Posts

AWS MCP Gateway Registry SQL Injection Exposes API Key Material — CVE-2026-14471

AWS patched CVE-2026-14471, a high-severity authenticated SQL injection in MCP Gateway Registry versions 1.0.3 through 1.0.12 that can expose API key material.

Google Cloud Run Sandboxes Put Agent-Generated Code Behind Deny-by-Default Egress

Google has put Cloud Run sandboxes into public preview, adding credential isolation, default-deny network egress, and disposable filesystem overlays for AI-generated code.

arXiv — SpellSmith: Text-Based Shield for MCP Taint-Style Vulnerabilities

Tongji researchers propose SpellSmith, a text-based mitigation that embeds behavioral guardrails into MCP tool descriptions to block taint-style exploits without code-level patches.

Ethereum Foundation AI Agent Audit — CVE-2026-34219 Gossipsub DoS

Microsoft — Claude Code GitHub Action Exposes CI/CD Secrets via /proc/self/environ

Microsoft MDASH — AI Agentic Scanning Finds 16 Windows CVEs in First Run

OpenClaw AI Agent — WhatsApp Message to Host RCE via Sandbox Bypass

Three high-severity vulnerabilities in OpenClaw let attackers chain environment variable injection, git transport abuse, and Docker sandbox escape to achieve host-level code execution via WhatsApp messages.

HalluSquatting — Agentic Botnets via LLM Hallucinated Resource Names

Tel Aviv University researchers demonstrate how attackers can weaponize LLM hallucinations to establish agentic botnets, achieving 100% attack success against multiple AI coding assistants.

CrowdStrike Prompt Injection Taxonomy — 200+ Techniques Cataloged

CrowdStrike expands its prompt injection taxonomy to over 200 techniques, revealing how attacks against AI agents are fragmenting into composite chains.

Unit 42 — Pickle in the Middle: Cross-Tenant RCE in Google Vertex AI

Palo Alto Networks Unit 42 disclosed a critical vulnerability in Google Cloud Vertex AI SDK that allowed cross-tenant model poisoning and remote code execution via bucket squatting.

CISA — Langflow Becomes First AI Agent Platform in KEV Catalog (CVE-2026-55255)

CISA adds Langflow CVE-2026-55255 to its Known Exploited Vulnerabilities catalog — the first AI agent orchestration platform ever listed — with a July 10 deadline.

arXiv — GitHub Copilot Refuses Harmful Requests in Chat, Writes Them in Code

New research demonstrates workflow-level jailbreak construction: coding agents that refuse harmful prompts in chat will produce the same harmful content when asked to write it as code.

ESET — 3,000+ Malicious AI Skills Found in Agent Ecosystem Scan

European Commission — EU Action Plan on Cybersecurity and AI

The EU published an Action Plan on July 7, 2026 to address risks and opportunities of advanced AI for cybersecurity, including AI model evaluation, structured access, and secure testing platforms.

Fiddler AI — AI Coding Agent Threat Models and Controls

Fiddler AI maps the full coding-agent attack surface — prompt injection, supply-chain poisoning, credential leaks, MCP spoofing — and proposes runtime guardrails.

When Your Software Supply Chain Includes AI Writing Your Code

Sygnia — Lone Attacker Uses Agentic AI to Compromise AWS in 72 Hours

Sygnia reports a single threat actor used agentic AI workflows to execute a full cloud compromise in 72 hours — a campaign that would have taken weeks manually.

TeamPCP — Supply Chain Compromise of Trivy, LiteLLM, and KICS Feeds VECT Ransomware Credential Archive

TeamPCP poisoned Trivy, Checkmarx KICS, LiteLLM, and Telnyx SDK to harvest 500K+ CI/CD credentials — VECT ransomware then selected victims from the archive.

arXiv — Agent Data Injection (ADI): New IPI Category Bypasses All Defenses

Seoul National University and UIUC researchers introduce Agent Data Injection, a new class of indirect prompt injection that exploits lack of trusted/untrusted data isolation in LLM agents.

CVE-2026-59707 — LocalAI Unauthenticated SSRF in Model Apply Endpoint

LocalAI before the latest patch contains an unauthenticated SSRF vulnerability in POST /models/apply that allows attackers to fetch arbitrary internal URLs.