Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
26 Feb 2026 · Model Context Protocol
In mcp-server-git versions before 2026.1.14, the git_add tool did not validate that file paths in the files argument stayed within repository boundaries, so relative paths containing '../' could stage files from outside the repository into the Git index. The issue is fixed in version 2026.1.14 (CVE-2026-27735).
coding·tool misuse·
26 Feb 2026 · Zed Industries
Zed's AI agent file tools (`read_file`, `edit_file`) in versions before 0.225.9 followed symbolic links out of the project directory, allowing reads and writes outside the workspace and bypassing `file_scan_exclusions` and `private_files` protections, potentially leaking sensitive user data to the LLM. The issue is fixed in version 0.225.9.
coding·excessive permissions·
26 Feb 2026 · Agenta
Two vulnerabilities were disclosed in the open-source Agenta LLMOps platform: a Python sandbox escape in the custom code evaluator (CVE-2026-27952) that let authenticated users run arbitrary code on the API server via a whitelisted numpy package, and a server-side template injection flaw in evaluator template rendering (CVE-2026-27961). Both affect self-hosted or managed Agenta deployments and are fixed in versions 0.48.1 and 0.86.8 respectively.
other·misconfiguration·
26 Feb 2026 · Langflow
Langflow versions prior to 1.8.0 hardcoded `allow_dangerous_code=True` in the CSV Agent node, exposing LangChain's Python REPL tool so an attacker could run arbitrary Python and OS commands on the server via prompt injection. Version 1.8.0 fixes the issue.
workflow·prompt injection·
25 Feb 2026 · Parse Community
Three chained vulnerabilities (CVE-2026-27595, CVE-2026-27608, CVE-2026-27609) in the opt-in AI Agent API endpoint of Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 allowed unauthenticated remote attackers to perform arbitrary reads and writes on connected Parse Server databases using the master key, due to missing authentication, missing per-app authorization and absent CSRF protection. The issues were fixed in version 9.0.0-alpha.8, with removal of the agent config block offered as a workaround.
other·excessive permissions·
25 Feb 2026 · agentfront
Enclave, a JavaScript sandbox for safe AI agent code execution, contained a flaw in `@enclave-vm/core` before version 2.11.1 that allowed attackers to escape the sandbox security boundaries and achieve remote code execution. The issue was fixed in version 2.11.1.
coding·unknown·
25 Feb 2026 · LangChain
Two LangChain vulnerabilities were disclosed and patched: a redirect-based SSRF bypass in RecursiveUrlLoader in @langchain/community (CVE-2026-27795), which allowed a validated public URL to redirect to internal or metadata endpoints, and a URL parameter injection flaw in LangSmith Studio (CVE-2026-25750) that leaked bearer tokens, user IDs and workspace IDs to attacker-controlled servers when users clicked crafted links.
workflow·data leak·
21 Feb 2026 · YosefHayim (ebay-mcp open source project)
All versions of the open source eBay API MCP Server are vulnerable to environment variable injection via the ebay_set_user_tokens tool, whose updateEnvFile function writes values to the .env file without validating newlines or quotes. Attackers can inject arbitrary environment variables, potentially causing configuration overwrites, denial of service, or remote code execution.
other·tool misuse·
19 Feb 2026 · OpenClaw
Five CVEs were published for the OpenClaw personal AI assistant (formerly Clawdbot) covering prompt injection via untrusted Slack channel metadata and unsanitized workspace paths, a misleading macOS deep-link confirmation dialog that could lead to arbitrary command execution, local file exfiltration via the Feishu extension's sendMediaFeishu tool, and path traversal in browser download helpers. All issues were fixed in releases 2026.2.3 through 2026.2.15.
other·prompt injection·
19 Feb 2026 · Cisco
A vulnerability in the optional API Server of Cisco AI Defense's Skill Scanner, caused by erroneous binding to multiple interfaces, allowed unauthenticated remote attackers to exhaust memory or upload files to arbitrary folders. It affects Skill-scanner 1.0.1 and earlier and is fixed in release 1.0.2.
other·misconfiguration·
13 Feb 2026 · Cloudflare
A reflected cross-site scripting flaw in the AI Playground's OAuth callback handler allowed the `error_description` query parameter to be interpolated unescaped into an inline script tag. Exploitation via a crafted link could expose a victim's stored LLM chat history and let an attacker interact with MCP servers connected to the victim's session.
other·misconfiguration·
13 Feb 2026 · Cursor
A vulnerability in Cursor versions prior to 2.5 allowed a malicious agent, e.g. via prompt injection, to write to improperly protected .git settings including git hooks, enabling out-of-sandbox remote code execution without user interaction when Git next ran those commands. The issue was fixed in version 2.5.
coding·prompt injection·
11 Feb 2026 · akutishevsky
CVE-2026-26029 describes a command injection flaw in sf-mcp-server, a Salesforce MCP server implementation for Claude for Desktop, caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Exploitation allows arbitrary shell command execution with the privileges of the MCP server process.
workflow·tool misuse·
10 Feb 2026 · Microsoft
Two CVEs (CVE-2026-21256 and CVE-2026-21516) describe improper neutralization of special elements used in a command in GitHub Copilot, and in Visual Studio for one of them, allowing an unauthorized attacker to execute code over a network. Both are covered by Microsoft Security Response Center advisories.
coding·unknown·
10 Feb 2026 · labring
Two vulnerabilities were disclosed in FastGPT, an AI agent building platform: versions 4.14.0-4.14.5 allowed unauthenticated access to the plugin system via /api/plugin/xxx, potentially crashing it and losing plugin installation state, and server-side fetching nodes (web page acquisition, HTTP nodes) allowed requests to internal network addresses. Fixes shipped in 4.14.5-fix and 4.14.7 respectively.
workflow·excessive permissions·
10 Feb 2026 · LangChain
Two server-side request forgery vulnerabilities were disclosed in LangChain: ChatOpenAI.get_num_tokens_from_messages() fetched arbitrary image_url values without validation (CVE-2026-26013), and the @langchain/community RecursiveUrlLoader used a string-prefix check for its preventOutside option and did not block private or reserved IP addresses, allowing crawls of internal infrastructure and cloud metadata services (CVE-2026-26019). Both were fixed in langchain-core 1.2.11 and @langchain/community 1.1.14 respectively.
workflow·tool misuse·
9 Feb 2026 · GitLab
GitLab patched a vulnerability in the Duo Workflow Service component of the GitLab AI Gateway where crafted Duo Agent Platform Flow definitions caused insecure template expansion of user-supplied data. The flaw could lead to denial of service or code execution on the Gateway and was fixed in AI Gateway versions 18.6.2, 18.7.1 and 18.8.1.
workflow·unknown·
9 Feb 2026 ·
Python code executed via 'runPython'/'runPythonAsync' in the mcp-run-python MCP server is not isolated from the surrounding JavaScript environment, letting Python code use Pyodide APIs to alter the JS environment. An attacker could hijack the MCP server, including shadowing MCP tools; the project is archived and unlikely to be fixed.
coding·excessive permissions·
6 Feb 2026 · smn2gnt
A vulnerability in the MCP Salesforce Connector, a Model Context Protocol server for Salesforce integration, allowed arbitrary attribute access that could disclose the Salesforce authentication token. The issue affects versions prior to 0.1.10 and is fixed in 0.1.10.
workflow·data leak·
6 Feb 2026 · Pydantic
Two vulnerabilities were disclosed in the Pydantic AI Python agent framework: a path traversal flaw in the web UI (CVE-2026-25640) that lets a crafted URL serve attacker-controlled JavaScript and steal chat history, and an SSRF flaw in URL download functionality (CVE-2026-25580) that can make the server request internal network resources. Both are fixed in versions 1.51.0 and 1.56.0 respectively.
workflow·tool misuse·
6 Feb 2026 · Microsoft
Multiple vulnerabilities were disclosed in Microsoft's AI agent development tooling, including an arbitrary file write in the Semantic Kernel .NET SDK's SessionsPythonPlugin (fixed in Microsoft.SemanticKernel.Core 1.71.0) and command injection and TOCTOU race condition flaws in GitHub Copilot with Visual Studio and Visual Studio Code that allow privilege elevation, security feature bypass, or code execution over a network.
coding·tool misuse·
6 Feb 2026 · agentfront
Versions of the Enclave (enclave-vm) secure JavaScript sandbox prior to 2.10.1 contain multiple weaknesses — AST sanitization bypass via dynamic property access, incomplete error-object hardening, and Function constructor access via host object references — that allow AI agent code to escape the sandbox. The issue was fixed in version 2.10.1.
coding·excessive permissions·
4 Feb 2026 · Significant Gravitas
AutoGPT's SendDiscordFileBlock passed an unfiltered user-supplied URL to aiohttp.ClientSession().get, allowing server-side request forgery. The issue was patched in autogpt-platform-beta-v0.6.34.
workflow·tool misuse·
4 Feb 2026 · OpenClaw
In OpenClaw personal AI assistant versions prior to 2026.1.30, the isValidMedia() function in src/media/parse.ts accepted absolute paths, home directory paths and directory traversal sequences, letting the agent read any file on the system by outputting MEDIA:/path/to/file and exfiltrate it to the user or channel. The issue was patched in version 2026.1.30.
other·excessive permissions·
4 Feb 2026 · Coding-Solo
A command injection flaw in the godot-mcp Model Context Protocol server (prior to version 0.1.1) passed user-controlled input such as projectPath directly to exec(), allowing an attacker to run arbitrary shell commands with the privileges of the MCP server process. The issue affects any tool accepting projectPath, including create_scene, add_node and load_sprite, and was patched in version 0.1.1.
coding·tool misuse·
3 Feb 2026 · Anthropic
A batch of CVEs disclosed in February 2026 described flaws in Anthropic's agentic coding tool Claude Code, including insufficient WebFetch trusted-domain validation, Bash/ZSH and find command parsing bypasses, symlink deny-rule bypass, and a bubblewrap sandbox gap allowing persistent hook injection; a related CVE covered cross-client response data leaks in the MCP TypeScript SDK. All issues were fixed in subsequent releases.
coding·tool misuse·
