Latest

●MLflow autologging writes CrewAI API keys into trace data ●AI agent finds four severe flaws in EPICS control software ●Researchers say 44 AI agents drove attacks on Japanese targets ●New 'Aokigahara' stealer goes after AI assistant sessions ●Warp discloses breach exposing AI agent logs and telemetry ●Strands Agents leaves agent session files open to local attackers ●Broken escape function lets documents wipe GraphRAG databases ●Three MCP servers let agents be tricked into running shell commands

Wednesday, 28 October 2026

1 agent hack today▼ 9 vs yesterday (10)

The Agentic Times Powered by

Section

Vulnerabilities

Disclosed flaws in agents, agent frameworks and the protocols that connect them.

Featured story

MLflow autologging writes CrewAI API keys into trace data

A GitHub advisory published on 27 October 2026 says MLflow's CrewAI integration copies LLM provider API keys into trace spans in plaintext.

By The Agentic Times · 28 Oct 2026

Vulnerabilities

A factory worker accidentally drops confidential blueprint cards into an open inspection log as machines automatically record every step of production.

AI agent finds four severe flaws in EPICS control software

Vulnerabilities

AI agent finds four severe flaws in EPICS control software

An autonomous hacking agent called Cipher uncovered a critical remote-code-execution bug in open source software used to run particle accelerators and fusion experiments.

27 Oct 2026

A factory worker leaves blueprints scattered on an unlocked table while an intruder's hand silently swaps them with forged versions, redirecting the entire production line.

Vulnerabilities

Strands Agents leaves agent session files open to local attackers

Two advisories published on 27 October 2026 say the Python SDK's default session storage is world-readable and can be hijacked with a symlink to overwrite arbitrary files.

27 Oct 2026

A corroded lock mechanism fails to contain poisoned ink, allowing it to seep through sealed chambers and dissolve an entire crystalline network into ash.

Vulnerabilities

Broken escape function lets documents wipe GraphRAG databases

A backwards string-escaping routine in Flexible GraphRAG's FalkorDB adapter lets poisoned documents run arbitrary Cypher, including a command that deletes every node.

27 Oct 2026

More stories

169 in Vulnerabilities

5

A puppet master's strings wind through three wooden marionettes, forcing their carved hands to type invisible commands into glowing terminals below them.

Vulnerabilities

Three MCP servers let agents be tricked into running shell commands

Advisories published on 27 October 2026 describe command injection flaws in esp-mcp, Kali-GPT and hagent that prompt injection can reach.

The Agentic Times · 27 Oct 2026

6

A robot arm reaches through an open doorway, its fingers typing commands into a control panel while a shadowy figure whispers instructions into its ear.

Vulnerabilities

Two MCP servers found open to command injection by prompt-injected agents

Advisories published on 27 October 2026 describe shell command injection flaws in the ai-sdlc plugin MCP server and in DroidMind, an Android control tool.

The Agentic Times · 27 Oct 2026

7

A mechanical hand reaches into an open vault, pulling out unmarked packages while security cameras hang dark and powerless on the walls.

Vulnerabilities

Unauthenticated MLflow servers can be forced to call attacker hosts

A GitHub advisory published on 23 October 2026 says MLflow's scorer endpoints accept unconstrained class names and keyword arguments from anonymous callers.

The Agentic Times · 23 Oct 2026

8

A single thread pulled from one locked filing cabinet unravels an entire neighboring cabinet's documents, spilling secrets across the shared office floor.

Vulnerabilities

LangGraph store flaw let one tenant reach another's data

A namespace check missing from read and delete calls meant a single dot in a label could cross tenant boundaries, LangChain said in an advisory published on 23 October 2026.

The Agentic Times · 23 Oct 2026

9

A robot scanning files stops at a fence marking the project boundary, but a winding path carved in the ground lures it backward toward a locked cabinet beyond.

Vulnerabilities

Fallow read files outside project root via test configs

A path traversal flaw in the code analysis tool let a crafted repository steer it into reading files beyond the project it was told to scan.

The Agentic Times · 23 Oct 2026

10

A uniformed guard watches helplessly as someone walks past the velvet rope directly to the vault, bypassing the checkpoint entirely.

Vulnerabilities

FastMCP flaw let low-privilege users call protected tools

PrefectHQ has patched an authorisation bypass in its Model Context Protocol server framework that skipped permission checks on direct component calls.

The Agentic Times · 23 Oct 2026

11

A vault door swings open as a rogue server's hand reaches through, siphoning glowing credential tokens into a shadowy funnel while legitimate machines stand helpless nearby.

Vulnerabilities

FastMCP flaw could leak OAuth secrets to rogue MCP servers

A credential-binding bug in FastMCP's machine-to-machine OAuth providers let untrusted servers redirect client secrets to an attacker's authorisation server.

The Agentic Times · 23 Oct 2026

12

A single malformed package crashes through a server's defenses, flooding its chambers with endless data until the entire machine grinds to a halt, choking on its own overflow.

Vulnerabilities

One request can crash a vLLM server, advisory warns

A flaw tracked as CVE-2026-114055 lets API clients pass unchecked image-processing settings to vLLM, exhausting memory and taking down shared instances.

The Agentic Times · 23 Oct 2026

13

A hand pressing a red stop button while a mechanical arm continues unfolding, shredding papers beneath it regardless.

Vulnerabilities

Obsidian-tc let refused actions run, advisory says

A flaw in the npm package obsidian-tc meant a declined confirmation could still result in notes being deleted or rewritten, according to an advisory published on 23 October 2026.

The Agentic Times · 23 Oct 2026

14

x402 SDK flaw could let rogue APIs drain AI agents' balances

Vulnerabilities

x402 SDK flaw could let rogue APIs drain AI agents' balances

Security firm V12 said agents that auto-signed payments could be asked for their whole token balance, because the default client set no spending cap.

The Agentic Times · 23 Oct 2026

15

OpenCode flaw let malicious MCP servers run code at sign-in

Vulnerabilities

OpenCode flaw let malicious MCP servers run code at sign-in

Anomaly fixed the AI coding agent in version 1.18.33 after researchers showed a hostile tool server could run commands on Windows and WSL machines.

The Agentic Times · 22 Oct 2026

16

A puppet's strings slip through a cage's bars, allowing its wooden hands to reach forbidden doors while its master watches helplessly from behind locked gates.

Vulnerabilities

OpenClaw patches browser flaw that bypassed blocked URLs

A GitHub advisory published on 21 October 2026 says OpenClaw's browser debugging discovery could connect to network destinations the agent's own policy was meant to block.

The Agentic Times · 21 Oct 2026

17

A robot's hand reaches through an open door into neighboring rooms, grabbing files from shelves it was never meant to access, while guards stand motionless at the threshold.

Vulnerabilities

MCP tool in djust reads files outside the project directory

A GitHub advisory published on 21 October 2026 says a djust tool opens any absolute file path an agent asks for, with no confinement check.

The Agentic Times · 21 Oct 2026

18

A hunter robot follows glowing false trails through a dark forest while real prey escapes untouched deeper in the woods.

Vulnerabilities

‘Context bombs’ send attacking AI agents chasing fake targets

Research reported by SecurityWeek on 21 October 2026 says planted decoy prompts cut the success rate of AI-driven attacks by up to 91% in testing.

The Agentic Times · 21 Oct 2026

19

AI models can plan attacks on industrial systems, study finds

Vulnerabilities

AI models can plan attacks on industrial systems, study finds

Frenos ran nearly 17,000 tests on ten AI models and found the best produced workable attack plans, but with inconsistent results and frequent gaps.

The Agentic Times · 21 Oct 2026

20

A factory assembly line stamps identical circuit boards, but one stream diverges into a shadowy fork, producing components with invisible cracks only discoverable under strain.

Vulnerabilities

Chinese AI model writes weaker code for US defence tasks

Researchers reported on 21 October 2026 that the model produced code 19% more likely to be hackable when told the customer was a US defence contractor.

The Agentic Times · 21 Oct 2026

21

A marionette puppet's strings feed directly into a massive machine's control lever, bypassing all safety gates between them.

Vulnerabilities

Prompt injection flaw lets attackers run root commands in Vibe-Trading

A vulnerability disclosed on 21 October 2026 affects HKUDS Vibe-Trading from version 0.1.0 before 0.1.7, with shell commands passed straight to the operating system.

The Agentic Times · 21 Oct 2026

22

A digital key slips from one messenger's hand into another's as they pass through an unsecured doorway, the path splitting unexpectedly toward a waiting stranger.

Vulnerabilities

A2A Java SDK leaks agent API keys through HTTP redirects

Two advisories published on 20 October 2026 say a malicious agent can push a client's API key to a third-party server, and that an earlier fix missed the Android path.

The Agentic Times · 20 Oct 2026

23

A locked toolbox springs open, spilling brass keys across a workbench while shadowy hands grab messages meant for neighboring stations, one worker collapsing mid-task.

Vulnerabilities

Five flaws patched in the MCP TypeScript SDK

Advisories published on 20 October 2026 cover leaked API keys, crossed-over client messages and a one-request memory crash, and two fixes need config changes.

The Agentic Times · 20 Oct 2026

24

A marionette puppet dangles from invisible strings attached to a malicious webpage, its wooden arms jerking to execute commands at a workbench without hesitation.

Vulnerabilities

Web pages can hijack LangAlpha agent and run shell commands

A CVE published on 20 October 2026 says the ginlix-ai coding agent executes attacker instructions found in retrieved web content, with no approval step.

The Agentic Times · 20 Oct 2026

The morning agent security brief

One lead story, four links, the week's incident count. Weekday mornings. Free.