Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 7 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Agenta LLMOps platform: sandbox escape RCE and SSTI in server-side evaluators

Two vulnerabilities were disclosed in the open-source Agenta LLMOps platform: a Python sandbox escape in the custom code evaluator (CVE-2026-27952) that let authenticated users run arbitrary code on the API server via a whitelisted numpy package, and a server-side template injection flaw in evaluator template rendering (CVE-2026-27961). Both affect self-hosted or managed Agenta deployments and are fixed in versions 0.48.1 and 0.86.8 respectively.

Disclosed 26 February 2026 · Record updated 13 September 2026

Impact

Authenticated users of self-hosted or managed Agenta deployments could escape the RestrictedPython sandbox and achieve arbitrary code execution on the API server; a separate SSTI flaw affected server-side evaluator template rendering.

Our coverage

No articles linked to this incident yet.

Sources

  1. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-27952
  2. nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-27961