Vulnerabilities

Disclosed flaws in agents, agent frameworks and the protocols that connect them.

FrontMCP SSRF patch bypassed via DNS tricks and redirects

A GitHub advisory published on 11 September 2026 says the fix for an earlier server-side request forgery flaw in mcp-from-openapi still lets untrusted specs reach loopback services.

13 Sept 2026

Vulnerabilities

Central Dogma Git mirror trusts any SSH host key

A disclosed flaw in LINE's configuration store means every outbound git+ssh mirror connection accepts whatever server key it is offered, according to the advisory.

13 Sept 2026

Vulnerabilities

MySQL MCP server left SQL wide open in SSE mode

A missing security setting in mysql-mcp-server let anyone on the network run arbitrary SQL, with 25 exposed instances found online.

13 Sept 2026

Vulnerabilities

Hidden channel in ChatGPT's package server leaked Gmail data

Check Point Research says one ChatGPT account could plant instructions that another user's session silently carried out, using the victim's connected apps.

13 Sept 2026

Vulnerabilities

Web form plus expired domain let attackers pull data from Agentforce

Noma Security rated the chain 9.4 on the CVSS scale. Salesforce patched it and re-secured a domain that had been left to lapse.

26 Sept 2025

Vulnerabilities

Deep Research agent leaked Gmail data from inside OpenAI's cloud

Because the agent made the outbound request itself, nothing crossed the victim's network for a security tool to catch.

19 Sept 2025

Vulnerabilities

A shared document quietly pulled API keys out of ChatGPT

Zenity Labs hid instructions in white text. Once the file was shared, ChatGPT's Drive connector did the rest.

8 Aug 2025

Vulnerabilities

Cursor could be turned into remote code execution with one message

Prompt injection let researchers write to the IDE's MCP configuration, which Cursor then ran without asking. Version 1.3 closed the hole.

2 Aug 2025

Vulnerabilities

A README was enough to make Gemini CLI run attacker commands

Hidden instructions plus a weak command allow-list let researchers exfiltrate environment variables from Google's coding agent.

29 Jul 2025

Vulnerabilities

Visiting a web page could compromise developers running MCP Inspector

Anthropic's debugging tool listened without authentication. A malicious site could reach it on localhost and run commands.

2 Jul 2025

Vulnerabilities

Zero-click email attack pulled data out of Microsoft 365 Copilot

A single email was enough to make Copilot hand over tenant data, researchers found. Microsoft fixed it before anyone had to act.

12 Jun 2025

Vulnerabilities

Langflow flaw let anyone run code on exposed agent servers

A code validation endpoint executed Python without checking who was asking. CISA listed it as exploited within a month.

6 May 2025

The morning agent security brief

One lead story, four links, the week's incident count. Weekday mornings. Free.