MIT AI Agent Index — transparency gaps in agent safety reporting
The 2025 AI Agent Index surveys 30 deployed agents and finds major gaps in safety disclosures, testing transparency, and accountability.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (312)Tools & Comparisons (2)AI Security Research (208)Agent & Supply Chain Security (699)
Orca Security — RoguePilot GitHub Copilot prompt injection
Orca Security details RoguePilot, a passive prompt injection in GitHub Codespaces that can coerce Copilot to exfiltrate GITHUB_TOKENs.
arXiv — Analysis of LLMs against prompt injection and jailbreak attacks
A new arXiv study benchmarks prompt-injection and jailbreak robustness across open-source LLMs and finds lightweight defenses are bypassable.
Endor Labs — Six OpenClaw vulnerabilities via AI SAST
Endor Labs details six patched OpenClaw vulnerabilities (SSRF, auth bypass, path traversal) found via agentic data-flow analysis, with CVEs and GHSAs covering tool and webhook attack paths.
SD Times — MCP privacy and security gaps
SD Times highlights MCP security and privacy gaps, including prompt injection risk, server verification challenges, and runtime policy enforcement needs.
arXiv — Agentic AI as a cybersecurity attack surface
A new arXiv paper maps agentic AI runtime supply-chain threats, from context injection to tool supply-chain abuse, and proposes zero-trust runtime defenses.
arXiv — Silent Egress: implicit prompt injection makes LLM agents leak without a trace
Silent Egress shows how URL preview prompt injection can trigger stealthy data exfiltration in tool-using LLM agents, and why network egress controls matter.
IBM — X-Force Threat Intelligence Index 2026
IBM’s 2026 X-Force Threat Intelligence Index flags AI-accelerated attacks, dark‑web trading of AI chatbot credentials, and a surge in exploitation of public‑facing apps.
Provos.org — IronCurtain agent sandbox architecture
IronCurtain proposes MCP-proxy sandboxing with policy enforcement and isolated execution modes for personal AI agents.
OpenReview — Jailbreaking the Matrix with Nullspace Steering
Researchers propose a circuit-level jailbreak method (HMNS) that suppresses attention heads and injects nullspace perturbations to bypass safety defenses with fewer queries.
arXiv — LLM-agent threat model and attack taxonomy survey
A survey of LLM agent ecosystem threats that unifies input-level prompt attacks with protocol-level exploits and maps real incidents to a single threat model.
Check Point Research — Claude Code hooks/MCP RCE
Check Point details Claude Code project configuration flaws enabling hook/MCP command execution and API key exfiltration when opening untrusted repos.
CrowdStrike — 2026 Global Threat Report: AI-accelerated adversaries
CrowdStrike’s 2026 Global Threat Report highlights prompt-injection abuse of GenAI tools, LLM-enabled malware, and faster breakout times.
Trail of Bits — Comet prompt-injection audit
Trail of Bits details how prompt injection against Perplexity’s Comet browser could exfiltrate Gmail data via agentic browsing tools.
arXiv — AgentDyn prompt injection benchmark
AgentDyn is a new benchmark for indirect prompt injection in real-world agent workflows, with dynamic tasks and hundreds of test cases across common tool domains.
Pillar Security — Operation Bizarre Bazaar LLMjacking campaign
Pillar Security details Operation Bizarre Bazaar, a coordinated LLMjacking campaign targeting exposed LLM and MCP endpoints with commercial resale.
Socket — SANDWORM_MODE npm worm targets AI coding tools
Socket details a Shai-Hulud-style npm worm that spreads via typosquats, hijacks CI workflows, and injects malicious MCP servers into AI coding tools.
Veza — Access Agents for AI identity governance
Veza introduced Access Agents and expanded AI Agent Security to map and govern AI agent identities, tools, and permissions across MCP-connected environments.
arXiv — Prompt injection vs LLM rankers
A new arXiv study measures how prompt injections inside candidate documents can hijack LLM ranking pipelines and which model architectures resist them.
GitHub Advisory — Cline unauthorized npm publish added postinstall
A compromised npm publish token led to an unauthorized Cline CLI release that added a postinstall script, highlighting supply-chain risk in agent tooling.