Posts

arXiv — Contextualized privacy defense for LLM agents

A new paper proposes a context-aware privacy instructor model for LLM agents that improves privacy-helpfulness tradeoffs under adversarial conditions.

arXiv — Image-based prompt injection against multimodal LLMs

A new paper shows how visually embedded adversarial instructions in images can hijack multimodal LLM behavior in black-box settings.

GitHub Advisory — Copilot CLI shell expansion RCE (CVE-2026-29783)

GitHub warns that Copilot CLI’s shell tool misclassifies dangerous bash parameter expansions as read-only, enabling command execution (CVE-2026-29783).

Huntress — Fake OpenClaw installers spread GhostSocks

Huntress reports malicious GitHub repos posing as OpenClaw installers that delivered info stealers and GhostSocks proxies via search-result poisoning.

GitLab Advisory — mcp-memory-service info disclosure (CVE-2026-29787)

CVE-2026-29787 exposes system details via mcp-memory-service’s /api/health/detailed endpoint when anonymous access is enabled.

Noma Security — ContextCrush in Context7 MCP server

Noma Security disclosed ContextCrush: a supply-chain prompt injection path in Context7’s MCP server custom rules that can steer IDE agents to execute attacker instructions.

GitHub Advisory — Agentgateway MCP→OpenAPI parameter injection (CVE-2026-29791)

CVE-2026-29791: Agentgateway’s MCP-to-OpenAPI proxy fails to sanitize path, query, and header inputs, enabling parameter injection.

AI Agent Security Threat Model 2026

A practical threat model for AI agents: assets, trust boundaries, common attack paths, and controls that actually work in production.

Check Point Research — Claude Code project-file RCE & key exfil

Check Point details Claude Code project-file weaknesses that enabled RCE and API key exfiltration via hooks, MCP servers, and env vars in untrusted repos.

Securing MCP and Agent Tool Supply Chains

How to secure the tool ecosystem: MCP servers, agent skills, plugins, and the software supply chain behind them.

Microsoft Security Blog — malicious AI assistant extensions harvest LLM chat histories

Microsoft Defender reports malicious AI-themed browser extensions harvesting LLM chat histories and browsing telemetry, exposing sensitive enterprise data.

Prompt Injection Defense Playbook (2026)

A practical defense playbook: detection, mitigation, and red‑team TTPs for prompt injection across agents and tool ecosystems.

Cisco Talos — 2025 CVE retrospective (AI-related CVEs double)

Cisco Talos’ 2025 CVE retrospective introduces AI keyword tracking and reports AI-related CVEs nearly doubled YoY to 330, with MCP and Claude appearing for the first time.

VulnerableMCP — MCP security database for real-world tool flaws

VulnerableMCP aggregates MCP server and agent tooling vulnerabilities with impact, exploitability, and source links for defenders.

Arctic Wolf — mcp-atlassian unauth RCE/SSRF (CVE-2026-27825/27826)

CVE-2026-27825 allows unauthenticated file writes via mcp-atlassian attachment tools, enabling RCE; CVE-2026-27826 adds header-driven SSRF.

GitLab Advisory — mcp-nmap-server command injection (CVE-2026-3484)

CVE-2026-3484 exposes command injection in nmap-mcp-server via child_process.exec, risking arbitrary command execution in MCP toolchains.

CERT/CC — MS-Agent shell tool command injection (CVE-2026-2256)

Unit 42 — Web-based indirect prompt injection observed in the wild

Unit 42 reports in-the-wild web-based indirect prompt injection targeting LLM agents, detailing attacker intent and real-world impact.

Techzine — DeepKeep AI Agent Scanner

DeepKeep launched a free AI Agent Scanner to map agent tool access, data sources, and vulnerabilities against OWASP’s agentic risks.

GitHub Advisory — Langflow CSV Agent RCE (CVE-2026-27966)

Langflow’s CSV Agent hardcodes allow_dangerous_code=True, exposing LangChain’s Python REPL tool and enabling prompt-injection-to-RCE on the server.