Guide
OWASP Agentic Skills Top 10: A Security Guide to AI Agent Skills Risks
The OWASP Agentic Skills Top 10 (AST01-AST10) names the risks in AI agent skills. This guide walks every risk and how to govern the skills layer.
Field notes on agentic AI security
Research, product, and perspective on governing AI agents, MCP servers, and everything loaded into them.
Guide
The State of Enterprise AI Security in 2026
The state of enterprise AI security in 2026: agents in production, MCP everywhere, skills as supply chain, and what security teams should do about it.
Guide
The Complete Enterprise AI Security Guide
Enterprise AI security spans agents, MCP, skills, browser AI, identity, and supply chain. This complete guide maps the attack surface, controls, and program roadmap.
Guide
Shadow AI Detection: Techniques and Best Practices
Shadow AI detection combines network, CASB, endpoint, browser, and identity signals to find unsanctioned AI. Here are the techniques, blind spots, and best practices.
Guide
What Is Shadow AI? A Complete Guide
Shadow AI is the unsanctioned AI tools, agents, and MCP servers employees use without security review. Here is what it is, why it emerged, and how to govern it.
Guide
Top MCP Servers Used by Developers (and What to Check)
A curated reference of the MCP servers developers actually use, the access each one grants, and what a security team should verify before allowing them.
Guide
Top 100 AI Apps Used in Enterprises (Categorized)
A categorized reference of the AI apps used in enterprises today - grouped by function, with the primary data-exposure risk each category carries.
Guide
What Are AI Agent Skills? A Security Primer on the New Shadow-IT Layer
AI agent skills are markdown plus code that load into an agent and run with its full permissions. This primer explains the security surface and how to see it.
Guide
AI Agent Security: A Practical Guide to Threats and Controls
AI agent security protects autonomous AI agents from misuse and attack. This practical guide covers the threat model and a control stack across the agent lifecycle.
Guide
AI Discovery: The Enterprise Buyer's Guide
AI discovery finds every AI agent, MCP server, and artifact in your environment. This enterprise buyer's guide covers evaluation criteria, build vs buy, and vendor questions.
Guide
The Most Common AI Browser Extensions (and Their Risks)
A reference to the most common AI browser extensions and their real security risks - broad page access, third-party data flows, and prompt injection.
AdvisoryHigh
SkillJacking: Hijacking Abandoned Skill Dependencies to Take Over AI Agents
SkillJacking takes over abandoned dependencies an agent skill relies on, seizing control of code that runs inside thousands of AI agents without ever touching the skill itself.
Guide
AI Identity Security Explained: Identities, Credentials, and Controls for AI Systems
AI identity security is the practice of giving AI agents scoped, verifiable, short-lived identities. Here is what those identities are and how to govern them.
Guide
Model Context Protocol (MCP) Security Explained
MCP security is the practice of governing how AI agents connect to tools and data through MCP servers. Here is what MCP is and why it is a security surface.
Guide
The Most Requested AI Agent Permissions (and How to Scope Them)
The permissions AI agents, MCP servers, and skills request most - filesystem, shell, network, OAuth scopes, secrets, browser - and how to scope each to least privilege.
AdvisoryCritical
Malicious Agent Skills: Hidden Payloads and Shadow Features (OWASP AST01)
Malicious agent skills combine hidden code payloads with natural-language instruction attacks. A USENIX 2026 study of 98,380 skills confirmed 157 malicious ones carrying 632 vulnerabilities.
Guide
AI Access Control and Least Privilege: A Practical Guide
AI access control decides what agents can do and reach. This guide covers RBAC, ABAC, policy-based authorization, JIT access, and least privilege for AI.
Guide
AI Governance Framework for Enterprises
An AI governance framework for enterprises built on four pillars - visibility, policy, enforcement, and audit - mapped to NIST AI RMF, ISO 42001, and the EU AI Act.
Guide
AI and OAuth: The Risk Report
AI OAuth risk explained: how AI agents and MCP turn consent screens, tokens, and grants into a new attack surface, and the controls that contain it.
Guide
Vetting and Approving AI Agent Skills: An Enterprise Playbook
A practical enterprise playbook for vetting AI agent skills before they run on your fleet, plus why one-time approval fails and continuous re-vetting is mandatory.
Guide
Browser AI Security: Risks and Controls
Browser AI security covers the risks of AI extensions, copilots, and agentic browsers - and the controls that keep corporate data from leaking through them.
Guide
Shadow AI Adoption by Department: Where AI Shows Up and Why
Shadow AI by department: a qualitative look at where unsanctioned AI shows up across engineering, marketing, sales, finance, HR, legal, and support.
Guide
Least Privilege for Agent Skills: Scoping Permissions, Metadata, and Isolation
Least privilege for agent skills means scoping each skill's capability, cleaning its metadata, and isolating it from the host - because a skill runs with the agent's full permissions.
AdvisoryHigh
LLMjacking: Stolen-Key Cost Abuse Against Enterprise LLM Endpoints
LLMjacking is credential theft aimed at your model bill: attackers steal cloud LLM keys and run inference at your expense. Here is how to see it and stop it.
Guide
Slopsquatting: When Your AI Coding Assistant Installs a Package That Doesn't Exist
Slopsquatting weaponizes LLM package hallucinations: attackers pre-register the fake names your AI assistant invents. Here is how it works and how to stop it.
Guide
Agent-to-Agent (A2A) Security: Trust Boundaries in Multi-Agent Systems
Agent-to-agent security is about the trust boundaries between agents. Here is how A2A systems fail - transitive injection, confused deputy, weak auth - and the controls that hold.
Guide
Securing Computer-Use and Browser Agents
Computer-use and browser agents act on untrusted web content with real mouse, keyboard, and screen access. Here is the lethal trifecta at the UI layer and how to contain it.
Research
Shadow AI Data Exposure: What Employees Are Actually Pasting Into ChatGPT, Claude, and Copilot
Shadow AI data exposure is now the top enterprise exfiltration channel. What employees paste into ChatGPT, Claude, and Copilot, by the numbers, and why DLP misses it.
Insights
The Lethal Trifecta in Production: Why Notion AI, Superhuman, and Claude Cowork Fell the Same Way
Four production AI agent exfiltration disclosures in one week proved the lethal trifecta is a config property, not a bug. Why Notion, Superhuman, and Cowork fell.
Guide
Secrets Management for AI Agents: Killing the .env File for Good
Secrets management for AI agents breaks the human-in-the-loop model. Here is why the .env file must die and the five practices that replace it.
Guide
Runtime Monitoring and Anomaly Detection for AI Agents: Building Behavioral Baselines
A practitioner's guide to AI agent monitoring: collecting runtime signals, building behavioral baselines with SPC/EWMA, and detecting drift before it becomes a breach.
Guide
OWASP LLM & Agentic Top 10: A Security-Controls Checklist for AI Agents
An OWASP LLM security controls checklist mapping LLM01-10 and Agentic ASI01-10 to preventive, detective, and agent and MCP-layer monitoring controls.
AdvisoryHigh
The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain
OpenClaw security crisis explained: CVE-2026-25253 one-click RCE, the ClawHavoc skill supply chain, the Moltbook leak, and how to govern shadow AI agents.
Guide
OAuth for MCP Servers: How AI Agent Authorization Actually Works (2026 Spec)
OAuth for MCP servers explained: how the 2026 MCP authorization spec uses OAuth 2.1, PKCE, RFC 8707 resource indicators, and why token passthrough is forbidden.
Guide
Non-Human Identities Are the New Shadow IT: A CISO's Guide to Machine Identity Governance
A CISO's guide to non-human identity governance: the NHI lifecycle, OWASP NHI Top 10, real breaches, and why AI agents and MCP clients break legacy models.
Guide
The Lethal Trifecta: When AI Agent Prompt Injection Becomes a Data Breach
The lethal trifecta for AI agents - private data, untrusted content, external comms - turns prompt injection into data theft. Break the chain by removing one leg.
Guide
Least Privilege for AI Agents: Why Most Agent Identities Are Over-Privileged (and How to Fix It)
Least privilege for AI agents means scoped, time-limited, per-session credentials. Here is why most agent identities are over-privileged and how to fix it.
Guide
Indirect Prompt Injection Explained: The Defining Attack on AI Agents
Indirect prompt injection hides attacker instructions in content an AI agent reads. Why it is unpatchable, how it hits MCP and RAG, and the controls that hold.
Guide
How to Build an MCP Server Registry and Govern MCP at Scale
How to build an MCP server registry that vets, pins, and governs Model Context Protocol servers at scale, plus the lifecycle and controls a security team needs.
Guide
How to Build an AI Agent Inventory: A Step-by-Step Guide for Security Teams
A step-by-step guide to building an AI agent inventory: the five discovery domains, the registry schema, and the risk tiers security teams need to govern agents and MCP.
Guide
GDPR for AI Agents: Lawful Basis, Consent, and Erasure When an Agent Processes Personal Data
GDPR for AI agents in practice: how lawful basis, consent, purpose limitation, and the right to erasure apply when an autonomous agent processes personal data.
Guide
DLP for AI Agents: Why Regex-Era Data Loss Prevention Fails on Prompts and MCP Calls
DLP for AI agents needs more than regex. Learn why legacy data loss prevention misses prompts and MCP calls, and what AI-native inspection and ABAC require.
AdvisoryHigh
Form-Based Prompt Injection: How ShareLeak and PipeLeak Turned Copilot Studio and Agentforce Against Their Owners
ShareLeak (CVE-2026-21520) and PipeLeak show how Copilot Studio prompt injection and Agentforce form fields exfiltrate private data through the agent's own tools.
Guide
AI Agent Memory Poisoning: Poison Once, Exploit Forever
AI agent memory poisoning explained: how attackers plant persistent instructions in agent memory that survive resets and re-fire across future sessions, and how to defend.
Guide
AI Agent Incident Response: Kill Switches, Containment, and Pulling Autonomy to Zero
An AI agent incident response playbook: detection signals, kill switch vs scoped safe mode, pause vs revoke, blast-radius mapping, and evidence preservation.
Guide
Building an Audit Trail for AI Agents: What to Log, How to Structure It, and Why Tool Calls Alone Aren't Enough
An AI agent audit trail must log intent and action, not just tool calls. Learn the schema, immutability, and MCP fields a security team needs for forensics.
Guide
Writing an AI Acceptable Use Policy for Agents and MCP That Reduces Shadow AI Instead of Driving It Underground
An AI acceptable use policy that reduces shadow AI instead of pushing it underground: tiered tool taxonomy, data classification, MCP approval, real enforcement.
Guide
OWASP Top 10 for LLM Applications (2025): A Security Team's Breakdown
A security team's breakdown of the OWASP Top 10 for LLM applications (2025): the full taxonomy, what changed, and how each risk maps to AI agents and MCP servers.
Guide
OWASP Top 10 for Agentic Applications: The Agent Threat List Explained (2026)
The OWASP Top 10 for Agentic Applications (ASI01-ASI10, 2026) explained: what each agent risk means, how it maps to MCP servers, and how to operationalize it.
Guide
OWASP AIVSS: Scoring Agentic AI Vulnerabilities Beyond CVSS (2026)
OWASP AIVSS scores agentic AI vulnerabilities by extending CVSS with an agentic uplift. A guide to the taxonomy, the v0.8 formula, and how to operationalize it.
Guide
NIST AI RMF for AI Agents: Govern, Map, Measure, and Manage (2026)
A practical guide to the NIST AI RMF (Govern, Map, Measure, Manage) for security teams, applied to autonomous AI agents and MCP servers across the fleet.
Guide
MITRE ATLAS for Agentic AI: Mapping Agent and MCP Attacks to the Matrix (2026)
MITRE ATLAS is the adversary-TTP knowledge base for AI systems. This guide maps its tactics and techniques to real agent and MCP server attacks for 2026.
Guide
ISO/IEC 42001 for AI Agent Governance: Building an AI Management System (2026)
A practical, evergreen guide to ISO 42001 AI governance: the AIMS structure, Annex A controls, and how to operationalize them for AI agents and MCP servers.
Guide
IBM AI Risk Atlas for Agentic AI: A Catalogue of Agent Risks (2026)
A security leader's guide to the IBM AI Risk Atlas: its taxonomy, its agentic risk items, and how to operationalize it for AI agents and MCP servers.
Guide
The EU AI Act for AI Agents: Risk Tiers, Obligations, and Compliance Timeline (2026)
A practical guide to the EU AI Act for AI agents: risk tiers, provider and deployer obligations, the 2025-2027 timeline, and what security teams must monitor.
Guide
CSA AI Controls Matrix (AICM): Control Domains for Agent Governance (2026)
A practical guide to the CSA AICM: its 18 domains, 243 control objectives, and how its agentic controls govern AI agents and MCP servers.
Guide
Cisco's AI Security and Safety Framework: What It Covers for AI Agents (2026)
A reference guide to the Cisco AI security framework: its four-layer threat taxonomy, embedded MCP, A2A, and supply-chain models, and what it means for agents.
Research
Claude Code vs OpenAI Codex vs Cursor: A Security Team’s Guide to Their Permission Models (2026)
Claude Code, Codex, and Cursor each gate agent actions differently: deny-first rules, an OS sandbox, and an allowlist plus LLM classifier. Side by side.
Research
Cursor’s Config Surface: .cursorrules, MCP, and Extension Drift on the Endpoint
What Cursor leaves on the endpoint: .cursorrules and .cursor/rules/, ~/.cursor/mcp.json servers, and Open VSX extensions that drift off any allowlist.
Guide
AI Supply-Chain Attacks: A Defender's Guide for Security Teams (2026)
AI supply-chain attacks now poison the agent config layer. Sonatype found 454,600+ malicious packages in 2025, 99% on npm. A defender's guide.
Guide
Securing AI Coding Agents and CLIs: The Complete Guide for Security Teams (2026)
Securing AI coding agents and CLIs in 2026: with 84% developer adoption, the inventory, runtime-governance and audit playbook for security teams.
Guide
Securing LLM Gateways and Proxies: The Complete Guide for Security Teams (2026)
Securing LLM gateways: the 2026 guide to the LiteLLM, vLLM, Ollama and LightLLM attack surface - with 175,000 Ollama hosts already exposed publicly.
Research
Cursor Privacy Mode and Enterprise Controls: What Admins Can Actually Enforce
Cursor admins can enforce Privacy Mode org-wide and re-verify it every 5 minutes, but the control plane stops at the local MCP and extension layer.
Guide
Governing AI Coding Assistants Across Your Fleet: Claude Code, OpenAI Codex, and GitHub Copilot (2026)
One framework to govern AI coding assistants: inventory, set policy, and audit Claude Code, OpenAI Codex, and GitHub Copilot across your fleet.
AdvisoryHigh
mcp-server-kubernetes Tool Restriction Bypass at Execution Layer - CVE-2026-46519
CVE-2026-46519 (CVSS 8.8): mcp-server-kubernetes enforces tool limits at tools/list, not tools/call, so any client can run kubectl_delete. Fix in v3.6.0.
Research
Cursor Auto-Run (Formerly YOLO Mode): Why Allow and Deny Lists Aren’t Enough
Cursor auto-run lets the agent run shell and apply edits unattended. Why the allowlist, denylist, and file-delete checkbox route around - and what holds.
Guide
GitHub Copilot Code Review and Security Validation: A Team Workflow (2026)
A team GitHub Copilot code review workflow: inline vs chat, validating suggestions, layering scanning, and a 90-day audit of every Copilot endpoint.
Guide
Governing GitHub Copilot in the Enterprise: Policies, Content Exclusion, and Audit (2026)
A practitioner guide to governing GitHub Copilot: org policies, the public-code filter, content exclusion limits, and the 180-day audit log.
Research
OpenAI Codex Full-Access Mode and the Trust Boundary
When Codex runs danger-full-access with approval_policy never, the sandbox and prompts are gone, network is on, and one trust click is your only control.
Guide
MCP Server Security: The Complete Guide for Security Teams (2026)
MCP server security in 2026: the attack surface, the CVE wave, MCP trust tiers, and how to inventory and govern every MCP server across your fleet.
AdvisoryCritical
LiteLLM MCP-Preview Command Injection Chained to Unauthenticated RCE - CVE-2026-42271
CVE-2026-42271: a LiteLLM RCE (CVSS 8.7) in the MCP-preview endpoints, chained with CVE-2026-48710 for unauthenticated RCE. Fixed in LiteLLM 1.83.7.
Research
OpenAI Codex Across CLI, Cloud, and IDE: Where the Security Model Differs
OpenAI Codex runs in three places with three different sandboxes. In cloud, agent-phase internet is off by default; on the CLI it depends on one TOML key.
Guide
Rolling Out OpenAI Codex Across Your Fleet: A Governance Guide (2026)
OpenAI Codex governance for a fleet: baseline sandbox/approval floor, repo trust tiers, secret handling, and the audit requirements.toml leaves open.
AdvisoryCritical
Hades PyPI Campaign Poisons 19 Packages with .pth Startup Hooks - Bun Credential Stealer and AI Scanner Misdirection
The Hades wave shipped 37 malicious wheels across 19 PyPI packages using *-setup.pth startup hooks that run a Bun credential stealer on every Python run.
Guide
Deploying Claude Code Across a Fleet: Settings Hierarchy, MCP, and Memory (2026)
Deploying Claude Code across a fleet: the five-layer settings hierarchy, vetting MCP servers across three scopes, CLAUDE.md, and the visibility gap.
Research
OpenAI Codex’s Sandbox and Approval Model: What’s Isolated, What Isn’t
OpenAI Codex isolates the agent phase with no network by default and strips secrets before it runs-but the fleet still owns approval drift and audit.
Research
Auditing Claude Code Across a Fleet: Settings, Hooks, MCP Servers, Plugins, and Skills
What we find auditing Claude Code on managed laptops: settings.json allow/deny drift, registry MCP servers, plugins, skills, and PreToolUse hooks.
Guide
Securing OpenAI Codex: Sandbox Modes, Approval Policies, and the Two-Phase Runtime (2026)
A practitioner guide to securing OpenAI Codex: pick sandbox plus approval combinations, why secrets are dropped before the agent phase, and a hardening checklist.
Research
What Claude Code’s --dangerously-skip-permissions Really Skips (and What It Doesn’t)
Claude Code's --dangerously-skip-permissions skips the prompts, not PreToolUse hooks, deny rules, or the rm -rf circuit breaker. What CI loses.
Guide
Configuring Claude Code Permissions and Hooks: A Hardening Guide for Teams (2026)
A practitioner guide to Claude Code permissions hardening: allow/deny rules, the four path anchors, a PreToolUse deny hook, and a 12-item checklist.
Guide
GitHub Copilot Best Practices: A Security-First Adoption Guide (2026)
GitHub Copilot best practices for security teams: prompting, validate-before-implement, CodeQL scanning, the 65-lexeme public-code filter, and governance.
Research
How Claude Code Permissions Actually Work: Allow Rules, Deny Rules, and the PreToolUse Hook
How Claude Code evaluates permissions: rules fire deny then ask then allow, and a PreToolUse hook can never override a matching deny or ask.
Guide
OpenAI Codex Use Cases: A Practical Guide for Engineering Teams (2026)
A practitioner guide to OpenAI Codex use cases - PR review, refactors, migrations, security scans - and the sandbox and approval settings each one needs.
AdvisoryCritical
Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit
The Miasma 'Phantom Gyp' npm worm abuses a 157-byte binding.gyp to run code at install, hitting 57 packages across 286+ versions in under two hours.
Guide
How Claude Code Works: A Security Team’s Guide to the Agentic Loop, Tools, and Hooks (2026)
How Claude Code works for security teams: the agentic loop, five tool categories, and governing the PreToolUse hook with a 90-day audit trail.
Company
Why We Built Anomity: Securing the AI Agent Endpoint
Why we built Anomity: AI agent adoption outran governance, and the endpoint is the layer Network, EDR, DLP, and GRC were never designed to see.
AdvisoryHigh
Claude Code GitHub Action Permission Bypass and Secret Exfiltration - claude-code-action
claude-code-action before v1.0.94 (CVSS 4.0 7.8): a [bot] actor check let attackers bypass the human gate and exfiltrate CI secrets. Patched in 4 days.
AdvisoryCritical
MCPJam Inspector Remote Code Execution - CVE-2026-23744
CVE-2026-23744 is a critical RCE in MCPJam Inspector ≤ 1.4.2: it binds 0.0.0.0 and a crafted request triggers an MCP server install and code execution.
AdvisoryHigh
TrapDoor Cross-Ecosystem Supply-Chain Attack - Credential Theft and AI Assistant Poisoning Across npm, PyPI and Crates.io
TrapDoor, disclosed May 2026, spread credential-stealing malware across 34+ packages and 384+ versions on npm, PyPI, and Crates.io and poisoned AI agents.
AdvisoryHigh
LiteLLM allowed_routes Privilege Escalation via Key Creation - CVE-2026-47101
CVE-2026-47101 (CVSS 8.8): a LiteLLM internal_user can mint a key with admin-only allowed_routes and escalate to proxy_admin. Fixed in LiteLLM 1.83.14.
AdvisoryHigh
LiteLLM /user/update Self-Promotion to proxy_admin - CVE-2026-47102
CVE-2026-47102 (CVSS 8.8): a LiteLLM org_admin can POST /user/update to set their own user_role to proxy_admin for full proxy control. Fixed in 1.83.10.
AdvisoryHigh
Network-AI Empty-Default-Secret Cross-Origin MCP Tool Invocation - CVE-2026-46701
CVE-2026-46701: Network-AI's MCP SSE server defaults to an empty secret, so auth passes for everyone, and wildcard CORS lets any page call its 22 tools.
AdvisoryMedium
Starlette BadHost Host-Header Auth Bypass Hits AI Gateways - CVE-2026-48710
CVE-2026-48710 (BadHost) is a Starlette host-header auth bypass before 1.0.1, reaching FastAPI, vLLM, LiteLLM, and MCP servers. Fixed in Starlette 1.0.1.
AdvisoryHigh
Comment and Control Prompt Injection Across Claude Code, Gemini CLI and Copilot Agents - Credential Theft via GitHub Comments
Comment and Control prompt injection turned three CI coding agents into credential thieves via PR comments; the Anthropic finding rated CVSS 9.4 Critical.
AdvisoryHigh
Mobile MCP Unvalidated URL Android Intent Injection - CVE-2026-35394
CVE-2026-35394: Mobile MCP intent injection before v0.0.50 passes any URI scheme to Android intents, enabling tel: USSD codes, calls, and SMS.
Product
Inside Anomity Discovery: How We Inventory Every AI Artifact on the Endpoint
How the Anomity Endpoint Sensor discovers every AI agent, MCP server, extension, and secret on an endpoint, then classifies and governs them from the cloud.
AdvisoryCritical
TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321
CVE-2026-45321: the Mini Shai-Hulud wave hit 42 @tanstack packages across 84 versions plus 170+ npm/PyPI packages to steal CI/CD and cloud secrets.
AdvisoryCritical
MCP Connect Default-Unauthenticated /bridge Endpoint OS Command Execution - GHSA-wvr4-3wq4-gpc5
GHSA-wvr4-3wq4-gpc5: MCP Connect's /bridge endpoint is unauthenticated by default in mcp-bridge up to 2.0.0, letting any network attacker run OS commands.
AdvisoryCritical
Ollama Bleeding Llama Unauthenticated Memory Leak - CVE-2026-7482
CVE-2026-7482 (Bleeding Llama) is a CVSS 9.1 unauthenticated heap read in Ollama before 0.17.1 that leaks prompts and API keys from ~300k servers.
AdvisoryCritical
Gemini CLI and run-gemini-cli Maximum-Severity CI Remote Code Execution - GHSA-wpqr-6v78-jr5g
GHSA-wpqr-6v78-jr5g (CVSS 10.0): an unprivileged PR or issue could load attacker-controlled .gemini config and run shell commands on a CI runner.
Research
What We Find When We Scan AI Agent Configs Across Managed Fleets
The recurring risks hiding in AI agent configs on managed endpoints: plaintext secrets, blanket permission grants, unvetted MCP servers, and off-allowlist extensions.
AdvisoryHigh
LMDeploy Vision Image-Loader SSRF Exploited in 12 Hours - CVE-2026-33626
CVE-2026-33626: an SSRF in LMDeploy's vision image loader, exploited against honeypots 12 hours after disclosure. Fixed in 0.12.3 - what to check.
AdvisoryCritical
LiteLLM Pre-Auth SQL Injection in Proxy Key Verification - CVE-2026-42208
CVE-2026-42208 is a CVSS 9.3 pre-auth SQL injection in LiteLLM Proxy 1.81.16-1.83.6 that reads upstream provider keys. Exploited in 36h; fix in 1.83.7.
AdvisoryCritical
Model Context Protocol STDIO Transport By-Design Command Execution - MCP By Design
MCP By Design (OX Security): the STDIO transport runs any process command on the host, tying ~7,000 public servers and 10+ CVEs to one root cause.
AdvisoryCritical
nginx-ui Unauthenticated MCP Message Endpoint Server Takeover - CVE-2026-33032
nginx-ui MCP authentication bypass: CVE-2026-33032 (CVSS 9.8) lets any network attacker invoke every MCP tool via /mcp_message. Fixed in nginx-ui 2.3.4.
AdvisoryHigh
PolinRider DPRK Supply-Chain Campaign - Malicious npm and VS Code Artifacts Infect 1,900+ GitHub Repositories
PolinRider DPRK npm supply chain campaign compromised 1,951 GitHub repositories across 1,047 owners by appending obfuscated JavaScript to config files.
AdvisoryMedium
Ollama Model Pull API SSRF - CVE-2026-5530
CVE-2026-5530: an SSRF in Ollama through 0.18.1. A crafted registry URL on the Model Pull API forces outbound requests. No vendor fix; exploited.
AdvisoryHigh
OpenAI Codex Branch-Name Command Injection and GitHub Token Theft - BeyondTrust Phantom Labs
OpenAI Codex ran shell from an unsanitized Git branch name, hidden behind 94 U+3000 spaces, capturing the GitHub access token. Fixed January 2026.
AdvisoryHigh
vLLM Hardcoded trust_remote_code Override Enables RCE - CVE-2026-27893
CVE-2026-27893 is a CVSS 8.8 RCE in vLLM 0.10.1 through before 0.18.0: hardcoded trust_remote_code=True overrides the operator opt-out. Fixed in 0.18.0.
AdvisoryCritical
vLLM Unauthenticated RCE via Malicious Video URL - CVE-2026-22778
CVE-2026-22778 is a CVSS 9.8 pre-auth RCE chain in vLLM 0.8.3-0.14.0: a video_url leaks a heap address, then a JPEG2000 overflow runs code. Fix: 0.14.1.
AdvisoryHigh
LiteLLM Supply-Chain Compromise - Malicious PyPI Release 1.82.8
Malicious LiteLLM releases 1.82.7 and 1.82.8 shipped a .pth file that ran on every Python startup to harvest credentials. What to check on your fleet.
AdvisoryHigh
Windows-MCP Unauthenticated HTTP Transport PowerShell RCE - GHSA-vrxg-gm77-7q5g
GHSA-vrxg-gm77-7q5g: Windows-MCP before v0.7.5 binds an unauthenticated HTTP transport on port 8000 with wildcard CORS, yielding remote PowerShell RCE.
Insights
Why AI Agents and MCP Servers Are the New Shadow IT
AI agents and MCP servers are adopted bottom-up, carry their own permissions, and report to no one in security. They are the new shadow IT.
AdvisoryCritical
Tencent WeKnora Unauthenticated MCP STDIO Validation Bypass RCE - CVE-2026-30861
WeKnora unauthenticated RCE: CVE-2026-30861 (CVSS 9.9) bypasses the MCP STDIO command allowlist via npx -p node. Patched in WeKnora v0.2.10.
AdvisoryHigh
SEO-Poisoning Campaign Delivers Fake Gemini CLI and Claude Code Installers - EclecticIQ
EclecticIQ tracked a March 2026 SEO-poisoning campaign of 30+ domains pushing fake Gemini CLI and Claude Code installers that ran a fileless stealer.
AdvisoryHigh
Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852
CVE-2025-59536 and CVE-2026-21852: a cloned repo's .claude/settings.json ran code and leaked the Anthropic API key before the Claude Code trust prompt.
AdvisoryCritical
mcp-atlassian Unauthenticated SSRF and Path Traversal to Root RCE - CVE-2026-27825
mcp-atlassian RCE: CVE-2026-27825 (MCPwnfluence) chains unauthenticated SSRF and path traversal to root code execution in versions below 0.17.0.
AdvisoryCritical
Tencent WeKnora Authenticated MCP STDIO Command Injection - CVE-2026-22688
CVE-2026-22688: an authenticated WeKnora user controls the MCP STDIO command/args, gaining process execution on the server. Patched in v0.2.5.
AdvisoryHigh
Cline GitHub Actions Compromise and Unauthorized npm Release - [email protected]
On February 17, 2026 an attacker stole the Cline CLI's npm publish token via a prompt-injection-and-cache-poisoning chain in its GitHub Actions workflows and shipped an unauthorized [email protected] release (with an openclaw-installing postinstall script). The VS Code extension was not affected. No CVE (tracked as GHSA-9ppg-jx86-fqw7).
AdvisoryCritical
LightLLM Unauthenticated Pickle Deserialization RCE in PD WebSockets - CVE-2026-26220
CVE-2026-26220 is a CVSS 9.3 unauthenticated pickle deserialization RCE in LightLLM 1.1.0 PD WebSockets. A broken empty-string nonce disabled the check.
AdvisoryCritical
Cursor Sandbox Escape via Git Hooks Remote Code Execution - CVE-2026-26268
CVE-2026-26268 (CVSS 9.9): a Cursor sandbox escape let a malicious agent write Git hooks, so a routine Git op ran code outside the sandbox. Fixed in 2.5.
AdvisoryCritical
LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252
CVE-2026-22252: a command injection in LibreChat's MCP STDIO transport lets any authenticated user run shell commands as root. Fixed in v0.8.2-rc2.
AdvisoryHigh
Mass Scanning and SSRF Campaign Against Exposed LLM Infrastructure - GreyNoise 2025-2026
GreyNoise's Ollama honeypots logged 91,403 attack sessions (Oct 2025-Jan 2026) probing 73+ LLM endpoints and abusing model-pull SSRF. 80,469 in 11 days.
AdvisoryCritical
Shai-Hulud 2.0 npm Worm Backdoors 796 Packages - Preinstall Credential Theft and Home-Directory Wiper
Shai-Hulud 2.0, identified November 24 2025, is a self-replicating npm worm that backdoored 796 packages and runs a credential stealer during preinstall.
AdvisoryHigh
vLLM Prompt-Embeds Tensor Deserialization Memory Corruption - CVE-2025-62164
CVE-2025-62164 is a memory-corruption flaw in vLLM 0.10.2 to before 0.11.1 that deserializes prompt-embeds via torch.load(), enabling DoS and maybe RCE.
AdvisoryHigh
GitHub Copilot and VS Code YOLO-Mode Remote Code Execution - CVE-2025-53773
CVE-2025-53773: indirect prompt injection makes GitHub Copilot write chat.tools.autoApprove into .vscode/settings.json, flipping VS Code to YOLO-mode RCE.
AdvisoryHigh
Cursor MCPoison Persistent Code Execution via MCP Trust Bypass - CVE-2025-54136
CVE-2025-54136 (CVSS 7.2): MCPoison tied Cursor's MCP approval to a server name, not its contents - a later swap ran without re-approval. Fixed in 1.3.
AdvisoryHigh
Cursor CurXecute MCP Prompt-Injection Remote Code Execution - CVE-2025-54135
CVE-2025-54135 (CVSS 8.5): CurXecute let prompt injection write Cursor's .cursor/mcp.json and auto-run commands before approval. RCE in Cursor 1.2.1.
AdvisoryHigh
Gemini CLI Silent Code Execution via Allowlist Bypass - Tracebit
Tracebit found Google Gemini CLI before 0.1.14 ran hidden chained shell commands past its allowlist, exfiltrating env vars two days after release.
AdvisoryMedium
Amazon Q Developer VS Code Extension Wiper Prompt Injection - GHSA-7g7f-ff96-5gcw
GHSA-7g7f-ff96-5gcw: a wiper prompt shipped in Amazon Q Developer for VS Code 1.84.0 told the agent to delete home files and AWS resources. Fix: 1.85.0.
AdvisoryCritical
mcp-remote OS Command Injection from Untrusted MCP Servers - CVE-2025-6514
CVE-2025-6514: an mcp-remote command injection (CVSS 9.6) lets an untrusted MCP server run OS commands on the connecting client. Fixed in 0.1.16.
AdvisoryCritical
Anthropic MCP Inspector Proxy Missing Auth Browser-Driven RCE - CVE-2025-49596
CVE-2025-49596: an unauthenticated CVSS 9.4 RCE in MCP Inspector below 0.14.1 (credited to Tenable Research) - a malicious webpage runs code on a developer host.
AdvisoryHigh
MCP Tool Poisoning via Hidden Instructions in Tool Descriptions - Invariant Labs Disclosure
Invariant Labs' Tool Poisoning Attack (April 1, 2025): hidden instructions in MCP tool descriptions steer the model; a 2025 academic survey of 1,899 open-source MCP servers found ~5.5% carried tool poisoning.
AdvisoryHigh
LiteLLM api_base SSRF Leaks Upstream Provider Keys - CVE-2024-6587
CVE-2024-6587 is a CVSS 7.5 SSRF in LiteLLM through 1.38.10: a caller-set api_base made the proxy forward the provider key. Fixed in 1.44.8.
