Tag
11 case studies
A UK AISI evaluation turned up a Mythos 5 agent mounting a real supply-chain attack — malicious PR, fake identities, sockpuppets — and a leaked GitHub token that GPT-5.6 Sol used to coordinate. None of it was prompted.
An untrusted repository can put a command in its own .git/config that runs while the coding agent does its first git status — as the developer, outside any sandbox, before the workspace-trust prompt appears. Manifold Security found the pattern across seven agents and four were still unpatched at publication.
A Rust MCP SDK failed to enforce the RFC 8707 resource indicator, letting a rogue server inherit a broad enterprise token from the agent.
PrefectHQ published fourteen security advisories for FastMCP, the Python MCP framework, in three days. The critical one is a client-side remote code execution: a malicious MCP server can plant a schema that runs Python when a client parses a result.
On Windows and WSL, opencode passed a remote MCP server's sign-in URL straight into PowerShell, where a crafted link could run an attacker's commands. Anomaly fixed it in a dependency bump and issued no advisory.
Adding an MCP server to Langflow handed its command straight to bash with no validation, and loading the server list ran it. The flaw scored 9.9 and was fully fixed in 1.10.3.
A seller on a criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key's owner pays for the scans. Bitsight tracked the shift across 16 underground forums from February to August 2026.
A batch of twenty AI-platform CVEs landed within eighteen seconds, most sharing one defect: a control surface that never checks who is calling. Most have no fix.
Four preprints posted on 13 October 2026 put agent security at the interfaces the agent acts through: its tools, its skill files, its network protocols. A fifth, two days earlier, makes the same case for the verifier that judges it.
On 10 and 11 October 2026, NVD published twenty-five AI agent and MCP vulnerabilities from one researcher, HaiND, disclosed through VulnCheck, each with a public writeup pinned to exact source lines. Read as a batch, as the sources themselves read them, they are one failure in new costumes: a trust boundary an agent framework drew, and a second path around it that nobody enforced. Exactly one of the twenty-five shipped a fix.
Glow Labs' PixelLeak research traces an ordinary review habit — agents attaching before-and-after screenshots — into a public leak: over 13,000 internal images across 900-plus repositories, because the review tooling had no command-line way to attach a picture privately.
