High-signal AI/security/automation notes.
Strands Agents Tools before 0.7.0 exposed Elasticsearch connection fields to the model, allowing a crafted prompt to redirect an operator API key to an attacker-controlled host.
n8n-mcp 2.57.3 and earlier can expose local workflow backups across tenant boundaries in shared HTTP deployments; version 2.57.4 closes both disclosed paths.
Wire-level testing found Grok Build 0.2.93 uploaded tracked files and full Git history independently of agent reads. xAI has disabled the upload server-side and promised deletion.
json-repair 0.59.10 and earlier can enter an infinite CPU loop when an untrusted JSON Schema contains a circular $ref; version 0.60.1 fixes the high-severity DoS.
mcp-atlassian 0.22.0 fixes a coordinated set of flaws spanning server-side file reads, HTTP authentication, SSRF, tool authorization, filters, OAuth storage, and XSS; 0.22.1 closes follow-up gaps.
MemGhost achieved 87.5% end-to-end stealth memory-injection success against OpenClaw with GPT-5.4 on 56 held-out cases, showing how one email can corrupt future agent behavior.
Tracebit reports that a guardrail-triggering string planted in one decoy AWS secret cut AI agents’ admin-success rate from 57% to 5% across 152 attack runs.
Cloudflare’s Precursor continuously evaluates browser behavior across a session, feeding agent and bot signals into bot scores, challenges, analytics, and WAF policy.
UMKC researchers demonstrate Ghostcommit, a pull-request attack that hides prompt injection in a PNG, bypasses text-only review, and makes coding agents encode .env secrets into source code.
UC Berkeley researchers propose Prismata, a DOM-aware least-privilege layer that confines web agents and sharply reduces cross-site prompt-injection success in WebArena tests.
AWS patched CVE-2026-14471, a high-severity authenticated SQL injection in MCP Gateway Registry versions 1.0.3 through 1.0.12 that can expose API key material.
Google has put Cloud Run sandboxes into public preview, adding credential isolation, default-deny network egress, and disposable filesystem overlays for AI-generated code.
Tongji researchers propose SpellSmith, a text-based mitigation that embeds behavioral guardrails into MCP tool descriptions to block taint-style exploits without code-level patches.
Three high-severity vulnerabilities in OpenClaw let attackers chain environment variable injection, git transport abuse, and Docker sandbox escape to achieve host-level code execution via WhatsApp messages.
Tel Aviv University researchers demonstrate how attackers can weaponize LLM hallucinations to establish agentic botnets, achieving 100% attack success against multiple AI coding assistants.
CrowdStrike expands its prompt injection taxonomy to over 200 techniques, revealing how attacks against AI agents are fragmenting into composite chains.
Palo Alto Networks Unit 42 disclosed a critical vulnerability in Google Cloud Vertex AI SDK that allowed cross-tenant model poisoning and remote code execution via bucket squatting.