Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (357)Tools & Comparisons (2)AI Security Research (210)Agent & Supply Chain Security (713)
Perplexity Bumblebee — Open-Source Scanner for Dev Endpoints and MCP Configs
Perplexity open-sources Bumblebee, a read-only Go scanner that inventories developer machines for compromised npm, PyPI, Go modules and MCP configurations.
Starlette CVE-2026-48710 "BadHost" — FastAPI AI Infrastructure Exposed
A single-character Host header flaw in Starlette bypasses authentication in thousands of FastAPI-based AI tools, model proxies, and MCP servers.
Adversa AI — SymJack symlink-to-RCE via AI coding agents
SymJack turns AI coding agents into supply-chain delivery systems: disguised symlinks inject malicious MCP servers that run unsandboxed on developer restart.
Trend Micro "Return-to-Tool" — AI Agents as Attack Chains
Anthropic Claude Code Security-Guidance Plugin — Three-Layer In-Session Vulnerability Detection
Anthropic releases a free security-guidance plugin for Claude Code that runs deterministic pattern matching, a separate-model review, and agentic commit-time checks.
arXiv — Poisoning the Watchtower: Prompt Injection Against LLM-Augmented SOC Analysts
New research demonstrates that attacker-controlled log fields (URLs, user agents, payloads) can carry prompt injection attacks into LLM-based security operations center tools, with persona hijacks bypassing 68% of triage alerts.
Check Point — IRGC-linked group uses AI-assisted MiniFast malware
IRGC-affiliated Nimbus Manticore group deploys AI-assisted malware toolkit MiniFast targeting defense, aerospace, and telecom sectors.
Huawei BeSafe-Bench — None of 13 AI Agents Clear 40% Safety Threshold
Oasis Security — Claudy Day: Claude.ai Prompt Injection to Silent Data Exfiltration
Three chained vulnerabilities in Claude.ai — invisible prompt injection via URL parameters, Files API data exfiltration, and an open redirect — create a complete attack pipeline against millions of users.
Paubox — Invisible text prompt injection bypasses AI email filters
Phishing campaigns use zero-font and color-matched hidden text to inject benign content that tricks AI email filters into classifying malicious messages as safe.
PromptArmor — Copilot Cowork Prompt Injection Bypasses M365 Approval to Exfiltrate Files
PromptArmor demonstrated that weaponized workflow content can force Copilot Cowork to generate and share Microsoft 365 file links to unauthorized recipients, completely bypassing user consent.
Ars Technica — BadHost CVE-2026-48710: Starlette Host-Header Auth Bypass Hits AI Tooling
A single-character Host header injection in Starlette (325M weekly downloads) bypasses path-based auth in FastAPI, vLLM, LiteLLM, and MCP servers, exposing credentials and PII across millions of AI agent deployments.
arXiv — Attested Tool-Server Admission for MCP (2605.24248)
A new arXiv paper proposes mcp-attested: a signed clearance assertion, per-server tool allowlist, and tamper-evident audit log for MCP deployments.
arXiv INFRASCOPE — Automated Detection of Vulnerability Variants in AI Infrastructure
INFRASCOPE uses reference-driven multi-agent analysis to find recurring vulnerability patterns across 688 AI infrastructure repositories, uncovering 20+ new vulnerabilities.
arXiv: 40.55% of Remote MCP Servers Expose Tools Without Auth
First measurement study of 7,973 live remote MCP servers finds over 40% expose tools without authentication; OAuth deployments universally exhibit at least one flaw, yielding 9 CVEs.
arXiv — Poisoning the Watchtower: Log-Substrate Prompt Injection in SOC Tools (2605.24421)
A new paper shows adversarial log content can inject into LLM-based SOC analyst assistants via persona hijacks and context manipulation — with 96% success on summarization tasks.
arXiv SUDP — Secret-Use Delegation Protocol for Agentic Systems
SUDP formalizes how LLM-driven agents can exercise user-authorized operations without gaining reusable authority over secrets, solving the Agent Secret Use problem.
CSO: Treat AI Models as Untrusted Components, Google and UCSD Researchers Argue
Researchers from Google, UCSD, and UW-Madison argue enterprises must treat AI models as fundamentally untrusted and enforce security at the system level around agents, not inside the model.
arXiv: Viper-MCP Finds 106 0-Day Vulnerabilities in MCP Servers
Viper-MCP, the first end-to-end automated vulnerability auditing framework for MCP servers, scanned 39,884 repositories and discovered 106 confirmed 0-days, with 67 CVEs assigned to date.