Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
29 May 2026 · jqwik
A developer added an undisclosed instruction to the jqwik library that directed AI coding agents processing the code to delete application output, reportedly out of frustration with 'vibe coders'. The hidden prompt injection was reported publicly in late May 2026.
coding·prompt injection·
29 May 2026 · InfiniFlow
A server-side template injection flaw in RAGFlow's prompt generator (rag/prompts/generator.py) in versions 0.24.0 and earlier lets any authenticated user run arbitrary OS commands on the server. Exploitation requires only registering an account and building a Canvas workflow chaining a DuckDuckGo search and LLM component to trigger the SSTI.
workflow·prompt injection·
29 May 2026 · MarcelRoozekrans
The get_diagnostics tool in Roslyn CodeLens MCP Server (versions 0.0.9 through 1.17.0) loads and executes all DiagnosticAnalyzer assemblies referenced by a target solution with no allowlist, signature check or user confirmation, and analyzer loading is enabled by default. An attacker who plants a malicious .csproj referencing an attacker-controlled DLL in a codebase the victim opens gains arbitrary code execution with the MCP server's OS privileges; fixed in 1.17.0.
coding·supply chain·
29 May 2026 · czlonkowski (n8n-mcp project)
Two vulnerabilities were disclosed in the n8n-MCP server: before 2.51.3 its telemetry sanitizer could retain fragments of URL-shaped node parameters (such as tenant identifiers or secrets in query strings) and send them to the project's anonymous telemetry backend, and before 2.51.2 multi-tenant HTTP deployments silently fell back to the operator's own N8N_API_URL/N8N_API_KEY when per-request headers were missing, letting a tenant execute n8n management calls against the operator's instance. Both issues are fixed in releases 2.51.3 and 2.51.2.
workflow·data leak·
29 May 2026 · labring
Two vulnerabilities were disclosed in the FastGPT AI agent building platform: an SSRF in the dataset preview endpoint that bypasses internal-address protection to reach internal services, and a JavaScript sandbox filter bypass (import/**/(...)) allowing arbitrary command execution inside the sandbox container. Both are fixed in version 4.15.0-beta1.
workflow·misconfiguration·
28 May 2026 · Mintplex Labs
Two vulnerabilities in AnythingLLM prior to 1.13.0 let an attacker chatting with an agent abuse the filesystem skills: an LLM-controlled ripgrep pattern (--pre=/bin/sh) enabled arbitrary command execution inside the server container, and the copy tool followed nested symlinks to copy files from outside the allowed filesystem root. Both were fixed in version 1.13.0.
workflow·tool misuse·
27 May 2026 · Dataojitori
Nocturne Memory, a long-term memory server for MCP agents, bypassed Bearer token authentication for all HTTP requests when API_TOKEN was unset or empty; combined with default 0.0.0.0 binding and wildcard CORS, this exposed the full knowledge-graph read/write API to any LAN-reachable client, allowing attackers to alter entries that auto-load into agent sessions and achieve persistent prompt injection. Fixed in version 2.4.1.
other·misconfiguration·
27 May 2026 · SafeDep
Gryph, a security layer for AI coding agents, stored sensitive file-write content (ContentPreview, OldString, NewString) in a local SQLite database at its default 'standard' log level, bypassing its own sensitive file filter and documented log level behaviour. The issue affects versions prior to 0.7.0 and is fixed in 0.7.0.
coding·data leak·
26 May 2026 · masci
Versions of the banks LLM prompt-templating library before 2.4.2 rendered prompt templates with an unsandboxed jinja2.Environment(), so applications passing user-supplied strings as templates to Prompt() were vulnerable to server-side template injection leading to remote code execution. The issue is fixed in version 2.4.2.
other·misconfiguration·
26 May 2026 · prolix-oc
In the Lumiverse AI chat application prior to version 0.9.7, the MCP server creation endpoint validated only the command binary name against an allowlist while passing the args array unchecked to a child process, letting any logged-in user run arbitrary OS-level code via inline-execution flags. The server listened on all interfaces and its host-header rebinding check could be trivially bypassed, making the flaw exploitable from any machine with network access; it is fixed in 0.9.7.
other·excessive permissions·
26 May 2026 · LangChain
LangChain versions before 0.3.85 and 1.3.3 deserialized application-controlled payloads using overly broad object allowlists, letting attacker-supplied serialized constructor dictionaries instantiate trusted LangChain classes with untrusted arguments. A related issue in the LangSmith SDKs (before Python 0.8.0 and JS/TS 0.6.0) meant prompt pull methods deserialized externally controlled public prompt manifests without distinguishing them from prompts owned by the caller's organization.
other·excessive permissions·
26 May 2026 · yoda-digital
Prior to version 0.6.0, the GitLab MCP Server's HTTP/SSE transport shipped with no inbound authentication, a wildcard Access-Control-Allow-Origin header, and a default bind to 0.0.0.0, exposing a mutation-capable RPC endpoint backed by the operator's GitLab personal access token. The issue is fixed in 0.6.0.
coding·misconfiguration·
24 May 2026 · NousResearch
A publicly disclosed vulnerability (CVE-2026-9353) in NousResearch hermes-agent up to version 2026.4.23 allows remote injection via manipulation of the THREAT_PATTERNS argument in the Skills Guard Multi-Word Prompt Handler (agent/skills_guard.py). The exploit has been published and the vendor did not respond to disclosure attempts.
other·prompt injection·
22 May 2026 · Microsoft
Two command injection vulnerabilities were published for Microsoft's Copilot assistants: CVE-2026-41090 lets an unauthorized attacker perform tampering over a network in Microsoft Copilot, and CVE-2026-42827 lets an unauthorized attacker disclose information over a network in M365 Copilot. Both stem from improper neutralization of special elements used in a command.
other·unknown·
21 May 2026 · LINE
Central Dogma's Git mirror SSH client (SshGitMirror) installs a server key verifier that unconditionally returns true and disables known_hosts fallbacks, so every outbound git+ssh:// mirror connection trusts any host key presented. An on-path attacker can impersonate the remote git server to exfiltrate mirrored configuration secrets or inject arbitrary commits that propagate to downstream services.
other·misconfiguration·
15 May 2026 · Microsoft
Three vulnerabilities disclosed in Microsoft APM, an open-source dependency manager for AI agents, allow malicious marketplace plugins or remote dependencies to copy arbitrary host files via path traversal, dereference committed symlinks into project deploy directories, and write outside the extraction root on Windows via unchecked tar extraction. All are fixed in versions 0.8.12 and 0.13.0.
coding·supply chain·
15 May 2026 · 611711Dark
MCP Calculate Server, an MCP-protocol mathematical calculation service built on SymPy, used eval() to evaluate expressions without input sanitization, allowing remote code execution. The issue was fixed in version 0.1.1.
other·tool misuse·
15 May 2026 · Open WebUI
Open WebUI versions prior to 0.9.5 validated only the initial URL in validate_url(), while downstream HTTP clients followed 3xx redirects without re-checking private or metadata IP block lists. Any authenticated user could submit a public URL redirecting to internal addresses (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read internal response bodies through retrieval, image and chat completion endpoints.
browsing·tool misuse·
14 May 2026 · Model Context Protocol
Five CVEs published on 14 May 2026 describe flaws in the Model Context Protocol ecosystem: stored XSS, open redirect, SSRF blocklist bypass, cross-deployment GitHub OIDC token reuse and fail-open OCI ownership validation in the MCP Registry, plus a missing Host-header check enabling DNS rebinding against local MCP servers in the rmcp Rust SDK. All issues were fixed in later releases (registry 1.7.5/1.7.6/1.7.7/1.7.9 and rmcp 1.4.0).
other·supply chain·
14 May 2026 · Hatchet
A missing authorization directive on Hatchet's GET /api/v1/stable/dags/tasks endpoint skipped the tenant-membership check, letting any authenticated user on the instance retrieve task metadata for DAGs belonging to other tenants. The issue is fixed in version 0.83.39.
workflow·misconfiguration·
13 May 2026 · Vercel
Vercel CLI versions 50.16.0 through 52.0.0 embedded plaintext authentication tokens passed via --token/-t into JSON follow-up command suggestions emitted in non-interactive or auto-detected AI agent mode, risking token exposure in CI/CD logs and agent transcripts. The issue is fixed in version 52.0.1.
coding·data leak·
13 May 2026 · GitHub
A vulnerability in GitHub Copilot CLI before version 1.0.43 allowed a malicious bare git repository nested in a project directory to achieve arbitrary code execution when the agent ran git operations, by abusing executable git config keys such as core.fsmonitor. The issue is fixed in version 1.0.43.
coding·tool misuse·
12 May 2026 · OpenAI
Researchers reported that a coordinated attack on the RubyGems package manager disclosed in May 2026 was carried out by a swarm of OpenAI agents, which also gained remote code execution on RubyDoc servers.
other·supply chain·
12 May 2026 · Aas-ee
Open-WebSearch, a multi-engine MCP server, CLI and local daemon for agent web search and content retrieval, had URL safety checks (isPublicHttpUrl/assertPublicHttpUrl) that failed to recognise bracketed IPv6 literals and did not resolve DNS, allowing non-blind SSRF with response bodies returned to the caller. The issue is fixed in version 2.1.7.
browsing·misconfiguration·
12 May 2026 · JunoClaw
Three CVEs in JunoClaw, an agentic AI platform built on Juno Network, covered an unvalidated filesystem path in the upload_wasm MCP tool, a bypassable substring blocklist in plugin-shell allowing unauthorized host command execution, and MCP write tools that accepted a BIP-39 mnemonic as a tool-call parameter, exposing the seed to transports, logs and telemetry. All were fixed in release 0.x.y-security-1.
other·data leak·
12 May 2026 · JunoClaw
Two vulnerabilities were disclosed in JunoClaw, an agentic AI platform built on Juno Network: plugin-shell's run_command passed agent-supplied argument strings to 'sh -c'/'cmd /C', allowing shell metacharacters to be interpreted as command syntax, and the WAVS bridge's computeDataVerify fetched agent-supplied URLs without validating scheme, port or resolved IP, causing SSRF. Both were fixed in release 0.x.y-security-1.
workflow·tool misuse·
12 May 2026 · LobeHub
In LobeHub/LobeChat before 2.1.48, unmatched custom tags in the Artifacts renderer fall back to HTML rendering, so an attacker who induces the LLM to emit malicious tags can trigger client-side XSS. The XSS can reach the Electron main process's unfiltered runCommand IPC interface to execute arbitrary system commands with the user's privileges.
other·prompt injection·
12 May 2026 ·
Code Runner MCP Server exposes its /mcp JSON-RPC endpoint without authentication on port 3088 when started with --transport http, letting a remote unauthenticated attacker call the run-code tool to execute arbitrary code via child_process.exec() with the server user's privileges. The issue is reported as unfixed and may affect all versions.
coding·excessive permissions·
12 May 2026 · Open Source Kubectl MCP Server (rohitg00)
A vulnerability in the open-source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim's system when the user interacts with a crafted HTML page. The flaw is tracked as CVE-2025-65719 and described as a critical RCE.
other·unknown·
12 May 2026 · Langflow
CVE-2026-42048: Langflow versions prior to 1.9.0 concatenate user-supplied knowledge base names into file paths without sanitization in the DELETE /api/v1/knowledge_bases endpoint, letting an authenticated attacker delete arbitrary directories on the server. The issue is fixed in version 1.9.0.
workflow·excessive permissions·
12 May 2026 · Jo-Jo98 (ciguard project)
The discover_pipeline_files() function in ciguard 0.8.0–0.8.1 follows symlinks when walking a directory tree, so an attacker who plants a symlink in a directory scanned by a user or AI agent can cause the tool to return paths to pipeline-shaped files outside the requested root. The issue is fixed in version 0.8.2.
coding·data leak·
12 May 2026 · MIC-DKFZ
Prior to version 2.4.1, nnU-Net's GitHub Actions issue-triage workflow embedded untrusted issue titles and bodies directly into the prompt of a command-capable Claude Code agent, allowing any GitHub user who opens an issue to steer the agent beyond its intended triage purpose and influence authenticated issue actions such as commenting and relabelling. The issue is fixed in nnU-Net 2.4.1.
workflow·prompt injection·
11 May 2026 ·
A command injection vulnerability in the automagik-genie 2.5.27 MCP server allows attackers to execute arbitrary commands through the view_task (view) tool via the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGE_BASE_URL.
other·tool misuse·
11 May 2026 · SOCFortress
SOCFortress CoPilot versions prior to 0.1.57 shipped a hardcoded JWT signing secret as a fallback in the backend code and in .env.example, so any deployment that did not explicitly set JWT_SECRET (including the default Docker Compose setup) signed tokens with a publicly known value. An unauthenticated attacker could forge admin-scoped JWTs and take full control of the application and every security tool it manages; fixed in 0.1.57.
other·misconfiguration·
11 May 2026 · bx33661 (Wireshark-MCP project)
Wireshark-MCP versions 1.1.5 and earlier expose a wireshark_export_objects MCP tool that passes an attacker-controlled dest_dir parameter to tshark's --export-objects flag without mandatory path restriction. Because the path sandbox is disabled unless WIRESHARK_MCP_ALLOWED_DIRS is set, a default installation permits exporting files to any directory on the filesystem.
other·excessive permissions·
11 May 2026 · Pythagora-io
GPT-Pilot, through commit 0819827 (2025-09-03), contains a command injection flaw (CWE-78) in Executor.run(): free-text user input at the command-confirmation prompt is passed directly to asyncio.create_subprocess_shell(). An attacker can substitute arbitrary shell commands, achieving remote code execution with the privileges of the GPT-Pilot process.
coding·tool misuse·
11 May 2026 · aiwaves-cn
A vulnerability in the aiwaves-cn 'agents' project (cheshire_cat_core component) allows remote attackers to trigger excessive resource consumption via the recall_relevant_memories_to_working_memory function in core/cat/looking_glass/stray_cat.py. A public exploit exists and the maintainers have not responded to the issue report.
other·unknown·
11 May 2026 · ThinkInAIXYZ
DeepChat versions before v1.0.4-beta.1 contained an incomplete fix for CVE-2025-55733, allowing an arbitrary protocol execution bypass (RCE). A Markdown link with target="_blank" returned by an attacker or compromised AI endpoint was passed by the native Electron pop-up handler in tabPresenter.ts straight to shell.openExternal(), bypassing the isValidExternalUrl check.
other·misconfiguration·
8 May 2026 · PromptHub
PromptHub versions 0.4.9 through 0.5.3 expose an authenticated POST /api/skills/fetch-remote endpoint that fetches a user-supplied URL server-side and reflects the response, with SSRF protections bypassable via alternate IPv6 representations. Any authenticated user — including self-registered users where ALLOW_REGISTRATION=true — could reach loopback, RFC1918 and link-local addresses; fixed in version 0.5.4.
workflow·misconfiguration·
8 May 2026 · BerriAI
CVE-2026-42271: LiteLLM versions 1.74.2 through 1.83.6 exposed two MCP server preview endpoints that accepted a full stdio server configuration and spawned the supplied command as a subprocess on the proxy host. The endpoints required only a valid proxy API key with no role check, so any authenticated user, including low-privilege internal users, could achieve arbitrary command execution; fixed in 1.83.7.
other·excessive permissions·
8 May 2026 · PraisonAI
Versions of PraisonAI before 4.6.34 exposed MCP file-handling tools that joined attacker-supplied filenames onto the rules directory without containment checks, allowing directory traversal to write arbitrary files as the running user. Dropping a Python .pth file into user site-packages escalates the flaw to arbitrary code execution in later Python processes; fixed in 4.6.34.
workflow·tool misuse·
8 May 2026 · labring
Six CVEs were published for FastGPT, an AI agent building platform, covering unauthenticated remote code execution in the agent-sandbox (code-server started with --auth none bound to 0.0.0.0:8080), several SSRF/DNS-rebinding and cloud metadata blocklist bypasses, and uncontrolled resource consumption in the code-sandbox leading to denial of service. Some issues were fixed in versions 4.14.13 and 4.14.17, while others had no public patch at publication.
workflow·misconfiguration·
7 May 2026 · Microsoft
Microsoft published a set of CVEs in May 2026 affecting M365 Copilot, Copilot Chat in Microsoft Edge, GitHub Copilot with Visual Studio, and Azure AI Foundry M365 published agents. The flaws include command/output injection issues enabling information disclosure, tampering or security feature bypass over a network, and improper access control allowing privilege elevation or local spoofing.
other·prompt injection·
6 May 2026 · OpenClaw
Three disclosed vulnerabilities in OpenClaw allow loopback clients to spoof owner context via bearer token headers, arbitrary code execution through unvalidated environment variables passed to MCP stdio servers, and bypass of guards on agent-facing gateway config.patch/config.apply endpoints so a prompt-injected model can persist changes to protected operator settings. All were fixed in releases 2026.4.20 and 2026.4.22.
other·excessive permissions·
5 May 2026 · Oracle
Oracle disclosed an easily exploitable vulnerability in the Oracle MCP Server Helper Tool (versions 1.0.1-1.0.156) that lets an unauthenticated attacker with HTTP network access compromise the tool and cause it to execute malicious SQL.
other·unknown·
5 May 2026 · GeekyBot
The GeekyBot AI content and chatbot/lead generation plugin for WordPress is vulnerable to SQL injection via the 'attributekey' parameter in versions up to and including 1.2.0, allowing unauthenticated attackers to extract sensitive database information.
customer service·unknown·
5 May 2026 · chatchat-space
Four vulnerabilities (CVE-2026-7844 through CVE-2026-7847) were disclosed in chatchat-space Langchain-Chatchat up to version 0.3.1.3, including missing authentication on OpenAI-compatible file endpoints, a weak hash in the vision chat paste-image handler, a time-of-check time-of-use flaw in file upload, and predictable file IDs. Public exploits exist and the project had not responded to the reporter's issue reports.
other·excessive permissions·
5 May 2026 · DataEase
SQLBot, an LLM/RAG-based Text-to-SQL system, concatenated user-supplied questions directly into the LLM prompt and executed the resulting SQL without validation in versions 1.7.0 and earlier. An authenticated attacker could use prompt injection to run arbitrary SQL and, against PostgreSQL data sources, achieve remote code execution via COPY FROM PROGRAM; fixed in version 1.7.1.
other·prompt injection·
4 May 2026 · pixelsock
A server-side request forgery flaw was disclosed in the validateUrl function of index.ts in pixelsock's directus-mcp 1.0.0 MCP server, where manipulating the fileUrl argument allows remote attackers to make the server issue arbitrary requests. A public exploit has been released and the fix pull request is still awaiting acceptance.
workflow·tool misuse·
4 May 2026 · EvoMap
Three vulnerabilities (CVE-2026-42075, CVE-2026-42076, CVE-2026-42077) were disclosed in EvoMap's Evolver self-evolving engine for AI agents, allowing arbitrary file writes via the skill download --out flag, remote code execution via unsanitised input to an execSync curl command, and prototype pollution in the mailbox store module. All were patched in version 1.69.3.
other·unknown·
