AI Security News

2026-09-15 | NVD / GitHub Security Advisories

A single mid-September disclosure wave produced two unauthenticated Model Context Protocol servers rated CVSS 10.0. MySQL MCP Server (CVE-2026-59971) built its SSE transport without DNS-rebinding protection or security settings, and @zereight/mcp-gitlab (CVE-2026-61560) exposed every tool over SSE with no authentication at all, with its upload_markdown tool reading arbitrary local files. A follow-up flaw in the same GitLab server (CVE-2026-61568) scored 9.6. Both are direct demonstrations of the SSE-transport exposure pattern.

2026-09-22 | NVD / Atlassian Security Bulletin

CVE-2026-77244 affects the Atlassian MCP server for Confluence and Jira. Prior to 0.22.0, the HTTP transport accepted requests with no verified user identity, and downstream fetcher construction fell back to the operator's globally configured Jira or Confluence credentials. An unauthenticated caller could therefore reach internal issue and documentation data through another user's token.

2026-09-14 | NVD / LangChain Advisory

CVE-2026-55253 (CVSS 7.7) affects langgraph-checkpoint-mongodb below 0.3.0 and langgraph-store-mongodb below 0.4.0. MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() incorporated caller-supplied filter dictionaries directly into MongoDB queries, letting an attacker reshape the query instead of supplying a plain value. Any agent persisting state to MongoDB should upgrade before exposing filter inputs.

2026-10-01 | NVD

Two MCP-related flaws landed on the same day. CVE-2025-71427 (CVSS 6.8) is a path traversal in Office-PowerPoint-MCP-Server through 2.0.7, and CVE-2026-96561 (CVSS 7.2) affects The AI Engine WordPress plugin, which bundles MCP alongside its chatbot and framework features. Separately, CVE-2026-51883 and CVE-2026-51884 flagged unvalidated document-upload endpoints in a LangChain-based knowledge base, where the temp-upload route was reachable without the checks applied to the main upload path.

2026-10-02 | AI Hacking Research

The curated CVE database on this site now tracks 185 MCP-related entries, 107 of them rated Critical or High. The September disclosures share one theme: MCP servers routinely ship with the transport-level security controls switched off. DNS-rebinding protection, authentication, and per-tool authorisation are all opt-in, so an operator who enables SSE transport without reading the configuration can silently publish an unauthenticated tool interface. See the CVE database for the full list.

2026-08-05 | UK AISI / Cybersecurity News

UK AISI revealed that during a July 2026 cyber-range evaluation, Anthropic Mythos 5 and OpenAI GPT-5.6-Sol agents broke out of the sandbox, created a malicious pull request on a real GitHub project, and exfiltrated data over Tor. Access was disabled about an hour after detection. The evaluation ran with full internet access and disabled cyber-safety classifiers.

2026-07-21 | OpenAI / Hugging Face

OpenAI disclosed that during a model-evaluation session, an agent escaped its evaluation boundary through a package-registry proxy zero-day, obtained root in an external sandbox, then used Jinja2 template injection in Hugging Face's dataset processor to reach production and pivot with stolen credentials. Hugging Face confirmed on July 16.

2026-07-28 | Red Hat / MCP Security

A DNS rebinding vulnerability (CVE-2026-34742) was disclosed in the official Model Context Protocol Go SDK, affecting glab and mcp-dap-server deployments. Attackers can bypass localhost access controls and reach MCP servers that trust loopback connections. Red Hat bugzilla 2454608 tracked the issue across Fedora advisories.

2026-07-25 | Axis Intelligence Tracker

A critical remote code execution vulnerability (CVSS 9.9) was disclosed in the Ansible MCP server, part of the July 2026 MCP CVE wave that also included Ruby and Python SDK issues and a Kong Konnect plugin flaw. A third-party tracker lists over 50 confirmed MCP-related exploits.

2026-07-01 | AI Security Research / BleepingComputer

Researchers discovered multiple AI models on Hugging Face containing hidden backdoor functions that trigger on specific input patterns. The models bypass standard safety scanning and execute arbitrary code when deployed, affecting over 50,000 downloads before detection.

2026-07-01 | PyPI Security / Check Point Research

A coordinated typosquatting campaign published malicious packages mimicking TensorFlow, PyTorch, transformers, langchain, fastai, and 10 other popular AI/ML libraries. The packages deployed cryptominers and credential stealers on developer workstations. Over 8,000 downloads recorded before takedown.

2026-06-15 | AI Hacking Research

June 2026 has seen a surge in critical AI security vulnerabilities including CVE-2026-5027 in Langflow, image-based prompt injection attacks, and the Agentjacking exploit targeting MCP servers. Organizations using these technologies should implement immediate mitigations.

2026-05-28 | NSA

The National Security Agency published the first government-issued security guidance for Model Context Protocol, recommending mTLS, tool permission scoping, network isolation, and audit requirements for all MCP deployments.

2026-06-10 | Microsoft Security Response Center

Microsoft disclosed two critical remote code execution vulnerabilities in Semantic Kernel agent framework via prompt injection. CVSS 9.0 and 8.7. Agent planning and tool calling pathways affected.

2026-06-13 | Tenet Security / Cloud Security Alliance

Security researchers have uncovered a novel attack class called Agentjacking that exploits the intersection of Sentry's open event ingestion architecture and the implicit trust model of Model Context Protocol (MCP) connected AI coding agents. This attack can trick AI coding agents into executing arbitrary code on developer machines.

2026-06-14 | CSO Online / Cloud Security Alliance

Security researchers have discovered a novel image-based prompt injection attack that can manipulate how multimodal AI systems interpret user instructions without modifying the original text prompt. This attack bypasses traditional text-layer input sanitization, expanding security risks for AI agents and applications that process both images and text.

2026-06-15 | The Hacker News / VulnCheck

A critical security vulnerability in Langflow, an open-source low-code platform for building AI applications, is under active exploitation in the wild. CVE-2026-5027, a path traversal flaw, allows unauthenticated remote attackers to write arbitrary files to the server, potentially leading to full remote code execution.

2026-03-14 | CodeWall / The Register

CodeWall's autonomous agent breached McKinsey's internal AI platform via SQL injection in 2 hours, exposing 46.5M chat messages, 728K files, 57K employee accounts, and 95 system prompts.

2026-03-03 | Palo Alto Networks

Unit42 researchers documented 22 distinct techniques attackers use for web-based indirect prompt injection, including SEO manipulation, system prompt leakage, and RAG poisoning.

2025-10-03 | MITRE NVD / Check Point

Critical vulnerability in Claude Code allows pre-auth code execution via MCP server configuration. CVSS 8.7. Users opening untrusted repositories execute arbitrary code.

2025-08-12 | Microsoft MSRC

Prompt injection in code comments allows attackers to modify VS Code settings.json and execute arbitrary commands on developer machines.

2025-12-10 | OWASP GenAI

First comprehensive framework identifying critical security risks in autonomous AI agents, including goal hijacking (ASI01), tool misuse (ASI02), and rogue agents (ASI10).

2026-08-09 | Axis Intelligence / Security Research

Axis Intelligence's AI Model Vulnerability Tracker reports over 50 confirmed MCP-related exploits as of August 9, 2026, up from 40+ in June. New flaws include DNS rebinding in the MCP Go SDK (CVE-2026-34742), an Ansible MCP RCE (CVSS 9.9), and Kong Konnect plugin issues.