risk to infrastructure and data. Details →First reported medium.com
Why Your MCP Server Fails Its First Security Review: 14 Gaps and a Scorecard (TypeScript Edition) | by Rick Hightower | Jun, 2026 | Spillwave Solutions
Rick Hightower's article presents a TypeScript-focused security-review checklist for Model Context Protocol (MCP) servers, enumerating 14 production gaps including shared API keys, missing audit logs, prompt-only guardrails, prompt injection through tool results, weak tenant isolation, non-idempotent mutations, schema drift, unmanaged secrets, and missing DLP, plus a maturity scorecard. It offers code patterns to close the most dangerous gaps and hardening guidance for moving MCP servers from demo to production. Details →First reported arxiv.org
Rethinking MCP Security: A Large-Scale Study of Runtime MCP Servers and Security Scanner Reliability
The paper "Rethinking MCP Security" presents MCPZoo, the largest collection of runtime Model Context Protocol (MCP) servers for dynamic analysis (64,611 unique servers, 37,288+ supporting dynamic analysis), built via a multi-agent framework that transforms static repositories into runnable services. Using it, the authors conduct an ecosystem-scale measurement showing that while existing MCP security scanners flag 96.89% of servers as risky, manual validation finds under 50% of sampled alerts are true positives, with inconsistent outputs across scanners. Details →First reported sans.edu
Someone Is Scanning for Your MCP Servers and AI Assistant Credentials
A SANS ISC diary by Manuel Humberto Santander Peláez reports that analysis of 14 days of Apache/ModSecurity logs from a small web host revealed distributed internet scanning specifically targeting Model Context Protocol (MCP) servers, AI assistant configuration files, and locally exposed LLM endpoints. Notably, the POST /mcp probes carried valid JSON-RPC 2.0 MCP 'initialize' handshakes from 49 distinct source IPs, indicating scanners that speak the protocol and would enumerate tools and data sources if a real MCP server responded. Details →First reported · updated · 2 reports cloudsecurityalliance.org
MCP Security in the Cloud: Where the Real Risks Begin
A Darktrace/CSA analysis (drawing on the arXiv paper 'Securing the Model Context Protocol (MCP): Risks, Controls, and Governance') outlines seven MCP security risks CISOs should prepare for, including content-injection/prompt-injection attacks, over-privileged agents, tool poisoning, supply-chain compromise via malicious MCP servers, and data exfiltration. It notes MCP handles only connection mechanics without built-in identity or access controls, amplifying the 'lethal trifecta' of sensitive-data access, untrusted content exposure, and external communication. Details →First reported arxiv.org
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
A systematization-of-knowledge paper by Mohammadreza Rashidi organizes 39 works (2023-2026) on execution security for AI coding agents into 17 categories covering sandbox isolation, capability/access control, policy enforcement, TOCTOU races, and MCP threats, and verifies four disclosed, patched CVEs affecting production agent harnesses. It surfaces five cross-cutting gaps, including denylist policy failure rates of 69-98% and benign out-of-scope agent actions occurring at rates up to 17.1% under realistic prompting. Details →First reported github.com
GitHub - pydantic/monty: A minimal, secure Python interpreter written in Rust for use by AI
Monty, from Pydantic, is a minimal, secure Python interpreter written in Rust intended for use by AI agents to execute generated code safely. It targets the emerging 'code mode' pattern where LLM agents write and run code to call MCP tools rather than invoking them directly, aiming to sandbox that execution. Details →First reported howtoharden.com
Cursor Hardening Guide
The Cursor Hardening Guide from howtoharden.com compiles defensive controls for the Cursor AI code editor, covering AI privacy settings, MCP server security, agent sandboxing, API key management, rules-file integrity, and extension supply-chain risk. It draws on 2025-2026 CVE analysis (including CurXecute RCE via MCP prompt injection CVE-2025-54135, MCPoison persistent compromise CVE-2025-54136, and sandbox/file-overwrite bugs) and ships runnable config packs mapped to OWASP LLM/Agentic Top 10, NIST AI RMF, and MITRE ATLAS. Details →First reported snyk.io
Cursor’s AI Security Agents: What They Get Right (and What’s Missing)
Snyk analyzes Cursor's four autonomous AI security agents, which review 3,000+ PRs weekly and catch 200+ vulnerabilities using a short prompt sitting atop a production-grade agent orchestration platform (custom MCP server, webhook orchestration, state management). The piece praises the engineering while arguing there is a meaningful gap between LLM agents reviewing PRs and a full enterprise security program. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported powerdmarc.com
Malicious MCP Servers & Email Security: The New Supply Chain Threat
The article analyzes the postmark-mcp incident, where a malicious actor published an exact-name lookalike npm package impersonating Postmark's official Model Context Protocol (MCP) server. Across 15 clean releases it built trust before adding a hidden BCC rule that silently forwarded 3,000-15,000 corporate emails per day to an attacker-controlled domain, leaking passwords, invoices, customer data, and auth tokens; because mail flowed through legitimate infrastructure, SPF and DKIM passed automatically. Details →First reported aminrj.com
Deleting the Malicious MCP Server Doesn't Save You | Amine Raji, PhD
A lab-built demonstration (mcp-attack-labs, Lab 08) chains MCP tool-description poisoning into an Agent-to-Agent (A2A) intrusion: a poisoned tool instructs the compromised agent to register a rogue A2A agent, hijack routing via shadowing, exfiltrate data, and persist even after the malicious MCP server is deleted. Each stage maps to a named vulnerability class (OWASP MCP Top 10 MCP03, ASI10, ASI07) and is paired with a detection that fires on it. Details →First reported jscrambler.com
Unauthorized Publication of a Malicious npm Package affecting CI
Jscrambler disclosed that a threat actor used compromised npm publishing credentials to publish a malicious version of its 'jscrambler' npm package (versions 8.14, 8.16, 8.17, 8.20), which ran an infostealer during the preinstall hook and was downloaded around 1,479 times in a two-hour window. Per Socket's analysis, the malware harvested developer credentials, cloud secrets, crypto wallets, browser data, and notably AI coding tool and MCP configurations (Claude, Cursor, Windsurf, VS Code, Zed), using ChaCha20-Poly1305 obfuscation to resist analysis. Jscrambler revoked credentials and released a safe version 8.22. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector