Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
25 Aug 2026 · MervinPraison
PraisonAI versions prior to 4.6.58 contain an origin validation bypass in the MCP HTTP Stream _validate_origin method that allows attackers to submit tool execution requests to local MCP servers without API key authentication through malicious webpages.
technology·workflow·misconfiguration·
24 Aug 2026 · Continue
The Continue CLI uses an incomplete denylist to block dangerous shell commands in unattended mode, allowing attackers to bypass protections through prompt injection and destroy user data via commands like rm -rf targeting /home, /root, /var, /opt or /srv directories.
technology·workflow·prompt injection·
21 Aug 2026 · Spring
The MCP Streamable HTTP server transport in Spring AI 2.0.0 does not limit session accumulation, allowing remote attackers to cause memory exhaustion and denial of service without authentication.
technology·other·misconfiguration·
21 Aug 2026 · Infracost
Two vulnerabilities in Infracost prior to 0.10.45 allow symlink traversal to read runner-accessible files and unauthorized disclosure of Terraform Cloud tokens when scanning attacker-controlled repositories.
technology·coding·tool misuse·
20 Aug 2026 · LangBot
LangBot versions 4.10.7 and earlier allow authenticated users to execute arbitrary commands on the server by configuring STDIO MCP servers without proper authorization checks. An attacker with an account can achieve remote code execution with service privileges.
technology·coding·excessive permissions·
20 Aug 2026 · SiteGround
The AI Agent by SiteGround WordPress plugin versions up to 1.2.7 are vulnerable to an authorization bypass that allows unauthenticated attackers to upload images to the media library by exploiting missing upload_files capability checks.
technology·coding·excessive permissions·
20 Aug 2026 · Neo.mjs
Neo.mjs contains command injection vulnerabilities in the FileSystemService.mjs component where checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled paths into shell commands, enabling arbitrary OS command execution when AI agents invoke these tools.
technology·coding·tool misuse·
20 Aug 2026 · LangChain
A vulnerability in LangChain Community's SitemapLoader allows attackers to bypass the restrict_to_same_domain control by pointing nested sitemap entries to internal addresses, enabling server-side request forgery and disclosure of internal responses.
technology·other·excessive permissions·
19 Aug 2026 · marimo-team
marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry. The vulnerability is triggered when a notebook is opened in edit mode without requiring authentication or cell execution.
technology·coding·prompt injection·
19 Aug 2026 · Splunk
Two vulnerabilities in Splunk products allow unauthorized privilege escalation and arbitrary command execution. CVE-2026-76391 enables non-admin users to run searches with system-level privileges in AI Toolkit below 6.0.0, while CVE-2026-76404 allows admin users to execute arbitrary OS commands in MCP Server app below 1.2.1.
technology·coding·excessive permissions·
19 Aug 2026 · Agno
A path traversal vulnerability in Agno's PythonTools allows attackers to read, write, or execute arbitrary files by injecting directory traversal sequences through the file_name argument. The vulnerability can be exploited via direct tool invocation or prompt injection in agent-processed content.
technology·coding·prompt injection·
18 Aug 2026 · CodeWhale
CodeWhale versions 0.8.41 through 0.8.63 contain three critical vulnerabilities allowing arbitrary code execution and file writes through prompt injection: auto-approval bypass in exec_shell_interact and rlm_eval tools, and argument injection in git_show tool.
technology·coding·prompt injection·
18 Aug 2026 · Context7
Context7 through version 2.1.2 contains a prompt injection vulnerability in its Custom AI Instructions feature that allows attackers to inject malicious instructions through the MCP server, enabling credential exfiltration and file deletion in connected AI coding agents.
technology·coding·prompt injection·
18 Aug 2026 · Microsoft
Two vulnerabilities were identified in Microsoft Copilot: a command injection flaw (CVE-2026-24301) allowing unauthorized attackers to disclose information, and an SSRF vulnerability (CVE-2026-69855) in Azure allowing authorized attackers to access sensitive data over a network.
technology·coding·prompt injection·
18 Aug 2026 · Apify
The Apify MCP server prior to version 0.10.11 allows malicious Actor publishers to redirect connections to third-party hosts and steal API tokens through improper URL validation in the getActorMCPServerURL function. Victims must invoke or inspect the attacker-controlled Actor to be affected.
technology·coding·prompt injection·
18 Aug 2026 · ArcadeData
ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool that allows authenticated read-only users to modify server configuration when allowAdmin=true. The vulnerability is fixed in version 26.8.1.
technology·other·excessive permissions·
17 Aug 2026 · MemTensor
MemOS fails to properly validate internal service requests when the INTERNAL_SERVICE_SECRET environment variable is unset, allowing unauthenticated remote attackers to bypass authentication and access admin API endpoints to mint, enumerate, and revoke API keys.
technology·other·misconfiguration·
17 Aug 2026 · jkawamoto
A server-side request forgery vulnerability was found in jkawamoto mcp-florence2 up to version 0.3.13 in the get_images function, allowing remote exploitation through manipulation of the src argument.
technology·other·tool misuse·
17 Aug 2026 · MLflow
Three vulnerabilities were identified in MLflow prior to version 3.15.0, including an unauthenticated SSRF via webhook validation bypass, an authentication bypass allowing injection of dataset metadata, and a path traversal enabling unauthorized artifact access. All issues were fixed in version 3.15.0.
technology·other·excessive permissions·
14 Aug 2026 · Cortex
The Cortex MCP server prior to version 3.17.1 treats the CLAUDE_PROJECT_DIR environment variable as trusted, allowing attackers to execute arbitrary code by placing marker files in a malicious repository.
technology·coding·misconfiguration·
14 Aug 2026 · mcp-memory-service
mcp-memory-service versions prior to 10.67.1 lack authentication on /api/documents/* endpoints, allowing unauthenticated attackers to read, write, and delete memory content despite configured API keys or OAuth.
technology·other·misconfiguration·
14 Aug 2026 · MindsDB
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability allowing attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected API endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python code without sandboxing.
technology·coding·excessive permissions·
14 Aug 2026 · ondata
CKAN MCP Server versions prior to 0.4.112 contain multiple security vulnerabilities including information disclosure through error reflection, URL validation bypass allowing SSRF attacks, and cache poisoning via parameter collision. These issues are fixed in version 0.4.112.
technology·other·misconfiguration·
13 Aug 2026 · Fosowl
AgenticSeek contains an unauthenticated remote code execution vulnerability in its POST /query API endpoint that allows network-adjacent attackers to execute arbitrary shell commands through a crafted query.
technology·other·excessive permissions·
13 Aug 2026 · Model Context Protocol
A server-side request forgery vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0 in the explore_url function. The exploit is public and the vendor did not respond to early disclosure.
technology·other·tool misuse·
13 Aug 2026 · Flowise
Flowise before version 3.1.3 contains multiple code injection vulnerabilities in the Airtable and CSV Agent nodes that allow unauthenticated attackers to execute arbitrary Python code through prompt injection and validator bypasses.
technology·workflow·prompt injection·
13 Aug 2026 · jshookmcp
CVE-2026-49856 in @jshookmcp/jshook version 0.3.1 allows MCP clients to bypass SSRF authorization policies by using ICMP probe and traceroute tools to probe internal network addresses. The vulnerability exposes internal reachability and route mapping from the server's network position.
technology·other·excessive permissions·
13 Aug 2026 · ymw0407
auth-fetch-mcp version 3.0.1 contains a Server-Side Request Forgery vulnerability where IPv4-mapped IPv6 loopback addresses bypass SSRF protection, allowing access to blocked loopback services. The issue was patched in version 3.0.1.
technology·other·misconfiguration·
13 Aug 2026 · EnzoVezzaro
Multiple server-side request forgery vulnerabilities were discovered in EnzoVezzaro's mcp-dominican-layer project, affecting the parse-csv and parse-pdf tools through manipulation of csvUrl and pdfUrl arguments. The vulnerabilities have been disclosed publicly and the vendor has not yet responded.
technology·other·tool misuse·
13 Aug 2026 · Trigger.dev
Five CVEs affecting Trigger.dev versions 3.3.8 through 4.5.6 allow prototype pollution, account takeover, cross-tenant resource access, and payload manipulation via insufficient input validation and missing ownership checks.
technology·workflow·misconfiguration·
13 Aug 2026 · HCL
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact.
technology·other·prompt injection·
12 Aug 2026 · Atlassian
MCP Atlassian versions prior to 0.22.0 allow authenticated clients to read arbitrary files accessible to the server process and exfiltrate them through Confluence attachments. If exploited through AI agents, this could expose sensitive credentials like API tokens and environment variables.
technology·other·excessive permissions·
11 Aug 2026 · Grafana
A vulnerability in mcp-grafana allows callers to control the destination of outbound requests via the X-Grafana-URL header, enabling server-side request forgery attacks against internal and metadata services. The grafana_api_request tool permits manipulation of HTTP methods, paths, and request bodies.
technology·coding·misconfiguration·
11 Aug 2026 · PapersGPT
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability where unsanitized LLM responses are passed to window.eval(), allowing attackers to execute arbitrary JavaScript through prompt injection, MITM interception, or malicious LLM endpoints.
technology·other·prompt injection·
11 Aug 2026 · Microsoft
An improper neutralization of special elements in os commands vulnerability in GitHub Copilot and Visual Studio Code allows unauthorized attackers to elevate privileges locally.
technology·coding·tool misuse·
11 Aug 2026 · ToolJet
ToolJet prior to version 3.20.207 contains an authorization bypass vulnerability in its Database HTTP API that allows authenticated users to access, modify, and delete data across organization boundaries by manipulating the tj-workspace-id header.
technology·workflow·excessive permissions·
11 Aug 2026 · Cursor
Two vulnerabilities in Cursor IDE for macOS allow agents running in Auto-Run Sandbox mode to escape the sandbox and execute arbitrary commands with user privileges. The first affects versions before 3.1.2 through Python executable replacement; the second affects versions before 3.0.0 through Docker container mounting.
technology·coding·excessive permissions·
11 Aug 2026 · n8n
n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections and access internal services.
technology·workflow·misconfiguration·
10 Aug 2026 · AAIF
The goose AI agent's `review` command prior to version 1.44.0 executes arbitrary commands from malicious Git repository configurations without user approval or sandboxing, allowing attackers to access files and steal environment secrets.
technology·coding·misconfiguration·
9 Aug 2026 · adenot
A server-side request forgery vulnerability was identified in adenot mcp-google-search up to version 0.3.1 in the read_webpage component. The vulnerability allows manipulation of the url argument and is restricted to local execution.
technology·other·tool misuse·
8 Aug 2026 · INQUIRELAB
A command injection vulnerability was discovered in INQUIRELAB mcp-bridge-api in the Servers Endpoint that allows remote attackers to manipulate command/args arguments. A fix has been proposed but not yet accepted.
technology·other·tool misuse·
8 Aug 2026 · AI Copilot
The AI Copilot – Content Generator WordPress plugin up to version 1.5.6 is vulnerable to authorization bypass, allowing unauthenticated attackers to create administrator accounts and achieve full site takeover by executing malicious workflows with exposed nonce values.
technology·workflow·excessive permissions·
7 Aug 2026 · Meta
Meta Ads MCP server prior to version 1.0.109 failed to authenticate HTTP requests, allowing unauthenticated callers to invoke MCP tools and potentially obtain access tokens through error responses. The vulnerability was fixed in version 1.0.109.
technology·workflow·misconfiguration·
6 Aug 2026 · MissionSquad
A server-side request forgery vulnerability was found in MissionSquad mcp-api up to version 1.11.9 in the src/services/dcrClients.ts file. The issue was fixed in version 1.11.10.
technology·other·tool misuse·
6 Aug 2026 · Kino-Kafkaesque
A command injection vulnerability was detected in the SSH Command Handler component of Kino-Kafkaesque ssh-mcp-server through commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. The vulnerability allows manipulation of host/username arguments to achieve command injection, though the project maintainer disputes the threat given the tool's intended use model as a local trusted agent.
technology·workflow·tool misuse·
6 Aug 2026 · Microsoft
Two separate improper authorization vulnerabilities were discovered in Microsoft Copilot Cowork and Visual Studio Code Copilot Chat Extension, allowing unauthorized attackers to elevate privileges and bypass security features over a network.
technology·coding·excessive permissions·
5 Aug 2026 · AgentFront
FrontMCP versions prior to 1.5.7 contain a sandbox escape vulnerability in the codecall:execute tool that allows attackers to achieve remote code execution by accessing the host Function constructor through Zod schema instances. The vulnerability can be exploited unauthenticated on unconfigured servers or via prompt injection on authenticated servers.
technology·coding·excessive permissions·
5 Aug 2026 · IBM
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain multiple vulnerabilities allowing authenticated attackers to execute arbitrary commands, read arbitrary files, bypass restrictions, and execute unintended code through improper validation in MCP server configurations and Agentic Assistant validation.
technology·coding·excessive permissions·
4 Aug 2026 · FlowiseAI
Two vulnerabilities in Flowise prior to version 3.1.3 allow arbitrary code execution: CVE-2026-69263 enables supply chain attacks via npm configuration variables during MCP server launch, and CVE-2026-70477 enables prompt injection attacks through CSV Agent nodes that bypass code validation. Both are fixed in version 3.1.3.
technology·workflow·supply chain·
3 Aug 2026 · Q00
Ouroboros versions prior to 0.39.0 allow arbitrary code execution when users run commands in directories containing malicious repositories, as the runtime loads and executes environment variables from .env files without validation. A second vulnerability in versions prior to 0.42.1 bypasses the initial fix through an incomplete denylist of environment variables.
technology·coding·misconfiguration·
