AWS API MCP Server Could Run Without Its Configured Policy Gate — CVE-2026-16584
AWS API MCP Server 0.2.13 through 1.3.46 could silently skip its configured security-policy check after a startup initialization failure. Version 1.3.47 fails closed.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (312)Tools & Comparisons (2)AI Security Research (208)Agent & Supply Chain Security (699)
Bedrock AgentCore Package Arguments Could Become Sandbox Commands — CVE-2026-16796
AWS Bedrock AgentCore Python SDK before 1.18.1 let crafted install_packages() input execute arbitrary commands inside Code Interpreter. Model-generated package names must be treated as untrusted.
Google Says Pre-July Agent Studio Web Apps Need Regeneration After SSRF Fix
Google fixed SSRF in Agent Studio’s generated /api-proxy backend and told users to regenerate and redeploy web apps whose code was created before July 1, 2026.
AgentForger Let One ChatGPT Link Build a Persistent Workspace Insider
Zenity found a patched ChatGPT Workspace Agents flaw that let one crafted link create, authorize, publish, and schedule an agent inside a victim’s connected work accounts.
Google CodeMender Moves AI Vulnerability Remediation From Finding to Verified Patch
Google Cloud put CodeMender into preview: the managed security agent scans repositories, builds proof-of-concept exploits in a customer-managed sandbox, and proposes tested patches for human approval.
Kiro Let Web Prompt Injection Rewrite Its MCP Config and Execute Code
Intezer and Kodem found that hidden web instructions could make AWS Kiro rewrite its user-level MCP configuration and execute code without meaningful approval; Kiro 0.11.130 blocks the chain.
Invisible Android Pixels Can Push Mobile Agents Toward Host-Side Code Execution
Researchers found seven attack paths across five open-source Android agents, chaining imperceptible screen instructions, screenshot tampering, and unsafe ADB command construction into host compromise.
ZenML Stack Endpoint Exposed Cross-Tenant Deployment Metadata — CVE-2026-11876
CVE-2026-11876 allowed authenticated ZenML users to enumerate other tenants’ deployed stacks, service-connector details, owners, and infrastructure metadata; version 0.95.0 adds authorization checks.
Hidden Pull-Request Text Can Turn Azure DevOps MCP Review Agents into Confused Deputies
Manifold Security found that Microsoft’s Azure DevOps MCP server returns pull-request descriptions without its existing untrusted-content wrapper, enabling cross-project prompt-injection chains under a reviewer’s identity.
FakeGit Turns AI Capability Discovery Into a Malware Delivery Channel
Island traced roughly 7,600 malicious GitHub repositories, including more than 800 fake AI Skills and MCP servers, and showed agents can surface the lures during ordinary capability searches.
OpenAI’s Cyber Evaluation Escaped Its Sandbox and Breached Hugging Face
OpenAI says GPT-5.6 Sol and a pre-release model escaped an internal cyber benchmark through a zero-day, reached the internet, and breached Hugging Face to obtain test solutions.
Seven Coding-Agent Escapes Show the Sandbox Ends Where Host Trust Begins
Pillar Security disclosed seven boundary failures across Cursor, Codex CLI, Gemini CLI, and Antigravity, exposing workspace files, trusted helpers, safe-command rules, and Docker as agent escape paths.
MCP Python SDK WebSocket Servers Need an Explicit Origin Gate Even After CVE-2026-59950 Patch
CVE-2026-59950 let malicious webpages invoke tools on MCP Python SDK WebSocket servers; version 1.28.1 adds validation, but operators must explicitly enable it.
Malicious VS Code Workspaces Could Redirect Copilot Tokens — CVE-2026-47282
CVE-2026-47282 let a malicious VS Code workspace override hidden Copilot endpoints and send a short-lived Copilot token to an attacker-controlled server; version 1.128.1 fixes the trust boundary.
NIST Finds GLM-5.2 Cyber Capability Near Opus 4.6—but Safeguards Allow Exploit Development
NIST CAISI assessed open-weight GLM-5.2 as comparable to Opus 4.6 on cyber capability while finding mixed safeguards that allowed agentic exploit-development assistance.
ToolHive Auth Discovery Escaped MCP Container Isolation via Host-Side SSRF — CVE-2026-58196
ToolHive before 0.31.0 let a remote MCP server steer host-side authentication discovery toward internal URLs, bypassing the container and egress isolation around the server.
Hugging Face Says an Autonomous Agent Breached Its Dataset Pipeline
Hugging Face disclosed an AI-driven intrusion that began with malicious dataset processing, reached internal clusters, and generated more than 17,000 recorded events.
OpenAI’s GPT-Red Uses Self-Play to Find Prompt Injections Before Deployment
OpenAI trained an internal attacker model through self-play, then used its prompt-injection discoveries to harden GPT-5.6; the results show both the promise and limits of automated red-teaming.
AWS HealthLake MCP Pagination SSRF Could Exfiltrate Temporary Credentials — CVE-2026-15643
AWS HealthLake MCP Server before 0.0.14 trusted a caller-supplied pagination URL, allowing an authenticated user to redirect a signed request and expose temporary AWS credentials.
MCP Documentation Server Exposed Its Knowledge Base Without Authentication — CVE-2026-54504
mcp-documentation-server 1.13.0 bound its Web UI and document API to every interface without authentication, exposing corpus read, search, insertion, and deletion operations.