First reported openai.com
Topic · Latest 50 of 116 active items
Tool Abuse
Items where model-connected tools, plugins, browsers, APIs, or automation surfaces become part of the abuse path.
Matching wire items
First reported embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
AWS Kiro, an agentic coding IDE, was vulnerable to arbitrary command execution via indirect prompt injection: hidden text on a web page (or a comment in a source file) processed by the agent could make Kiro use its no-approval fsWrite tool to rewrite ~/.kiro/settings/mcp.json (or allowlist all Bash commands in .vscode/settings.json), causing it to launch attacker-specified MCP servers/commands and achieve RCE on the developer's machine, bypassing the human 'allow' approval boundary. Discovered by Intezer with Kodem Security and independently by Embrace The Red (Johann Rehberger); AWS has patched the issue. Details →First reported arxiv.org
(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
Researchers from Simon Fraser University, CUHK, Shandong University, and QAX's Xingtu Lab published an arXiv paper (arXiv:2607.00333) demonstrating seven concrete attacks against five open-source mobile AI agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA). A malicious Android app without privileged permissions can slip invisible on-screen text that the VLM-driven agent reads and acts on, exploiting a 'Screen Perception' surface (human-vs-machine vision gap) and a 'Misused Channel' surface to hijack agent actions and even achieve arbitrary command execution on the host PC driving the agent. All five frameworks fell to at least six of the seven attacks; no CVE was assigned and authors report no evidence of in-the-wild use. Details →First reported mitiga.io
Modern Malware — Spyware Skills, Hijacked Base URLs, and 1,230+ Leaking API Keys in AI Instruction Files
Mitiga Labs details malware hidden in AI agent instruction files — Cursor rules, Anthropic Skills, Claude Hooks, AGENTS.md/CLAUDE.md context files, MCP server configs, and .pyc droppers — that AI agents follow with near-zero validation. The research found prompt-exfiltration tradecraft caught in the wild, attacker-controlled ANTHROPIC_BASE_URL overrides routing Claude traffic through MITM proxies, permission-bypass defaults, and over 1,230 hardcoded API keys and JWT tokens across tens of services. Mitiga also released a free scanner, Skillgate, built during the investigation. Details →First reported youtube.com
CyberTalks: Data Poisoning Attacks on ML & Agentic AI Systems | Jason Ross |COASP
A recorded EC-Council CyberTalks webinar by Salesforce Product Security Principal Jason Ross covers data poisoning attacks against machine learning and agentic AI systems, walking through the ML lifecycle attack surface, AI supply-chain risks (including Hugging Face attacks and sleeper-agent backdoors), RAG embedding-database poisoning, cascading poisoning, and MCP exploitation examples such as GitHub and WhatsApp MCP abuse. The session also outlines mitigation strategies including secure data sourcing, validation, monitoring, and governance frameworks. Details →First reported arxiv.org
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
Tencent's Zhuque Lab released AI-Infra-Guard, an open-source multi-layer AI agent red-teaming framework, on June 30, 2026, described in an arXiv paper and published to GitHub. The framework matches a detection paradigm to each layer of an agent's attack surface: deterministic rule matching over 75+ components and 1,400+ vulnerability rules, LLM-driven agentic auditing of MCP servers and agent-skill packages (supply-chain auditing), multi-turn black-box agent red teaming, and a jailbreak harness with 26+ attack operators across sixteen datasets. Details →First reported deepinspect.ai
MCP Server Supply Chain Security: The Install Path Nobody Reviews
A DeepInspect analysis lays out five review gates for securing the MCP server supply chain, arguing that adding a third-party MCP server grants code execution, credential access, and text injection with far less scrutiny than an npm dependency. It cites CSA/OX Security research finding 9 of 11 MCP marketplaces affected by a STDIO-interface design flaw, 40+ MCP CVEs in early 2026 (including CVE-2026-33032 in nginx-ui MCP and CVE-2026-0755 in gemini-mcp-tool, both CVSS 9.8), and details tool-description poisoning as indirect prompt injection (MITRE ATLAS AML.T0051.001). Details →First reported google.com
Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting
Researchers from Tel Aviv University, Technion, and Intuit disclosed 'HalluSquatting' (adversarial hallucination squatting), a technique that exploits the predictable tendency of LLMs to hallucinate resource identifiers (repos, skills, URLs) in tool calls. By preemptively registering the hallucinated resources, attackers can achieve scalable, untargeted remote tool execution and remote code execution across popular agentic LLM applications without any direct injection channel, potentially building agentic botnets. Details →First reported pillar.security
The Week of Sandbox Escapes
Pillar Security researchers demonstrated seven sandbox-escape techniques against four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — where a sandboxed agent writes workspace files that trusted tools running outside the sandbox (Python extensions, Git integrations, hook engines, Docker daemons) later execute. Prompt injection planted in a README, issue, dependency, or diff triggers local command execution on the developer's machine; one Cursor flaw is tracked as CVE-2026-48124 and fixed in version 3.0.0, with most issues patched and vendor-acknowledged. Details →First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads. Details →First reported · updated · 5 reports wiz.io
GhostApproval: AI Coding Assistant Trust Boundary Flaw
Wiz researchers disclosed GhostApproval (CVE-2026-12958 and related), a symlink-following vulnerability pattern (CWE-61 plus CWE-451 UI misrepresentation) affecting six top AI coding assistants: Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. A malicious repository disguises a symlink as an innocuous config file so that when the agent 'sets up the workspace' it writes an attacker SSH key to ~/.ssh/authorized_keys — sometimes before any confirmation dialog — while the human-in-the-loop approval prompt conceals the true target, enabling remote code execution. AWS, Cursor, and Google fixed the issue; two vendors went silent and one called it outside its threat model. Details →First reported ainowinstitute.org
Anthropic and OpenAI Security Tools Could Fuel Cyber-Attacks
Infosecurity Magazine reports on a research brief (attributed to the AI Now Institute) warning that AI security tools built by Anthropic and OpenAI could be repurposed to fuel cyber-attacks. The piece frames researcher concerns that defensive AI capabilities carry dual-use risk of being weaponized by attackers. Details →First reported keycard.ai
The Agent Security Stack: Transport, Identity, Policy, Runtime
A Keycard explainer maps the "agent security stack" into distinct layers — transport (MCP/OAuth 2.1 authorization), identity, policy, and runtime guardrails that watch for prompt injection — arguing that agent security cannot be collapsed into a single control surface. The piece frames how multi-agent call chains multiply control surfaces (LLM tool invocation, transport, credential, authorization) and argues identity/authorization is the most under-served layer, citing recent CrowdStrike/SGNL and Palo Alto/CyberArk acquisitions. Details →First reported · updated · 3 reports appsentinels.ai
One Poisoned MCP Server Can Hijack All the Others — Coograph
MCP tool poisoning hides malicious instructions inside a Model Context Protocol server's tool descriptions, parameter schemas, or return values — invisible to human reviewers but fully read by the LLM, which then selects and executes the poisoned tool, enabling data exfiltration, credential theft, or lateral movement. The technique spans schema poisoning, tool shadowing, and rug pulls, and is catalogued as OWASP MCP03:2025; a single malicious server can influence an agent's decisions across all connected tools (cross-tool poisoning). Details →First reported · updated · 2 reports arxiv.org
Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions
The paper 'Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions' systematically analyzes vulnerabilities in Model Context Protocol (MCP) servers, finding that taint-style vulnerabilities (e.g., SSRF as in the Markdownify server, CVE-2025-5276) make up a substantial fraction and are slow to be remediated. It proposes SpellSmith, which builds tool-level risk profiles and embeds behavioral guidance into MCP tool descriptions plus LLM self-reflection to mitigate exploitation without code-level fixes. Details →First reported simspace.com
Exposing AI Agent Failure Modes Through Structured Cyber Exercises
SimSpace's blog post argues for using structured cyber exercises — combining red teaming, tabletop decisions, and automated simulations — to expose AI agent failure modes such as goal drift, tool misuse, context loss, and cascading logical errors before agents are deployed at scale. The piece lays out a failure-mode taxonomy (security vs. safety failures) and a five-phase validation flow, citing practitioner evidence that only 37% of a single-agent pipeline's outputs were error-free. Details →First reported asana.com
Breaking the Lethal Trifecta: How Asana Thinks About Agentic AI Security • Asana
Asana engineering explains how it approaches agentic AI security using Simon Willison's "lethal trifecta" framework — the convergence of access to sensitive data, exposure to untrusted content, and the ability to externally communicate (create side effects) that together enable prompt-injection attacks. The piece argues that since prompt injection cannot be reliably solved, defenders should break at least one leg of the trifecta, citing demonstrated attacks against Microsoft 365 Copilot (EchoLeak), GitHub's MCP server, and Slack AI. Details →First reported barndoor.ai
MCP Gateway Requirements for Enterprise Security Teams
Barndoor's blog outlines security requirements for enterprise MCP (Model Context Protocol) gateways, arguing that most MCP deployments lack access controls and identifying five gaps: all-or-nothing tool permissions, no user scoping, silent vendor-side changes, fragmented policy across AI clients, and unfiltered sensitive data. It recommends per-tool policy enforcement, IdP-driven identity, change management, and a default-deny posture. Details →First reported dev.to
How I Used Automated Red Teaming to Evaluate My AI Agent's Safety - DEV Community
A DEV Community walkthrough demonstrates using automated red teaming (the Strands Evals red-teaming module with AdversarialCaseGenerator and CrescendoStrategy multi-turn escalation) against an internal helper AI agent built on Strands Agents and Amazon Bedrock. The author shows how a bash-equipped agent can be coaxed via gradual multi-turn escalation into reading AWS credentials and how auto-generated adversarial cases surface data-exfiltration, excessive-agency, and system-prompt-leak breaches, going from 6/9 detected breaches to 0 after adding guardrails. Details →First reported medium.com
The Last Patch. The MCP Attack Surface We’re Building… | by Zac | Jul, 2026
An opinion piece by Zac on Medium argues that the rush to expose MCP endpoints and build agent-to-agent (A2A) orchestration is creating a large new attack surface, where every MCP endpoint is an agent-callable function and every A2A handoff is a traversable trust boundary. The article draws on Anthropic's report mapping 832 accounts banned for malicious cyber activity (March 2025–March 2026) against MITRE ATT&CK, noting medium-or-higher-risk actors rose from 33% to 56% and that AI is increasingly used deeper in the attack lifecycle. Details →First reported medium.com
Prompt Injection Is Just SSRF for Text | MCP Security → Part 3 | by Abhishek meena | Jul, 2026
Part 3 of an MCP bug bounty guide by Abhishek meena frames MCP prompt injection as analogous to SSRF: tool outputs (URLs, files, emails, API responses) are attacker-controlled text that the model reads and treats as instructions. The write-up explains how to find, exploit, and argue indirect prompt injection via tool output, with sanitized PoCs referenced. Details →First reported traefik.io
MCP Gateway Best Practices | Traefik Hub Documentation
Traefik Hub documentation outlines security best practices for deploying an MCP Gateway in production, covering On-Behalf-Of (OBO) token delegation per RFC 8693, Task-Based Access Control (TBAC) for AI agents, and a defense-in-depth 'Triple Gate' pattern. The guidance emphasizes least-privilege access so that a compromised MCP server does not grant an attacker access to all backend resources. Details →First reported embracethered.com
Autonomous AI Intrusions Are Here: Lessons from the Hugging Face Compromise
An embracethered.com analysis examines two reported autonomous-AI intrusions: a Hugging Face compromise that Hugging Face says was driven end-to-end by an autonomous AI agent (entering via a malicious dataset and code-execution paths in its processing pipeline, then harvesting cloud/cluster credentials and moving laterally across 17,000+ recorded actions), and Sysdig's JADEPUFFER agent-driven ransomware that autonomously enumerated services, exploited Nacos auth bypass (CVE-2021-29441), forged JWTs, and self-corrected failed payloads to insert a backdoor admin. The write-up highlights a defensive asymmetry in which commercial-model safety guardrails blocked Hugging Face's own forensic analysis, forcing a pivot to a locally hosted open-weight model, and criticizes the lack of shared IOCs. Details →First reported tracebit.com
Now, defenders are embracing the prompt injection, too
Researchers at Tracebit disclosed a defensive technique they call "context bombing," in which prompt injections placed alongside decoy AWS secrets trigger an attacking LLM's own guardrail refusal mechanism, causing autonomous AI hacking agents to shut down. Across 152 attack runs against five models (Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, Kimi 2.6), planting a forbidden-content string cut full account admin compromise from 57% to 5% and complete compromise with persistence from 36% to 1%. Details →First reported promptarmor.com
Connecting AI agents to outside services explodes the risk radius
The Register reports on PromptArmor research finding that AI agent connectors — OpenAI/ChatGPT and Anthropic/Claude MCP-based integrations with services like Gmail, Slack, and Dropbox — change constantly, with 931 of 2,517 connectors (37%) changing over six weeks, 1,686 new tools added and 1,127 tool descriptions rewritten. The study found connectors gaining write and destructive capabilities (Dropbox went from 8 to 24 tools, 0 to 4 destructive), permission scopes shifting, injected model instructions appearing, and about 2 in 5 Claude connectors likely calling additional external AI services. Details →First reported swarmnetics.com
Agentjacking and MCP trust: are AI coding agents too easy to steer?
Agentjacking, described by Swarmnetics and Tenet Security, abuses trusted error-report inputs in AI coding agents: an attacker with a publicly exposed Sentry DSN can inject malicious instructions into telemetry that the agent processes, steering it to exfiltrate secrets such as cloud keys, Git credentials, and private repo URLs. The root flaw is that these systems treat source trust as if it equals action trust, letting external report text become executable guidance. Details →First reported tenetsecurity.ai
A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex
Researchers at Tenet Security describe "agentjacking," an attack in which a publicly exposed Sentry key lets an attacker inject fake error messages that AI coding agents such as Claude Code, Cursor, and Codex ingest via the Sentry MCP server. The crafted error content acts as an indirect prompt injection, hijacking the agent to execute attacker-directed actions; the team also published a mitigation tool, agent-jackstop, on GitHub. Details →First reported · updated · 2 reports arxiv.org
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime). Details →First reported · updated · 4 reports arxiv.org
Agent Data Injection Attacks are Realistic Threats to AI Agents
A research paper by Woohyuk Choi and colleagues introduces agent data injection attacks (ADI), a new category of indirect prompt injection in which malicious data is disguised as trusted data (such as security-critical metadata or agent context data like tool call/response formats) rather than as instructions. The authors demonstrate ADI against real-world agents, achieving arbitrary click attacks on web agents (Claude in Chrome, Antigravity, Nanobrowser) and remote code execution plus supply-chain attacks on coding agents (Claude Code, Codex, Gemini CLI), showing it bypasses existing IPI defenses because agents fail to isolate trusted from untrusted data. Details →First reported medium.com
Prompt Injection Is No Longer Just a Chatbot Problem
A Medium explainer titled "Prompt Injection Is No Longer Just a Chatbot Problem" argues that as AI applications gain the ability to search documents, retain memory, call APIs, and run autonomous agent workflows, prompt injection now extends beyond chatbots to poison retrieved knowledge, corrupt long-term memory, manipulate an agent's plan, or trigger unauthorized tool calls. The piece frames prompt injection as a core security challenge across prompts, RAG, tools, memory, and agents. Details →First reported · updated · 4 reports sentia.community
The Confused Deputy with a Chat Window: Why AI Agents Are Exposing the Security Checks Enterprises Never Wrote – The Sentia AI Community
An explainer from the Sentia AI Community argues that autonomous, write-enabled LLM agents connected to production APIs re-introduce the classic 'confused deputy' problem: because an agent's interface is natural language, it lacks a native, cryptographic way to verify who authorized a given instruction, so untrusted input can drive privileged actions. The piece frames this as a structural gap in enterprise security models built around implicit human judgment and static perimeter API controls. Details →First reported · updated · 3 reports medium.com
Your AI Agent Trusts Every Tool It's Ever Been Introduced To
An analysis piece, 'The MCP paradox,' argues that the Model Context Protocol standardized not only how agents reach tools but also how attackers reach agents, walking through concrete vectors like tool poisoning attacks where a malicious tool description instructs an agent to exfiltrate secrets (e.g. SSH keys) via text the user never sees. The article cites Invariant Labs' April 2025 tool-poisoning proof of concept and MCP's own design choices, and proposes defensive controls to harden MCP servers. Details →First reported acm.org
Confused Deputy Attack Against Model Context Protocol | ACM Transactions on Software Engineering and Methodology
An ACM TOSEM paper uncovers the "confused deputy attack" against the Model Context Protocol (MCP), where an adversarial server with subtly manipulated metadata overshadows a benign server and intercepts tool invocations without overt malicious behavior. The authors built Puppet, an automated evaluation framework that rewrites benign tool descriptions to hijack tool selection, achieving hijacking rates up to 90.89% and payload execution up to 86.46% across 14 models, while evading MCP-Scan and McpSafetyScanner which cannot detect metadata-level manipulation. Details →First reported github.com
GitHub - opena2a-org/damn-vulnerable-ai-agent: Damn Vulnerable AI Agent is a deliberately vulnerable AI agent platform for security testing and education.
Damn Vulnerable AI Agent (DVAA) by opena2a-org is a deliberately vulnerable AI agent platform, distributed as a GitHub repo and Docker image (opena2a/dvaa), built for security testing and education. Modeled after projects like DVWA, it ships a fleet of intentionally exploitable AI agents so practitioners can practice attacks such as prompt injection and tool/agent abuse against a safe target. Details →First reported arxiv.org
BraveGuard: From Open-World Threats to Safer Computer-Use Agents
BraveGuard is a self-evolving defense framework, presented in an arXiv paper (arXiv:2606.01166), for training guard models to monitor computer-use agents that interact with files, terminals, browsers, and external tools. The framework mines open-world threat signals, instantiates them as executable agent tasks, and derives trajectory-level supervision; on the AgentHazard benchmark it raised detection accuracy from 38.79% to 82.38% over off-the-shelf guards like Qwen3-Guard and Llama-Guard variants. Details →First reported exein.io
Physical AI Security: A Threat Model for Edge Devices
Exein's blog post "Physical AI Security: A Threat Model for Edge Devices" argues that on-device AI (cameras, robots, drones running vision-language models and LLMs locally) introduces risks classic embedded threat models miss: every sensor becomes an instruction channel enabling physical-world prompt injection (e.g. text on a sign in front of a camera), probabilistic behavior that cannot be patched like a CVE, and unattended failures that act on the physical world via actuators. It proposes modeling the agent loop rather than individual components. Details →First reported · updated · 2 reports senthex.com
Prompt Injection Prevention for Coding Agents | Fiddler AI Blog
A Fiddler AI blog post explains prompt injection risks specific to coding agents, where untrusted inbound context (repositories, issues, docs, and tool returns) can turn an injected instruction into executed code or remote code execution. It argues model-level guardrails are bypassable and advocates layered prevention: isolating untrusted input, least-privilege tool and credential scoping, blast-radius containment, and runtime policy enforcement with decision lineage. Details →First reported · updated · 3 reports theregister.com
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Security
Noma Security's "GitLost" research demonstrated that GitHub Agentic Workflows (AI agents backed by Claude or Copilot) could be tricked via indirect prompt injection: an unauthenticated attacker posts a crafted issue on a public org repo, and the agent fetches a private repo's README and posts it in a public comment. The PoC used an "Additionally" prefix to bypass guardrails and was disclosed to GitHub with no public patch date noted. Details →First reported qianxin.com
NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era
NadMesh is a Go-based botnet observed in early July 2026 by QiAnXin's XLab that autonomously scans for and exploits exposed AI services — ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — using a Shodan harvester (ai_harvest.py) to prioritize AI infrastructure and the MCP ecosystem. It folds scanning, 20+ RCE exploitation vectors (Redis, Docker, MCP, Kubernetes), credential/AI-service intelligence harvesting, polymorphic builds, and redundant persistence into a single productized platform; the operator's dashboard claims 3,811 unique AWS keys plus model inventories tagged as cloud services. Details →First reported infosecwriteups.com
Google fixing Android lock screen bug that lets Gemini send SMS without a PIN
Google is fixing an Android 16 lock screen bypass in which Gemini, accessible from the lock screen, can be tricked into sending SMS and WhatsApp messages without a PIN. Pressing Gemini's "Continue" prompt simultaneously with its "Add attachment" button lets an attacker with physical access dispatch messages and re-enable Gemini's access to previously disconnected apps, all while the device stays locked. Details →First reported adversa.ai
Solving GitHub’s Secure Code game with an AI red teaming agent
Adversa AI documents pointing its autonomous AI Red Teaming Agent at GitHub's open-source Secure Code Game 'ProdBot' challenge, an intentionally vulnerable agentic-AI teaching target where the goal is to coax the agent into leaking a flag stored one directory above its sandbox. The agent cleared the first three levels (Sandbox, Web, MCP) at full score in a single 57-second run, relying on 'context seeding' — fabricating a plausible prior workflow implying authentication had already occurred — rather than overt jailbreak language, illustrating that each added capability (web browsing, MCP tool chains, skills, multi-agent) opens a new attack surface via indirect injection, poisoned tool chains, and confused-deputy trust. Details →First reported strobes.co
CVE-2026-23744 - CVE Details, Severity, and Analysis | Strobes VI
CVE-2026-23744 is a critical (CVSS 9.8) remote code execution vulnerability in MCPJam Inspector versions 1.4.2 and earlier, a local-first development platform for MCP servers. Because the tool binds to 0.0.0.0 and its /api/mcp/connect endpoint extracts command and args without security checks, an attacker can send a crafted, unauthenticated HTTP request to trigger arbitrary command execution with no user interaction; public PoCs and vendor patches are available. Details →First reported · updated · 2 reports redhat.com
CVE-2026-42271 - Red Hat Customer Portal
CVE-2026-42271 is an Important-severity (CVSS 8.8) flaw in LiteLLM, an AI gateway/proxy for LLM APIs, where two MCP-server preview endpoints accepted full server configurations including command-execution parameters without adequate role checks. An authenticated user with even low-privilege internal-user keys could send a crafted configuration to achieve arbitrary OS command execution on the proxy host; Red Hat notes known public exploits and the CVE is tracked in CISA's KEV catalog, with fixes shipped in LiteLLM v1.83.7-stable and Red Hat OpenShift AI / Ansible Automation Platform errata. Details →First reported · updated · 4 reports reversinglabs.com
MCP Supply Chain Attacks: Why Better Models Make It Worse
A dope.security blog post argues that the Model Context Protocol (MCP) has become a new shadow-IT and supply-chain risk because MCP servers create outbound HTTPS connections that read files, hit APIs, and move data on an agent's behalf while looking indistinguishable from ordinary encrypted traffic. It contends DNS filters and cloud proxies cannot see the URL paths, payloads, or tool calls inside MCP sessions, and promotes the vendor's device-level SWG and DLP as a means to name, allow, or block MCP servers at egress. Details →First reported knostic.ai
Building openclaw-shield: Lessons Learned Securing OpenClaw Agents
Knostic has open-sourced openclaw-shield, a security plugin for OpenClaw AI agents that enforces guardrails at the tool/execution layer rather than relying on prompts or transcript scanning. It uses a 5-layer defense-in-depth approach (prompt guard, output scanner, and an execution gate requiring explicit allow/deny decisions) to stop agents from leaking secrets, exposing PII, or running destructive commands like rm -rf. Details →First reported clawsecure.ai
AI Agent Security: The Complete 2026 Guide
ClawSecure's blog post is a 2026 explainer guide on AI agent security, describing why autonomous agents break traditional security (broad access, autonomy, and treating data as instructions) and cataloging risks like prompt injection, tool poisoning, credential theft, and data exfiltration mapped to the OWASP Top 10 for Agentic Applications. It cites ClawSecure's finding that 41% of popular OpenClaw skills carry security vulnerabilities and promotes the company's runtime monitoring and integrity-layer product. Details →First reported github.com
GitHub - cgrtml/reasongate: Explainable security gate for LLM apps — blocks prompt injection with an auditable reason for every decision.
ReasonGate is an open-source explainable security gate for LLM applications that aims to block prompt injection while emitting an auditable reason for every allow/deny decision. Beyond text detection, it adds a capability-based 'agent action gate' (framed around the lethal-trifecta) that blocks tool calls by argument taint even when detection misses reworded attacks, with a live playground and a documented threat model describing its guarantees and non-guarantees. Details →First reported · updated · 2 reports manifold.security
ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail
Manifold Security researcher Ax Sharma disclosed two unpatched vulnerabilities in Anthropic's Claude for Chrome extension (v1.0.80). Any browser extension with a content script on claude.ai can inject a DOM element and dispatch a synthetic click that Claude treats as a legitimate user action, triggering one of nine hardcoded workflows that read Gmail, Google Docs, and Calendar or act on Salesforce; a second flaw initializes the side panel in privileged mode via a ?skipPermissions=true URL parameter with no consent. Rated CVSS 7.7 in default mode and 9.6 Critical when 'Act without asking' is enabled, and reportedly still reproducible after eight releases since being reported to Anthropic in May. Details →First reported · updated · 3 reports theregister.com
Red teamers turned Claude Desktop into a double agent to do their evil bidding
Oasis Security disclosed "PromptFiction," a vulnerability in Anthropic's Claude Desktop where a single click on a trusted-looking claude:// URL silently submitted attacker-controlled prompts to the assistant with no user confirmation. Chained with the earlier "Claudy Day" trio of flaws, it could enable silent exfiltration of prior conversations and — when Anthropic's official Filesystem MCP server is installed — file read/write, persistence, and remote code execution. Anthropic has fixed the flaw. Details →First reported github.com