High-signal AI/security/automation notes.
ToolHive before 0.31.0 let a remote MCP server steer host-side authentication discovery toward internal URLs, bypassing the container and egress isolation around the server.
Hugging Face disclosed an AI-driven intrusion that began with malicious dataset processing, reached internal clusters, and generated more than 17,000 recorded events.
OpenAI trained an internal attacker model through self-play, then used its prompt-injection discoveries to harden GPT-5.6; the results show both the promise and limits of automated red-teaming.
AWS HealthLake MCP Server before 0.0.14 trusted a caller-supplied pagination URL, allowing an authenticated user to redirect a signed request and expose temporary AWS credentials.
mcp-documentation-server 1.13.0 bound its Web UI and document API to every interface without authentication, exposing corpus read, search, insertion, and deletion operations.
Strands Agents Tools before 0.7.0 exposed Elasticsearch connection fields to the model, allowing a crafted prompt to redirect an operator API key to an attacker-controlled host.
n8n-mcp 2.57.3 and earlier can expose local workflow backups across tenant boundaries in shared HTTP deployments; version 2.57.4 closes both disclosed paths.
Wire-level testing found Grok Build 0.2.93 uploaded tracked files and full Git history independently of agent reads. xAI has disabled the upload server-side and promised deletion.
json-repair 0.59.10 and earlier can enter an infinite CPU loop when an untrusted JSON Schema contains a circular $ref; version 0.60.1 fixes the high-severity DoS.
mcp-atlassian 0.22.0 fixes a coordinated set of flaws spanning server-side file reads, HTTP authentication, SSRF, tool authorization, filters, OAuth storage, and XSS; 0.22.1 closes follow-up gaps.
MemGhost achieved 87.5% end-to-end stealth memory-injection success against OpenClaw with GPT-5.4 on 56 held-out cases, showing how one email can corrupt future agent behavior.
Tracebit reports that a guardrail-triggering string planted in one decoy AWS secret cut AI agents’ admin-success rate from 57% to 5% across 152 attack runs.
Cloudflare’s Precursor continuously evaluates browser behavior across a session, feeding agent and bot signals into bot scores, challenges, analytics, and WAF policy.
UMKC researchers demonstrate Ghostcommit, a pull-request attack that hides prompt injection in a PNG, bypasses text-only review, and makes coding agents encode .env secrets into source code.
UC Berkeley researchers propose Prismata, a DOM-aware least-privilege layer that confines web agents and sharply reduces cross-site prompt-injection success in WebArena tests.
AWS patched CVE-2026-14471, a high-severity authenticated SQL injection in MCP Gateway Registry versions 1.0.3 through 1.0.12 that can expose API key material.
Google has put Cloud Run sandboxes into public preview, adding credential isolation, default-deny network egress, and disposable filesystem overlays for AI-generated code.
Tongji researchers propose SpellSmith, a text-based mitigation that embeds behavioral guardrails into MCP tool descriptions to block taint-style exploits without code-level patches.