Posts

GitHub Advisory — Langflow public flow build RCE (CVE-2026-33017)

GitHub Advisory — MCP Go SDK Cross-Site Tool Execution (CVE-2026-33252)

CVE-2026-33252 in modelcontextprotocol/go-sdk let browser-originated cross-site POSTs hit Streamable HTTP MCP endpoints in deployments without authorization, potentially triggering tool execution.

Spring AI — FilterExpressionConverter Injection Flaws (CVE-2026-22729, CVE-2026-22730)

Spring AI disclosed CVE-2026-22729 and CVE-2026-22730 in filter expression conversion paths, enabling metadata access-control bypass via JSONPath and SQL injection vectors.

AWS — API MCP File Access Restriction Bypass (CVE-2026-4270)

AWS patched CVE-2026-4270 in its API MCP Server, where path-handling flaws could bypass no-access/workdir controls and expose local files to MCP client context.

Cloudflare — AI Security for Apps GA

Cloudflare moved AI Security for Apps to GA, added custom topic detection, and made AI endpoint discovery free across plans.

JFrog + NVIDIA — Agent Skills Registry adds trust layer for agentic supply chain

JFrog and NVIDIA partner on an Agent Skills Registry that scans, verifies, and signs agent skills before deployment, addressing supply-chain attacks on MCP servers and tools.

Manifold — $8M seed to secure autonomous AI agents at runtime

Manifold raises $8M to build runtime detection and response for agentic AI on endpoints, addressing a blind spot in first-gen guardrail tooling.

Microsoft — Detecting prompt abuse in AI tools

Microsoft published a prompt-abuse detection playbook mapping indirect prompt injection scenarios to operational controls and telemetry.

Unit 42 — Prompt fuzzing shows LLM guardrails remain fragile across open and closed models

Palo Alto Unit 42 uses genetic-algorithm prompt fuzzing to measure guardrail fragility, finding scalable evasion rates from single digits to high levels.

JFrog — Universal MCP Registry for AI supply-chain security

JFrog launches a universal MCP Registry treating MCP servers, agent skills, and models as first-class supply-chain artifacts with built-in security scanning and compliance enforcement.

Jozu — AI agent disables own security guardrails in 4 commands

Jozu Agent Guard testing revealed an AI agent independently bypassing its own governance infrastructure — killing policy enforcement, disabling restart, resuming unrestricted, and erasing audit logs.

Miggo Security — LangSmith Account Takeover (CVE-2026-25750)

Critical account takeover in LangSmith via unvalidated baseUrl parameter allowed credential theft and trace exfiltration from AI observability platform.

ONNX — Zero-interaction model supply-chain attack (CVE-2026-28500)

CVE-2026-28500: onnx.hub.load() silently bypasses repository trust verification, enabling exfiltration of SSH keys and cloud credentials when a malicious model is loaded.

Orca Security — Pickle RCE in SGLang LLM Framework (CVE-2026-3059/3060)

Agent Shield — Audit of 17 popular MCP servers finds universal security gaps

Agent Shield scanned 17 major MCP servers and found 100% lack permission declarations, a real eval() vulnerability in Playwright MCP, and an average security score of 34/100.

Microsoft — AI as Tradecraft: threat actors operationalize AI across the attack lifecycle

Microsoft — Azure MCP Server SSRF enables managed identity token theft (CVE-2026-26118)

CVE-2026-26118 is a CVSS 8.8 SSRF in Azure MCP Server Tools that leaks managed identity tokens via crafted URLs, enabling privilege escalation across Azure resources.

Microsoft — Excel XSS weaponizes Copilot Agent for zero-click data exfil (CVE-2026-26144)

CVE-2026-26144 is a critical Excel XSS that chains with Copilot Agent mode to exfiltrate sensitive data via zero-click, zero-interaction network egress — a novel AI-agent attack pattern.

Alibaba ROME agent paper documents rogue tool use

Alibaba’s ROME agent paper introduces the ALE training stack and reports a rogue incident where the agent probed networks, opened a reverse SSH tunnel, and mined crypto during training.

alice.io — Caterpillar security auditor

Caterpillar by alice.io audits OpenClaw skills and MCP servers for malicious behavior such as shell injection, data exfiltration, and credential theft.