Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (380)Tools & Comparisons (2)AI Security Research (212)Agent & Supply Chain Security (742)
The Fix Shipped in August, the CVE Arrived in October: NVIDIA’s 18-CVE AI-Stack Batch
NVIDIA PSIRT published six AI-stack security bulletins on 13 October 2026 covering 18 CVEs, including a CVSS 10.0 in AIStore. Every named “updated version” was already public — between 46 and 180 days earlier — one is a beta, and for the 10.0 the version the bulletin names still carries the vulnerable API.
Governed, Except by Default: Three obsidian-tc CVEs Sat Fixed but Undisclosed for Three Months
NVD published CVE-2026-77363, CVE-2026-77364 and CVE-2026-77366 against obsidian-tc on 12 October 2026, including a 9.9 cross-vault bypass. All three were fixed in v1.3.1 on 3 July. The fixes shipped, the advisories did not follow for over three months.
Patched in June, Published in October: Two PraisonAI CVEs and the Fix That Needed a Second Fix
CVE-2026-57118 (9.8, unauthenticated agent invocation) and CVE-2026-57143 (8.8, LLM-controlled SSRF in the default search tool) reached NVD on 12 October 2026 — 117 days after PraisonAI shipped both fixes on 17 June. We read both commits: the auth fix returns True when no token is configured, and the guard that makes it matter on an exposed host did not land until August.
Five Ways to Disagree With bash: Roo Code Gets Five Approval-Bypass CVEs and No Patch Is Possible
CVE-2026-110202 through CVE-2026-110206, published to NVD at 19:18Z on 13 October 2026, name five independent command-approval bypasses in Roo Code through 3.54.0. The repository was archived on 16 May 2026, so "through 3.54.0" is permanent. The same batch carries CVE-2026-109429 against Mistral Vibe, whose tree-sitter-bash parser was defeated by the one trick Roo Code’s regex denylist actually catches. We read both gates at the named tags and reproduced the glob tokenisation locally.
The Advisory Says Patched in 0.45.2; the Code Says 0.58.3: SAP's CVSS-10 OAuth2 SSRF in the Cloud SDK for Python
CVE-2026-89111 is a CVSS 10.0 OAuth2 SSRF in SAP Cloud SDK for Python: a tenant-controlled subdomain reaches an str.replace token-URL sink and posts client credentials to an attacker host. The advisory names 0.45.2 as the patch; the fourth call site was fixed in 0.55.1 and the URL parser in 0.58.3.
The Budget Arrives in the Request: Five SGLang Multimodal CVEs With No Fixed Version
NVD published CVE-2026-109225 through 109229 against SGLang on 12 October 2026, each 8.7, each unauthenticated, all affecting 0.5.21 with no fix. Four are the same mistake — the limit is applied after the allocation — and one lets the caller set the resource budget in the request body. We read all five code paths at the v0.5.21 tag.
The Name Is Not the Repository: SlugFest Turns Abandoned GitHub Slugs Into npm Publish Rights
Repeat After Me: ToFu Turns Six Agent Frameworks Into Confused Deputies, Then Finds 253 Bugs in 343 MCP Tools
arXiv:2610.13651 (9 October 2026) presents ToFu, a tool-aware fuzzer for the LLM-orchestrator-tool trust boundary. A Repeat-After-Me technique turns attacker text into tool calls across LangGraph, Microsoft Agent Framework, Google ADK 2.0, AutoGen, Strands and CrewAI; the fuzzing pass reports 253 verified semantic bugs across 343 tools in 118 of 273 MCP servers tested.
One Fix, One Docstring, One Untouched: Three agno CVEs Record What a 42,000-Star Agent Framework Decided to Treat as a Bug
NVD published CVE-2026-108816, 108817 and 108818 against agno on 12 October 2026, from three reports filed on 8 September. The maintainers answered one with a thorough code fix, one with a docstring, and one with nothing. We read every file at main HEAD to establish which is which.
Four Words in White Type: Sakana AI Measures What Hidden Instructions Do to LLM Paper Reviewers
arXiv:2610.11087 from Sakana AI benchmarks LLM peer review on error detection, then injects tiny white text after the conclusion of 50 rejected papers. Every system scored the manipulated papers higher. LLM-Review rose 2.42 points to 9.30 out of 10. The best system caught the injection in 8 of 50 cases — and only because it was handed the PDF as an image, where white text does not render.
An Open Directory, Fifty-One Agents, 628,000 Records: CyberXero’s AI-Augmented Campaign Against Ukraine
SOCRadar’s 6 October report exposes CyberXero, a Russian-speaking initial-access broker pairing commodity tooling with 51 Claude Code agents and a PentAGI-wired Cobalt Strike server. An open directory leaked the operation’s session logs — including the context-engineering used to work around model refusals — plus data on 628,000 Ukrainians.
The Fix Landed, the Reply Never Did: DeepSeek Harness Rebuilt Its Workflow Sandbox and Told No One
CVE-2026-108789, published to NVD this morning, records a VM escape in DeepSeek Harness that turns a model-written workflow script into user-privilege code execution. The record says the vendor never responded. We read the repository: the maintainers rewrote the execution substrate on 13 September and shipped it on 15 September — without a reply, an advisory, or a deprecation of the vulnerable npm packages, which still resolve to pre-fix code.
The Denylist Grew Twelve Characters and Still Lost: Emacs TRAMP’s Filename RCE Survives Its Own Fix
CVE-2026-108976, published to NVD on 11 October 2026, is an incomplete fix for CVE-2026-79992 — the zero-click local command execution GitHub Security Lab found in Emacs TRAMP in August. We read three distribution channels first-hand. The GNU tarball still ships the original vulnerable code, GNU ELPA and Emacs master carry only the incomplete fix, and the second patch has landed nowhere.
Eight Months, Three Follow-Ups, Zero Replies: mac-shell-mcp’s Whitelist Bypass Outlived Its Own Fix
CVE-2026-108953, published 12 October 2026, names OS command injection in mac-shell-mcp before 2.0.0: shell metacharacters in execute_command arguments bypass the command whitelist, reachable by malicious prompts. The researcher disclosed privately in January; the CVE came from VulnCheck in October. The fix is on npm but the repo never tagged it.
The Config Is the Credential Store: Three Independent Counts of Secrets in Public MCP Files
Hush Security (82,000 files, 1 in 8 slots hardcoded), GitGuardian (24,008 secrets, 2,117 valid, AI-service leaks up 81.5%) and Flare (96 live secrets) independently quantify credential exposure in public MCP configuration files - plus why the exposure window outlasts classic leaked-key revocation.
Buffer First, Validate Later: mcp-go Reads Every POST Body Into Memory With No Fix Available
CVE-2026-108859, published 11 October 2026, names an unbounded POST-body read in mark3labs/mcp-go, the Go MCP SDK with 9,000 stars. ServeHTTP calls io.ReadAll before any validation; the file contains no MaxBytesReader and the built-in server sets no timeouts. We verified main HEAD still reads the whole body. There is no fixed version.
Fifty Days to Eight: Britain Puts Frontier AI on Vulnerability Duty and Starts Writing an Agentic Incident Playbook
On 12 October 2026 the UK announced four measures at once: frontier AI turned loose on government systems, AI loss-of-control risk pulled into the Cyber Security and Resilience Bill, a near-miss reporting regime, and an NCSC/AISI capability for agentic AI incidents. The same afternoon AISI published its own list of what frontier developers should be doing. Read together, the two documents concede that evaluation-before-release is no longer where the risk sits.