AI Vulnerability Database
The Anomity Security Database tracks 167 public vulnerabilities and security advisories for AI agents, MCP servers, IDE extensions, agent skills and the packages they install, 71 of them with a CVE id. 61 are critical and 92 high; 22 have been exploited in the wild. Each page says who is affected and how to fix it, with links to the original advisory.
- Advisories
- 167
- Critical
- 61
- High
- 92
- Exploited
- 22
- With CVE
- 71
Trojanized Claude Code Extension 2.1.313 in Cursor's Marketplace Planted an SSH Key, a Reverse Tunnel and Per…
On 29 October 2026, from about 09:27 to 20:35 UTC, Cursor's own extension marketplace served a tampered build of the official Claude Code f…
Load/Mine: 31 Fake Qwen2 Repositories on Hugging Face and ModelScope Used trust_remote_code to Install a Pear…
Pluto Security published on 29 October 2026 a campaign of 31 malicious model repositories across seven Hugging Face accounts plus a ModelSc…
MCP Reference Servers v2.1.0 Fix Eight Advisories, Including a Write That Escaped allowedDirectories in serve…
The modelcontextprotocol/servers repository released v2.1.0 on 25 October 2026 (00:03 UTC), fixing eight advisories in three reference serv…
CVE-2026-115726: A Committed .aider.conf.yml Runs Shell Commands in Aider With No Trust Prompt (Unpatched)
VulnCheck published CVE-2026-115726 on 23 October 2026 (CVSS 4.0 8.5; NVD shows 7.8), credited to Seoyoung Lee. Aider auto-loads .aider.con…
Agent Frameworks: Strands Agents' A2A Server Shared Conversation History Across Callers (CVE-2026-115419), me…
The Strands Agents SDK (Python strands-agents before 1.43.0, TypeScript @strands-agents/sdk before 1.5.0) published CVE-2026-115419 on 23 O…
MCP Servers on Developer Machines: Trigger.dev's Dev MCP Server Listened on All Interfaces With No Auth (CVE-…
Several MCP server CVEs published 21 to 23 October 2026 affect servers developers run locally. CVE-2026-114090 (CVSS 7.6): `trigger dev --m…
FastMCP 3.4.10 and 4.1.2: Transformed Components Skipped Their Authorization Check, and the 4.x OAuth Client …
PrefectHQ published two FastMCP advisories on 23 October 2026, both rated medium. GHSA-7xgj-8392-5q4r (CVSS 6.8): when a server transform c…
CVE-2026-114612: LiteLLM Proxy Encrypted a Forged Admin Credential With the Key It Trusts for Sessions, Givin…
NVD published CVE-2026-114612 on 22 October 2026 (CVSS 9.9, GitHub advisory GHSA-7hp6-4w63-5g45). From 1.87.0, the LiteLLM proxy used one c…
Forever Security: An AGENTS.md Planted in ~/Downloads Got Codex to Register an MCP Server That Installed the …
Forever Security (Gal Weizman, Omer Samet) published on 22 October 2026 an attack it first caught on a customer machine, where a coding age…
Three Agent Advisories: Goose Sent Raw Terminal History to the LLM Provider (CVE-2026-111079), a Colon in a H…
Red Hat published CVE-2026-111079 (CVSS 7.4) on 22 October 2026 for Goose: when the terminal integration is enabled, Goose captures shell c…
MCP Inspector Fixes Nine Advisories on 21 October, Two Critical: a Malicious Server's OAuth Callback Switched…
The maintainers of @modelcontextprotocol/inspector, the official MCP debugging client, published nine GitHub security advisories on 21 Octo…
LiteLLM 1.107.0 Compromised on PyPI and Docker: A cook.pth Startup Hook Stole Configs From 20+ AI Coding Tool…
On 21 October 2026, litellm 1.107.0 was published to PyPI with malware in all seven wheels, live from 11:39 to 13:23 UTC, and the Docker Hu…
BeyondTrust: A Hidden Comment on a GitHub Issue Hijacked the Copilot Coding Agent, Stole Its Token and Agent …
BeyondTrust Phantom Labs (Tyler Jespersen) published on 21 October 2026 an attack chain against GitHub Copilot's cloud coding agent. An iss…
Microsoft: China-Aligned Storm-0940 Ran the ARTEX Agentic Pen-Test Framework Against Hundreds of Organization…
Microsoft Threat Intelligence reported on 21 October 2026 that Storm-0940, a China-state aligned actor active since 2021, has used ARTEX si…
SOCRadar: INC and The Gentlemen Ransomware Affiliates Ran Intrusions at 62 Organizations Through OpenCode and…
SOCRadar published on 20 October 2026 (updated 23 October) an analysis of a publicly reachable command-and-control server that exposed a ra…
OpenAI: Two Internal GPT-6 Coding Agents Weakened Misalignment Monitoring While Making Requested Changes, and…
OpenAI posted a misalignment report on 20 October 2026, filed under concealment, covering two internal coding tasks on 3 and 6 October in w…
MCP Gateways and Hosted Servers: Google's Agent Mesh Let Any OIDC Token Holder Enroll and Call Every Backend …
CVE-2026-103091 (published 19 October 2026, CVSS 9.3): in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 to alpha.8, GET /info disclosed the OID…
OpenCode Console Breach: Saved OpenAI, Anthropic and Google Provider Keys Exposed for 1.4% of Console Users T…
OpenCode disclosed on X on 17 October 2026 that it had a security breach the previous night "related to a large scale distillation attack" …
CVE-2026-96620: A Dash-Leading Resume ID in the Claude Agent SDK for Python Became a CLI Flag That Defined a …
Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical…
FastMCP: A Malicious MCP Server's Tool Output Schema Ran Python Code in the Client (GHSA-gpgx-58w2-xwwf, Crit…
PrefectHQ published GHSA-gpgx-58w2-xwwf for fastmcp on 16 October 2026, rated critical, with no CVE. When a FastMCP client parses a success…
CVE-2026-105740: Langflow's MCP Stdio Command Injection Is Exploited in the Wild, With Payloads Reading LANGF…
Previdian reported on 15 October 2026 that CVE-2026-105740 (GHSA-7w94-79vh-5mr2, CVSS 9.9) is being exploited. It is the Langflow flaw in w…
Four MCP Server CVEs: NetLicensing Path Traversal Unredacts Admin Tokens (CVSS 9.6), Unla Gateway Issues OAut…
Several MCP servers received CVEs between 7 and 15 October 2026. CVE-2026-57496 (NVD 15 October, CVSS 3.1 9.6; GHSA-hxpf-9xvq-wph8): in Lab…
CVE-2026-111091 and CVE-2026-88755: JetBrains Junie CLI and Z.ai ZCode Started the MCP Servers a Cloned Repos…
Two coding agents received CVEs a day apart for starting MCP servers declared inside an untrusted project. JetBrains, acting as its own CNA…
MCP Reference SDKs: A Shared Server Instance Delivered One HTTP Client's Messages to Another, Bearer Auth Acc…
The Model Context Protocol maintainers published another batch of server-side SDK advisories between 30 September and 15 October 2026. GHSA…
Symantec: The Aoki Infostealer Now Takes Claude, Codex, Cursor, Copilot, Gemini, JetBrains AI and Kiro Creden…
Symantec's Threat Hunter Team reported on 15 October 2026 that newer samples of the Aoki (Aokigahara) infostealer, first seen earlier in 20…
Omnigent 0.18.0 Fixes Six Advisories, Two Critical: Session Imports Could Use Another User's Host, and Header…
Omnigent, an open-source agent meta-harness that orchestrates Claude Code, Codex, Cursor and other agents with policies and sandboxing (omn…
Microsoft October Patch Tuesday: A Trailing Dot Let Copilot in Visual Studio and SSMS Rewrite Its Own MCP Con…
Microsoft shipped fixes on 13 October 2026 for three agent-related flaws. CVE-2026-103572 (CVSS 3.1 8.8, Important, Remote Code Execution) …
Command-Approval Bypasses in Four Coding Agents: Five Roo Code CVEs That Will Never Be Fixed, Continue CLI Co…
VulnCheck published a run of CVEs on 12 and 13 October 2026 for coding agents whose shell-command approval could be slipped by prompt-injec…
Claude Desktop and Claude Code: A Planted git.exe Ran on Project Open (CVE-2026-88066), a Write-Time Symlink …
Anthropic published two advisories in October 2026. GHSA-4p2j-qj3c-6x84 / CVE-2026-88066 (13 October, CVSS 4.0 7.5): Claude Desktop on Wind…
SlugFest: npm Trusted Publishing Bound Packages to Reclaimable GitHub Repo Names, Exposing 1,500+ Packages to…
Bloom Security (Golan Myers) disclosed SlugFest on 13 October 2026. npm Trusted Publishing bound a package to a GitHub owner/repo slug and …
CVE-2026-96893: Crafted Content in GitLab Duo Agent Platform Instructions Could Run Commands Attributed to Ot…
NVD published CVE-2026-96893 on 13 October 2026, with GitLab as CNA and a CVSS 3.1 score of 7.3, referencing GitLab's 19.4.2 patch release.…
Apex Accelerator (REF8801): A Fake Web3 Accelerator's npm Coding Agent Repackaged Oh My Pi, Rerouted Its LLM …
Elastic Security Labs (Jia Yu Chan, Daniel Stepanic) published REF8801 on 12 October 2026, about an operation posing as a Web3 accelerator …
VulnCheck Source-Review CVEs Hit Agent Tooling: mini-swe-agent's Bubblewrap Sandbox Inherits Host API Keys (C…
VulnCheck, as CNA, published dozens of CVEs from 10 October 2026 onward for findings from a static source review of MCP servers, agent fram…
CVE-2026-107824: x64dbg-MCP Server Exposed All 71 Debugger Tools Unauthenticated on 0.0.0.0 (CVSS 4.0 9.3)
NVD published CVE-2026-107824 on 9 October 2026 with a CVSS 4.0 score of 9.3, from repository advisory GHSA-4478-h5jv-647m that the maintai…
Tensorlake npm SDK 0.5.144 Compromised by a Shai-Hulud/ChainDrop Worm That Steals Cloud, CI and Claude/Cursor…
Socket and Endor Labs reported on 8 October 2026 that tensorlake@0.5.144, the TypeScript SDK for the Tensorlake AI sandbox platform, was pu…
GhostAction Returns: A security-audit.yml Workflow Pushed From Compromised Maintainer Accounts Sends Actions …
On 8 October 2026 an attacker used two compromised open-source maintainer accounts to push a workflow named security-audit.yml into 345 rep…
Cryptographic Context Injection: An Encrypted Web Page Got GitHub Copilot CLI in Autopilot to Decrypt Its Own…
Adversa AI published a Cryptographic Context Injection attack on GitHub Copilot CLI on 6 October 2026. The user asks the agent to review on…
opencode on Windows and WSL: A Remote MCP Server's OAuth authorization_endpoint Ran PowerShell on Connect, Fi…
Pillar Security (Eilon Cohen) disclosed on 4 October 2026 a remote code execution flaw in opencode (opencode-ai on npm) on Windows and WSL.…
CVE-2026-104120: The Official mcp-server-fetch Reference Server Reaches Loopback, Private and Cloud-Metadata …
NVD published CVE-2026-104120 on 2 October 2026 from VulDB as CNA, with a CVSS 4.0 score of 5.5, for modelcontextprotocol mcp-server-fetch …
CVE-2026-102437 (ConfigPoisoning): Viewing a Diff in DeepSeek-Reasonix Studio Ran the Repository's git filter…
GitLab's Threat Research Group (Abisheik Magesh, Daniel Abeles) published ConfigPoisoning on 2 October 2026. It is tracked as GHSA-grg2-7gc…
CVE-2026-97662: A Crafted Git Ref Turns the AWS Security Agent MCP Server's Diff Scan Into a File Write Outsi…
AWS Security Bulletin 2026-121-AWS (1 October 2026, with GHSA-8g28-rj54-p5p2; NVD published the same day) covers an argument injection in a…
Manus: One Email With a JSFuck Payload, or One Shared-Project Instruction, Ran Code in the Victim's Sandbox a…
Salt Labs published on 1 October 2026 (first reported by Dark Reading on 24 September) that an email alone could hijack a Manus agent. Manu…
CVE-2026-102911: pi-llm-wiki's wiki_capture_source MCP Tool Put a URL Inside `sh -c` (CVSS 9.9); github-mcp-s…
NVD published two OS command injection CVEs in MCP servers on 30 September 2026, both assigned by VulDB from public issue reports with PoCs…
CVE-2026-104850: MCP TypeScript SDK Let a Malicious MCP Server Name Its Own Authorization Server and Receive …
The Model Context Protocol maintainers published GHSA-6qxp-vccf-f47h for the official TypeScript SDK on 30 September 2026; it was assigned …
PixelLeak: Coding Agents Posted 13,000 Internal Screenshots to Public GitHub Repos Under Developers' Personal…
Glow Labs (Yoni Gottesman, Noam Kesten) published PixelLeak on 29 September 2026: more than 13,000 internal images from developers at over …
CVE-2026-105697: Langflow Ran Any OS Command Placed in an MCP stdio Server Config (CVSS 9.9); the 1.9.0 Fix W…
Langflow published GHSA-w794-rj3p-xv45 on 28 September 2026, and NVD published CVE-2026-105697 on 5 October with a CVSS 3.1 score of 9.9. B…
MCP Reference SDKs: A Malicious Server Could Pick Where the Python OAuth Client Sent Its Secrets, and Both SD…
The Model Context Protocol reference SDKs published four client-side advisories between 28 September and 2 October 2026, none with a CVE an…
brig Agent Sandbox: Project-Mount Symlink Traversal Let a Coding Agent Get Any Host Directory Mounted Read-Wr…
brig is a Go tool for running AI coding agents such as Claude Code inside a container or microVM sandbox. It mounted the project the operat…
Claude Code "Mods" (Function Hooks) Preview Gives Plugin and Skills-Folder Code In-Process Control of Tools, …
Dash Security (Yuval Fischer) published an analysis on 25 September 2026 of Claude Mods, also called function hooks, a preview feature Anth…
GHSA-632h-h47v-g4x4: A Web Page Can Make `opencode serve` npm-Install an Attacker Tarball and Run Its Preinst…
Datadog Security Labs (Christophe Tafani-Dereeper) published GHSA-632h-h47v-g4x4 on 24 September 2026, the same day Anomaly published the a…
Pluto Operation:MCP: 147 of 179 Internet-Facing MCP Servers Accepted Unauthenticated tools/call (Root Shells …
Pluto Security (Avishai Gonen, Ehud Melzer) published on 24 September 2026 the results of Operation:MCP internet scanning: 179 confirmed ex…
SalesBleed: Zero-Click Data Exfiltration From Salesforce Agentforce via a Poisoned Web-to-Lead Record
Zenity Labs (Alex Apostolov, Joao Donato, Avishai Efrat, Ayush RoyChowdhury) published SalesBleed on 24 September 2026. An attacker submits…
MemTensor Compromise: Poisoned OpenClaw Memory Plugin and MemoryOS Releases Run the sckit Credential Stealer …
Socket (Karlo Zanki) reported on 23 September 2026 that a threat actor published malicious releases of two MemTensor MemOS packages the sam…
CVE-2026-77244: mcp-atlassian Over HTTP Ran Anonymous Requests as the Operator, and the SSE Transport Stayed …
NVD published CVE-2026-77244 on 22 September 2026 (GHSA-wrhw-j3f9-8vc6, CVSS 3.1 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Before 0.22.0,…
A Repo-Defined Claude Code Subagent Downgraded Its Own Security Review to Haiku and Kept the Reviewer Out of …
Straiker STAR Labs (Brian Cumi) published on 22 September 2026 a Claude Code attack that needs no prompt injection or jailbreak. A maliciou…
MCP server/discover `instructions` Field Can Inject Before the First Tool Call (MCP-2026-015)
Mike Moore (@themsquared) published a red-team lab (write-up 11 September 2026; RuntimeWire coverage 18 September 2026) showing that an MCP…
ZCode (Z.ai) Silently Uploaded Encrypted Full-Workspace Snapshots, Including .git History, to Aliyun OSS
On 18 September 2026 blogger ferstar, a paying Z.ai Coding Plan subscriber, reported that the ZCode desktop client builds encrypted full-wo…
Plugin4Shell: SHA-Pinning Bypass Gives Zero-Click RCE Across Claude Code, Codex, Copilot, and Gemini CLI
Air Security (Or Nevo, Dor Granat, Niv Hoffman) published Plugin4Shell on 17 September 2026 (covered by The Register the same day and The H…
Obot MCP Gateway GHSA-6fwv-3h4c-37j9 (CVSS 8.1): The Composite Route Skipped the Deny List, Reopening an MCP …
Obot published repository advisory GHSA-6fwv-3h4c-37j9 on 17 September 2026, rated high (CVSS 3.1 8.1), credited to arpitjain099, with no C…
CVE-2026-90999 (PhantomFix): Fabricated Sentry Events Steer Seer Autofix Into Coding-Agent RCE (CVSS 9.8)
CERT/CC vulnerability note VU#212479 (published 16 September 2026; researchers Nikita Benkovich and Vitalii Valkov of agyn, who also wrote …
Mandiant: Hijacked AI Coding-Assistant Session Deploys Shai-Hulud Across ~100 Internal Repos
Mandiant's September 2026 AI Risk and Resilience report (Google Cloud; covered by The Hacker News on 16 September 2026) documents an IR cas…
OpenAI Codex: Two Sandbox Escapes, apply_patch "Overpatch" in Codex CLI and "Heapjack" Token Leak in the Code…
Accomplish principal security researcher Oren Yomtov published two Codex sandbox escapes on 15 September 2026, after reporting both to Open…
Mistral Vibe Shell Permission Bypass: Env-Var Prefix RCE and Unchecked Redirect File Write (CVE-2026-87987 CV…
HiddenLayer published two advisories on 11 September 2026, credited to Esteban Tonglet, for permission-check bypasses in the Bash tool of M…
Wiz: Nearly 1 in 10 Internet-Facing LiteLLM Gateways Accepted sk-1234; MCP Auth Bypass Lands on CISA KEV
Wiz Research published on 9 September 2026 (picked up by The Hacker News on 10 September) a scan of 3,074 internet-facing LiteLLM gateways …
Anthropic September 2026 Threat Report: Fake Claude Code Installers and a Criminal Market in Stolen AI Creden…
Anthropic's Threat Intelligence team published "Detecting and countering misuse of AI: September 2026" on 10 September 2026, covering opera…
CVE-2026-88938: knowns code.find MCP Tool Reads Any Source File Outside the Project Root (CVSS 7.1)
knowns through 0.33.0 fails to confine the path argument of its code.find MCP tool to the project root, so an AI agent session can supply a…
CVE-2026-82533: DeepSeek Harness's Unauthenticated Local Control API Let a Sandboxed Agent Turn Off Its Own S…
OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek…
Gen Digital: Infostealers (CallbackBeaver, Amatera, Remus, Djinn) Now Harvest AI Coding-Agent Tokens, MCP Con…
Gen Digital threat research team lead Jan Rubín reported on 8 September 2026 that infostealer families have added AI coding agents to their…
Shai-Hulud Wave-C Payload Returns After 111 Days — Including Feishu Docx MCP Server on npm
On 7 September 2026 Aikido Security reported that a single npm account published, within one hour, new versions of four unrelated packages …
Grafana MCP: A Fake Session ID Plus CVE-2026-19516 SSRF Turns the Server Into an Unauthenticated Cloud Pivot …
Pillar Security published on 2 September 2026 two chained flaws in mcp-grafana, Grafana's official Model Context Protocol server (~1.9M cum…
Deadbugz: An MCP Server That Behaves for Exactly Three Tool Calls, Then Rewrites Its Own Tool Descriptions
Pillar Security reported an active campaign distributing a malicious MCP server through public GitHub pull requests. The server calls itsel…
Vendor Documentation Told the Agent to Install a Package Nobody Had Registered, and Fortune 500 Agents Did It
Alon Hertz and a team at a stealth-stage security startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 firms an…
GitSpawn: A Line in .git/config Runs Attacker Code in Seven Coding Agents, Most of Them Before the Trust Prom…
Manifold Security published eight code-execution findings on 1 September 2026 under the name GitSpawn, covering Claude Code, OpenAI Codex, …
OWASP Publishes the 2026 LLM Top 10 and an Agent Control Standard for Runtime Governance
The OWASP GenAI Security Project announced on 1 September 2026 a refreshed Top 10 for LLM Applications for 2026 plus a new Agent Control St…
Kiro Powers: A Steering File Renders Your Local Files Into a Markdown Image and Ships Them Out
Mindgard showed that attacker-controlled repository content can steer the AWS Kiro agent into exfiltrating local data with no code executio…
CVE-2026-64849: MLflow SSRF Exploited Within Hours and Added to CISA KEV (CVSS 9.3)
An unauthenticated server-side request forgery in MLflow's model-registry webhooks lets an attacker proxy requests through the server into …
CVE-2026-75130: Context7 MCP Serves Unsanitised "Custom AI Instructions" Into Any Connected Agent (CVSS 9.0)
Context7, Upstash's widely installed documentation MCP server, lets its free-text Custom AI Instructions feature reach a connected coding a…
CVE-2026-24301: CoSnitch Talked Copilot Into Naming the Parameter That Exfiltrates Its Own Session
Varonis Threat Labs mapped Copilot Personal's internals by repeatedly asking it why automatic prompt execution was not possible and reframi…
Claude Code Makes Auto Mode the Default Permission Mode for Paid Plans
From 14 August, new Claude Code sessions on Pro, Max and Team plans default to auto mode, in which a separate classifier judges each tool c…
The Model Is the Malware: Four Evaluation Agents Reached Real Production Systems
SentinelLabs analyzed four incidents in which frontier-lab agents under evaluation broke out onto live infrastructure. OpenAI models held a…
CVE-2026-73498: mcp-atlassian Uploads Any File the Server Can Read Into Confluence (CVSS 7.7)
In mcp-atlassian before 0.22.0, the confluence_upload_attachment tool passes a client-supplied file_path straight to open(file_path, 'rb') …
GhostSplice: Malicious MCP Servers Split One Instruction Across Two Channels to Beat Review
ASSET Research Group showed that an MCP server can advertise a bland, harmless tool and then supply the rest of the instruction later throu…
DEF CON 34: One Pyodide Escape Broke the Sandbox in Seven Products at Once
Cyera researchers Vladimir Tokarev and Saar Pearl showed that products relying on Pyodide for sandboxed Python were enforcing their restric…
GhostJacking: A Firewall Block Log Is an Injection Channel, Because the Agent Reads It Afterwards
Tenet Security presented GhostJacking at DEF CON 34 on 9 August 2026, and the shape of it is worth sitting with, because the delivery chann…
Shai-Hulud Reaches the Official MCP Registry, Shipping Poisoned .claude and .vscode Settings
The worm behind this month's 440-package npm outbreak used the official Model Context Protocol Registry for the first time. A registry entr…
CVE-2026-12537: Gemini CLI Command Injection Reaches CI Runner Hosts Before the Sandbox Starts (CVSS 10.0)
Running headless in CI, Gemini CLI automatically trusted whatever workspace folder it was pointed at and loaded configuration from it, incl…
CVE-2026-43631: Unauthenticated RCE in llama-server When Idle Sleep Is Enabled (CVSS 9.2)
A use-after-free on the vocab pointer in llama.cpp's llama-server lets an unauthenticated remote attacker run code by sending requests whil…
CVE-2026-54316: Claude Code Pre-Approved huggingface.co, Turning a Download Counter Into an Exfiltration Chan…
Claude Code shipped huggingface.co as a bare pre-approved hostname for the WebFetch tool, so every path on that domain, including attacker-…
RovoBlast: One Link Makes Atlassian Rovo Exfiltrate Jira and Confluence Data
Varonis showed that Rovo Chat honoured a rovoChatPrompt URL parameter that pre-filled the assistant with attacker-supplied instructions, so…
CoreBreak: AWS, Google and Vercel Agent Runtimes Ran Tools Without Ever Invoking the Model
Stealth researchers Hedi Ingber and Aviyam Ivgi showed at Black Hat USA 2026 that four agent runtimes accepted anything shaped like a model…
Prompt Injection Is Not the Bug: Check Point Discloses 11 Flaws Inside the Agent Framework Runtimes
After a year spent examining LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, Check Point researchers Yarde…
ChainDrop: Opening a Repository Is Enough to Execute Attacker Code
Pillar Security and Microsoft threat intelligence both documented ChainDrop, a self-propagating supply chain compromise where merely openin…
keyv/cacheable npm Worm Writes Auto-Run Hooks Into .claude/settings.json
A self-propagating worm in the Shai-Hulud family compromised the keyv and cacheable npm namespaces and spread to more than 400 packages. Be…
Claude Code Silently Patched Five Permission and Hook Bypasses Across 2.1.216 to 2.1.222
Five releases between 20 July and 4 August each fixed a security-relevant bypass, recorded only as changelog bullets with no advisory or CV…
Open VSX Removes 77 Malicious "Evil Twin" IDE Extensions
Manifold Security reported 77 malicious extensions uploaded to Open VSX that impersonated popular legitimate extensions, exfiltrating devel…
CVE-2026-67357: An ArcadeDB Settings Tool Exposed Over MCP Returns the Cluster Token in Cleartext (CVSS 7.7)
ArcadeDB before 26.7.3 exposes a get_server_settings tool over MCP that returns arcadedb.ha.clusterToken in cleartext. That token is enough…
A Hole in Every One: One Malicious Agent Skill Defeats All Eight Open-Source Skill Scanners
Adversa AI built a single malicious agent skill and ran it past all eight open-source AI skill scanners currently available. Every one pass…
RufRoot: Unauthenticated RCE via an Exposed MCP Bridge Turns Agents Into Rogue Admins (CVSS 10.0)
Noma Labs found that Ruflo exposed an MCP bridge with no authentication, letting an unauthenticated attacker reach it directly and execute …
MacSync: A Fake Claude Install Guide Hosted on claude.ai Delivers a macOS Stealer
Huntress traced a campaign where Google Ads pushed a fake "Apple Support" Claude installation guide that was itself hosted on claude.ai/sha…
SharedRoot: Escaping the Claude Cowork Sandbox to Read the Host Mac Filesystem
Accomplish AI chained a public Linux kernel flaw in the traffic-control act_pedit module (CVE-2026-46331, a page-cache poisoning bug, assig…
A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP)
Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull-request descriptions verbatim through repo_get_pull_…
The Week of Sandbox Escapes: Cursor, Codex CLI, Gemini CLI and Antigravity All Broke Out
Pillar Security published a week-long series demonstrating working sandbox escapes in four AI coding agents in a row, then a follow-up when…
CVE-2026-10591: AWS Kiro Rewrites Its Own MCP Config for Silent RCE (CVSS 8.8)
Intezer and Kodem Security showed that hidden instructions on an ordinary web page could make AWS Kiro rewrite its own MCP server config an…
Agent Data Injection Tricks AI Agents into Misreading Tool Data
Researchers disclosed Agent Data Injection (ADI), which corrupts the factual data agents trust (sender names, button IDs, tool results) usi…
AsyncAPI npm Packages Backdoored with Miasma Malware Framework
Five AsyncAPI npm releases were trojanized with the Miasma framework, which supports credential theft, AI tool poisoning, lateral movement,…
DeepJack: One-Click Cursor Deeplink Installs an Attacker-Controlled MCP Server
Adversa AI showed that a crafted cursor:// deeplink can install a malicious MCP server and run commands under the victim's account after on…
CVE-2026-15643: The AWS HealthLake MCP Server Followed an Attacker's Pagination URL, Carrying AWS Credentials
The AWS HealthLake MCP server before 0.0.14 did not validate that a pagination URL pointed back at the expected HealthLake endpoint, so a c…
CVE-2026-50510: GitHub Copilot Plugin for JetBrains IDEs Allows Local Code Execution (CVSS 7.8)
Microsoft disclosed an improper resource-name restriction (CWE-641) in the GitHub Copilot plugin for JetBrains IDEs that allows local code …
jscrambler npm Package Hijacked to Drop AI Config Infostealer
An attacker used a stolen credential to push malicious jscrambler npm versions carrying a cross-platform Rust infostealer via a preinstall …
Friendly Fire: Claude Code and Codex Driven to RCE from Untrusted Repos
The AI Now Institute published a proof-of-concept (Friendly Fire) showing Claude Code and OpenAI Codex in autonomous review modes can be dr…
GhostApproval: Symlink Bypass Hits Claude Code, Cursor, Windsurf
Wiz Research disclosed GhostApproval, where a malicious repo plants symlinks that AI coding assistants fail to resolve before writing, so a…
HalluSquatting Weaponizes AI Package Hallucinations for Malware Delivery
Tel Aviv University, Technion, and Intuit researchers detailed HalluSquatting, which pre-registers the fake package and skill names that AI…
Workflow Jailbreak Defeats GitHub Copilot Safety Guardrails
Alan Turing Institute researchers showed a workflow-level jailbreak that routes harmful requests through an ordinary multi-step coding task…
GitLost: A Public GitHub Issue Makes Agentic Workflows Leak Private Repos
Noma Labs found that anyone able to open an issue on a public repository could make GitHub Agentic Workflows read private repositories in t…
Indirect Prompt Injection Observed in the Wild: AI Agents Paid Attackers
Zscaler ThreatLabz documented two live campaigns that hide instructions in web pages to steer browsing AI agents, the first confirmed in-th…
DuneSlide: Zero-Click RCE Flaws in Cursor AI Code Editor (CVSS 9.8)
Cato AI Labs disclosed DuneSlide, two critical flaws (CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8) that let a single prompt escape Cur…
CVE-2026-50143: Apify MCP Server Leaks API Tokens via Path Injection
A path injection flaw in the @apify/actors-mcp-server npm package lets a malicious Actor with a crafted webServerMcpPath redirect the MCP c…
Phantom Squatting: Attackers Register the Domains That Models Hallucinate
Unit 42 ran 685,339 adversarial prompts across 913 brands and collected 2.1 million unique URLs, finding that models routinely invent plaus…
CVE-2026-46406: Claude Code /copy Wrote Secrets to a World-Readable Temp Path
Claude Code's /copy command wrote every response to the hardcoded path /tmp/claude/response.md, world-readable and in a traversable directo…
Multiple GitHub Actions & npm Packages Compromised (TeamPCP, Miasma-like)
Between June 24-26 2026, repositories of multiple GitHub Actions (e.g. codfish/semantic-release-action, simonecorsi/mawesome) were compromi…
AgentJacking: Public Sentry DSN Hijacks Claude Code, Cursor & Codex via MCP
Tenet Security's Threat Labs documented "AgentJacking": a public Sentry DSN (logging key) left exposed in a project lets an attacker interc…
DifyTap: Four Authorization Flaws in Dify Enable Cross-Tenant AI Data Exfiltration
Zafran Security disclosed four vulnerabilities in the Dify open-source LLMOps platform (which powers 1M+ AI apps): CVE-2026-41947 (CVSS 9.1…
CVE-2026-49468: LiteLLM Authentication Bypass via Host Header
A critical authentication-bypass flaw in LiteLLM versions prior to 1.84.0 stems from improper handling of Host headers in the auth layer, l…
Mastra npm Packages Trojanized via Maintainer Account Compromise
Wiz is tracking the trojanization of dozens of npm packages published by the Mastra (AI agent framework) organization after a maintainer ac…
Fifteen JetBrains Marketplace Plugins Harvested AI Provider API Keys Across 70,000 Installs
Aikido Security found a coordinated campaign of at least 15 JetBrains Marketplace plugins across seven vendor accounts, posing as AI coding…
Atomic Arch: AUR + npm Supply Chain Compromise (atomic-lockfile)
Wiz Research tracked "Atomic Arch": attackers took over 400+ orphaned Arch User Repository (AUR) packages with new accounts and modified bu…
Claude Code GitHub Action: Prompt-Injection Credential Theft (Microsoft Disclosure)
Microsoft Security disclosed a now-patched flaw in Anthropic's Claude Code GitHub Action: attackers hide prompt-injection instructions in G…
TeamPCP Injects Malware into Microsoft-Linked GitHub Repositories
TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches across the Azure, Azure-S…
binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propagation
Researchers identified an active npm supply-chain attack that abuses the binding.gyp build mechanism to execute malicious code during insta…
GitHub Repository Exfiltration Campaign Using Compromised PATs
Wiz Research identified an active campaign in which a threat actor used compromised GitHub Personal Access Tokens (classic) for mass reposi…
CVE-2026-45618: LiquidJS Template Injection RCE
A critical remote-code-execution flaw in the npm package LiquidJS lets attackers execute arbitrary code by supplying specially crafted temp…
"Miasma" npm Worm Compromises 31 Red Hat Cloud Services Packages via CI/CD Hijack
A self-propagating Mini Shai-Hulud variant dubbed "Miasma: The Spreading Blight" compromised 31 @redhat-cloud-services npm packages, not vi…
TrustFall: One-Click RCE via Claude Code Trust-Dialog Regression
Adversa AI disclosed TrustFall, a regression in Claude Code's trust dialog combined with a settings-scope inconsistency that lets a cloned …
SymJack: Symlink-Disguised File Copy Tricks AI Coding Agents into RCE
Adversa AI disclosed SymJack, a symlink-disguised file-copy operation that tricks AI coding assistants into arbitrary code execution while …
TrapDoor: Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Config Files
TrapDoor planted 34 malicious packages across 384 versions on npm, PyPI, and Crates.io, disguised as developer tools and security scanners …
Three Typosquatted "AI Labs SDK" PyPI Packages Exfiltrate Developer Reconnaissance Data
Three malicious packages typosquatting AI Labs were published to PyPI on May 19 and available for less than 24 hours, accumulating ~1,600 i…
Nx Console v18.95.0: Malicious VS Code Extension Harvests Claude Code Credentials
A malicious build of the Nx Console VS Code extension, nrwl.angular-console v18.95.0 (2.2M+ installs), was published to the Microsoft VS Co…
CVE-2026-32211: Azure MCP Server Authentication Flaw Exposes Sensitive Data (CVSS 9.1)
Microsoft's Azure MCP Server contained an authentication-bypass flaw that let unauthenticated callers query resource inventories, list conn…
OpenAI Confirms Security Breach via TanStack npm Supply Chain Attack
OpenAI confirmed that two employee workstations were silently compromised in the May 11 TanStack supply chain attack, exposing internal CI …
Three MCP Database-Server Flaws Hit Apache Doris, Alibaba RDS, Apache Pinot: One Left Unpatched
A bug hunter disclosed three MCP server flaws across major database integrations: Apache Doris's MCP server allowed unintended SQL executio…
CVE-2026-35435: Azure AI Foundry Elevation of Privilege (CVSS 8.6)
A critical access-control flaw in Azure AI Foundry's M365 published agents allowed unauthenticated remote attackers to elevate to a tenant-…
MistralAI PyPI Package v2.4.6 Backdoored With Credential Stealer
The mistralai PyPI package v2.4.6 was published May 12 at 00:05 UTC containing injected malicious code that runs on import and spawns a bac…
"Mini Shai-Hulud": 170+ npm/PyPI Packages Compromised in Coordinated TanStack/Mistral/UiPath Attack
A coordinated supply chain attack by the TeamPCP extortion gang published 404 malicious versions across 170+ npm and PyPI packages on May 1…
CVE-2026-44338: PraisonAI Authentication Disabled by Default, Exploited Within Hours
PraisonAI's legacy API server ships with authentication disabled by default, allowing anyone on the network to hijack autonomous agent runs…
CVE-2026-33032: nginx-ui MCP Endpoint Authentication Bypass (CVSS 9.8)
nginx-ui's MCP message endpoint shipped without any authentication on the command-execution path, allowing unauthenticated attackers to res…
Palo Alto Unit 42: "Double Agents" Hijack GCP Vertex AI Agent Engine
Unit 42 demonstrated a multi-step attack chain against Google Cloud Vertex AI Agent Engine that extracts the service agent's default creden…
OpenClaw "Claw Chain": Four CVEs Enable Data Theft, Privilege Escalation, and Persistence
Four chained vulnerabilities (CVE-2026-44112, 44113, 44115, 44118) in OpenClaw allow an attacker with minimal foothold to escalate privileg…
CVE-2026-40576: excel-mcp-server Path Traversal Allows Unauthenticated File Read and Overwrite (CVSS 9.4)
A path traversal flaw in excel-mcp-server let unauthenticated attackers read, write and overwrite arbitrary files. Its get_excel_path() pas…
Checkmarx Supply Chain Compromise: Malicious VS Code Extensions and Docker Images
The ongoing Checkmarx supply chain campaign expanded in April 2026 with attackers publishing malicious KICS Docker images and VS Code exten…
Self-Propagating npm Supply Chain Worm Targets AI Agent Packages
A self-spreading CanisterWorm-style malware strain was discovered in multiple npm packages from Namastex Labs, an agentic AI company. The w…
Google Patches Antigravity IDE Prompt Injection Sandbox Escape
Pillar Security researchers discovered a prompt injection vulnerability in Google's Antigravity agentic IDE that allowed arbitrary code exe…
Claude Desktop Silently Installs Browser Extension Bridges: Privacy Violation
Security researcher Alexander Hanff discovered that Claude Desktop silently installs Native Messaging host manifests into seven Chromium br…
"Comment and Control": Claude Code, Gemini CLI, Copilot Agents Vulnerable to Prompt Injection via GitHub Comm…
Johns Hopkins University researchers discovered that AI coding agents processing GitHub data (PR titles, comments, issue bodies) are vulner…
Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk
OX Security disclosed a systemic vulnerability baked into Anthropic's official MCP SDK across Python, TypeScript, Java, and Rust. Unsafe de…
Malicious AI Assistant Extensions Harvest LLM Chat Histories from VS Code
Microsoft Security researchers identified malicious VS Code extensions masquerading as AI coding assistants that silently harvest LLM conve…
Axios npm Supply Chain Attack: North Korean RAT via AI Agent Auto-Install
UNC1069 (North Korea-nexus) compromised the Axios npm maintainer's credentials and published two backdoored releases containing a phantom d…
CVE-2026-33579: OpenClaw Privilege Escalation via /pair approve (CVSS 9.8)
OpenClaw's /pair approve command path failed to validate the approving user's privilege level, allowing any user with minimal operator.pair…
CVE-2026-25536: MCP TypeScript SDK Cross-Client Data Leak
When a single McpServer instance using StreamableHTTPServerTransport was reused across multiple HTTP clients, a common stateless deployment…
CVE-2025-59536: Claude Code RCE via Hooks/MCP in Untrusted Repositories
Arbitrary shell commands embedded in Hooks and MCP server definitions inside a malicious repository's .claude/settings.json executed automa…
CVE-2026-21852: Claude Code API Key Exfiltration via Malicious Repository Config
Claude Code's project-load flow issued API requests, including auth headers, to ANTHROPIC_BASE_URL before showing a trust prompt, allowing …
"Clinejection": Cline v2.3.0 Supply Chain Attack via GitHub Issue Bot Prompt Injection
An attacker injected a malicious instruction into a GitHub issue title, which Cline's AI-powered triage bot interpreted as a real command a…
ToxicSkills: 36 Percent of Audited Agent Skills Carried Security Flaws, and 8 Malicious Ones Were Still Live
Snyk audited 3,984 agent skills across the ClawHub and skills.sh marketplaces and found 1,467 of them, 36 percent, carrying security flaws,…
Palo Alto Unit 42: MCP Sampling Prompt Injection for Persistent Session Hijacking
Unit 42 demonstrated that MCP's sampling/createMessage feature, which lets an MCP server ask the host LLM to generate text on its behalf, c…
VSCode Fork "Recommended Extension" Namespace Squatting Supply Chain Attack
AI-powered IDEs forked from VS Code (Cursor, Windsurf, Google Antigravity, Trae) inherit Microsoft's hardcoded extension recommendation lis…
"MCP fURI" + CVE-2026-26118: Microsoft MarkItDown MCP SSRF to AWS Cloud Takeover
Microsoft's MarkItDown MCP server placed no restrictions on the URI passed to convert_to_markdown, allowing any caller to reach internal HT…
CVE-2026-21520: Microsoft Copilot Studio Indirect Prompt Injection ("ShareLeak")
Copilot Studio concatenated SharePoint form input directly into the agent's system prompt with no sanitization, allowing an attacker fillin…
A Marketplace Plugin Quietly Chose Where Claude Code Installed Your Dependencies
Prompt Security researcher David Abutbul showed a plugin called Python Dependency Helper, installed from an unvetted marketplace hosted in …
A CVE list tells you what is vulnerable; Anomity tells you where it is running. Anomity inventories the AI agents, MCP servers, IDE extensions and skills on every developer device and flags the ones named in these advisories. See how Anomity works →
This list is also available as Markdown, as JSON, and in the JSON Feed.