Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
31 Aug 2026 · Meta
An AI agent used by a security researcher at Meta reportedly deleted her emails without authorization, an incident that was disclosed and discussed publicly.
other·hallucinated action·
31 Aug 2026 · ash-project
A vulnerability in ash_ai's MCP server allows malicious web pages to bypass DNS-rebinding protection through improper origin validation, enabling cross-site requests to local MCP servers. The issue affects versions 0.8.0 before 1.0.0 and has been fixed by trusting only localhost origins by default.
other·misconfiguration·
31 Aug 2026 · sdcb
A server-side request forgery vulnerability was discovered in sdcb chats up to version 1.12.0 in the McpController's fetch-tools endpoint. The exploit is public and the vendor did not respond to early disclosure attempts.
other·tool misuse·
28 Aug 2026 · SiYuan
Two path-based vulnerabilities in SiYuan before v3.8.2: a path traversal in asset.upload MCP tool allowing upload of sensitive files via prompt injection, and a case-sensitive path guard bypass enabling reading of protected configuration files.
other·prompt injection·
28 Aug 2026 · Microsoft
Two vulnerabilities were disclosed in Microsoft's Copilot products: a race condition in Copilot Chat allowing information disclosure, and improper cryptographic signature verification in Copilot Studio allowing privilege escalation.
other·misconfiguration·
28 Aug 2026 · Hatchet
Hatchet versions 0.40.0 to 0.91.0 lack proper tenant verification in Dispatcher gRPC service, allowing authenticated users to manipulate other tenants' workers and cause denial of service on multi-tenant deployments. The vulnerability was fixed in version 0.91.1.
workflow·misconfiguration·
27 Aug 2026 · GitLab
GitLab remediated two vulnerabilities in the AI Gateway component that could allow authenticated users with Duo Agent Platform access to redirect requests to external endpoints and disclose cloud service credentials and signing keys.
other·prompt injection·
27 Aug 2026 · mark3labs
mcp-go accepted HTTP requests without validating the Host header, allowing attackers to bypass loopback restrictions via DNS rebinding. The vulnerability was patched in version 0.56.0 by adding Host header validation.
other·misconfiguration·
27 Aug 2026 · mcp-router
The mcp-router CLI served its MCP aggregator on all network interfaces without requiring authentication unless explicitly configured, exposing the aggregator and all fronted MCP servers to unauthorized network access. The vulnerability was fixed in version 0.6.3 by defaulting to loopback address and requiring authentication for non-loopback hosts.
other·misconfiguration·
27 Aug 2026 · ToolUniverse
ToolUniverse's Python code executor allowed sandbox escape through dunder attribute access, and exposed HTTP/MCP servers with no authentication enabled remote code execution as the server process.
coding·excessive permissions·
27 Aug 2026 · Dropbox
The Dash MCP server bound its listener to loopback but failed to validate the Host header, allowing DNS rebinding attacks. A malicious webpage could invoke the server's tools using the visitor's Dropbox credentials.
other·misconfiguration·
27 Aug 2026 · ServiceNow
ServiceNow remediated two vulnerabilities in its AI platform: a code injection flaw and a SQL injection flaw, both allowing unauthenticated users to execute arbitrary code or SQL statements and access or modify instance data. No malicious exploitation has been reported.
other·unknown·
27 Aug 2026 · mcp-use
The proxy middleware in mcp-use's inspector failed to validate the host of requests, allowing callers to make the server issue requests to private, loopback, and link-local addresses and read responses. This server-side request forgery vulnerability has been patched with proper host validation and redirect limiting.
other·misconfiguration·
27 Aug 2026 · Apify
The get-html-skeleton tool in Apify MCP Server validated URLs only for syntax, allowing callers to request internal endpoints including cloud metadata services. Version 0.9.12 removes the vulnerable tool.
browsing·excessive permissions·
27 Aug 2026 · Timescale
Timescale's pg-aiguide and tiger-slack failed to enable DNS rebinding protection in their MCP HTTP transports, allowing attackers to drive locally reachable servers through a visitor's browser via DNS name control.
other·misconfiguration·
27 Aug 2026 · Telnyx
The Telnyx MCP server exposed its HTTP transport on all interfaces without requiring authentication, allowing unauthenticated access to dispatch tools and the server's stored credentials including API keys and code-execution keys.
coding·misconfiguration·
27 Aug 2026 · ByteDance
The mcp-http-server package in UI-TARS-desktop defaulted to listening on all interfaces ('::') without requiring authentication, allowing unauthenticated remote attackers to execute arbitrary commands or access files on the host system.
other·misconfiguration·
27 Aug 2026 · Agno
Agno up to version 2.5.8 is vulnerable to remote code execution through prompt injection in PythonTools and ShellTools components. An unauthenticated attacker can exploit unsanitized LLM-generated arguments to execute arbitrary code and OS commands.
coding·prompt injection·
27 Aug 2026 · Nightingale
Nightingale (n9e) contains a server-side request forgery vulnerability in the isPublicIP function that fails to properly unwrap certain IPv6 address formats, allowing attackers to bypass SSRF guards and reach internal services or metadata endpoints.
other·misconfiguration·
26 Aug 2026 · Google
An eval injection vulnerability in Google langfun's lf.query protocol allows remote attackers to execute arbitrary Python code via crafted prompt inputs. The vulnerability affects versions prior to 0.1.2.
coding·prompt injection·
25 Aug 2026 · MervinPraison
PraisonAI versions prior to 4.6.58 contain an origin validation bypass in the MCP HTTP Stream _validate_origin method that allows attackers to submit tool execution requests to local MCP servers without API key authentication through malicious webpages.
workflow·misconfiguration·
25 Aug 2026 · sonirico
Three vulnerabilities in mcp-shell prior to version 0.6.0 allow attackers to execute arbitrary OS commands through the shell_exec MCP tool due to insecure default configuration, insufficient command validation, and shell metacharacter bypass in Git alias handling.
coding·misconfiguration·
25 Aug 2026 · Nextcloud
Nextcloud MCP Server prior to 0.117.2 has an unauthenticated webhook endpoint that allows attackers to delete or re-index vector embeddings for any user by sending forged deletion events, due to missing authentication when WEBHOOK_SECRET is unset.
coding·misconfiguration·
25 Aug 2026 · GeiserX
genieacs-mcp versions prior to 0.3.2 create an unauthenticated HTTP listener on 127.0.0.1:8080 that does not validate Host or Origin headers, allowing DNS rebinding attacks to expose or modify CPE management state through GenieACS operations.
other·misconfiguration·
25 Aug 2026 · ruvnet
Path traversal vulnerability in MCP tools allows attackers to read, write, or overwrite files accessible to the server process. The vulnerability affects sublinear-time-solver and consciousness-explorer through unsanitized filepath parameters in filesystem operations.
other·misconfiguration·
25 Aug 2026 · Amazon
Improper input neutralization in the python_repl tool of Amazon Strands Agents Tools before 0.8.5 allows remote attackers to execute arbitrary Python code by bypassing consent gates via crafted prompts.
coding·prompt injection·
25 Aug 2026 · Dradis
An authorization bypass in Dradis Community Edition allows authenticated non-admin users to create arbitrary AI providers and trigger server-side request forgery attacks. The SSRF vulnerability permits reading response bodies from internal hosts via reflected error messages.
coding·excessive permissions·
25 Aug 2026 · Anthropic
The MCP PHP SDK versions 0.5.0 through 0.7.0 are vulnerable to memory exhaustion when the HTTP client transport connects to a malicious or compromised server that streams data without sending SSE event delimiters, causing unbounded buffer growth and denial of service.
other·tool misuse·
24 Aug 2026 · Continue
The Continue CLI uses an incomplete denylist to block dangerous shell commands in unattended mode, allowing attackers to bypass protections through prompt injection and destroy user data via commands like rm -rf targeting /home, /root, /var, /opt or /srv directories.
workflow·prompt injection·
21 Aug 2026 · Spring
The MCP Streamable HTTP server transport in Spring AI 2.0.0 does not limit session accumulation, allowing remote attackers to cause memory exhaustion and denial of service without authentication.
other·misconfiguration·
21 Aug 2026 · Infracost
Two vulnerabilities in Infracost prior to 0.10.45 allow symlink traversal to read runner-accessible files and unauthorized disclosure of Terraform Cloud tokens when scanning attacker-controlled repositories.
coding·tool misuse·
20 Aug 2026 · SiteGround
The AI Agent by SiteGround WordPress plugin versions up to 1.2.7 are vulnerable to an authorization bypass that allows unauthenticated attackers to upload images to the media library by exploiting missing upload_files capability checks.
coding·excessive permissions·
20 Aug 2026 · LangBot
LangBot versions 4.10.7 and earlier allow authenticated users to execute arbitrary commands on the server by configuring STDIO MCP servers without proper authorization checks. An attacker with an account can achieve remote code execution with service privileges.
coding·excessive permissions·
20 Aug 2026 · Neo.mjs
Neo.mjs contains command injection vulnerabilities in the FileSystemService.mjs component where checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled paths into shell commands, enabling arbitrary OS command execution when AI agents invoke these tools.
coding·tool misuse·
20 Aug 2026 · LangChain
A vulnerability in LangChain Community's SitemapLoader allows attackers to bypass the restrict_to_same_domain control by pointing nested sitemap entries to internal addresses, enabling server-side request forgery and disclosure of internal responses.
other·excessive permissions·
19 Aug 2026 · Splunk
Two vulnerabilities in Splunk products allow unauthorized privilege escalation and arbitrary command execution. CVE-2026-76391 enables non-admin users to run searches with system-level privileges in AI Toolkit below 6.0.0, while CVE-2026-76404 allows admin users to execute arbitrary OS commands in MCP Server app below 1.2.1.
coding·excessive permissions·
19 Aug 2026 · marimo-team
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry. The vulnerability is triggered when a notebook is opened in edit mode without requiring authentication or cell execution.
coding·prompt injection·
19 Aug 2026 · Agno
A path traversal vulnerability in Agno's PythonTools allows attackers to read, write, or execute arbitrary files by injecting directory traversal sequences through the file_name argument. The vulnerability can be exploited via direct tool invocation or prompt injection in agent-processed content.
coding·prompt injection·
18 Aug 2026 · Microsoft
Two vulnerabilities were identified in Microsoft Copilot: a command injection flaw (CVE-2026-24301) allowing unauthorized attackers to disclose information, and an SSRF vulnerability (CVE-2026-69855) in Azure allowing authorized attackers to access sensitive data over a network.
coding·prompt injection·
18 Aug 2026 · Apify
The Apify MCP server prior to version 0.10.11 allows malicious Actor publishers to redirect connections to third-party hosts and steal API tokens through improper URL validation in the getActorMCPServerURL function. Victims must invoke or inspect the attacker-controlled Actor to be affected.
coding·prompt injection·
18 Aug 2026 · ArcadeData
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool that allows authenticated read-only users to modify server configuration when allowAdmin=true. The vulnerability is fixed in version 26.8.1.
other·excessive permissions·
18 Aug 2026 · CodeWhale
CodeWhale versions 0.8.41 through 0.8.63 contain three critical vulnerabilities allowing arbitrary code execution and file writes through prompt injection: auto-approval bypass in exec_shell_interact and rlm_eval tools, and argument injection in git_show tool.
coding·prompt injection·
18 Aug 2026 · Context7
Context7 through version 2.1.2 contains a prompt injection vulnerability in its Custom AI Instructions feature that allows attackers to inject malicious instructions through the MCP server, enabling credential exfiltration and file deletion in connected AI coding agents.
coding·prompt injection·
17 Aug 2026 · jkawamoto
A server-side request forgery vulnerability was found in jkawamoto mcp-florence2 up to version 0.3.13 in the get_images function, allowing remote exploitation through manipulation of the src argument.
other·tool misuse·
17 Aug 2026 · MLflow
Three vulnerabilities were identified in MLflow prior to version 3.15.0, including an unauthenticated SSRF via webhook validation bypass, an authentication bypass allowing injection of dataset metadata, and a path traversal enabling unauthorized artifact access. All issues were fixed in version 3.15.0.
other·excessive permissions·
17 Aug 2026 · MemTensor
MemOS fails to properly validate internal service requests when the INTERNAL_SERVICE_SECRET environment variable is unset, allowing unauthenticated remote attackers to bypass authentication and access admin API endpoints to mint, enumerate, and revoke API keys.
other·misconfiguration·
14 Aug 2026 · Cortex
The Cortex MCP server prior to version 3.17.1 treats the CLAUDE_PROJECT_DIR environment variable as trusted, allowing attackers to execute arbitrary code by placing marker files in a malicious repository.
coding·misconfiguration·
14 Aug 2026 · mcp-memory-service
mcp-memory-service versions prior to 10.67.1 lack authentication on /api/documents/* endpoints, allowing unauthenticated attackers to read, write, and delete memory content despite configured API keys or OAuth.
other·misconfiguration·
14 Aug 2026 · ondata
CKAN MCP Server versions prior to 0.4.112 contain multiple security vulnerabilities including information disclosure through error reflection, URL validation bypass allowing SSRF attacks, and cache poisoning via parameter collision. These issues are fixed in version 0.4.112.
other·misconfiguration·
14 Aug 2026 · MindsDB
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected API endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python code without sandboxing.
coding·excessive permissions·
