Beat: mcp-security

29 pieces filed under mcp-security, newest first.

• MCP's destructive_hint Is Not a Security Boundary, and LangChain v1.4.0 Just Made It Easier to Forget

  MCP tool annotations are self-declarations by the server you are trying to constrain, so they belong in your UX and never in your safety guarantee, which has to live in…

• Claude Code 2.1.259 Changed What Your MCP Allowlist Covers, and the Docs Still Say Otherwise

  Claude Code 2.1.259 narrowed allowedMcpServers to servers users add, so a managed-mcp.json server your allowlist used to filter out now loads on upgrade, while the…

• CL4R1T4S Has 48,000 Stars and a Prompt Injection at the Bottom of Its README

  CL4R1T4S argues you cannot trust an output whose input you have not read, and then proves it by ending a one-screen README with a prompt-injection payload that the…

• ChatGPT Work Mounts One Filesystem Into Every Session You Have Running

  ChatGPT Work Cloud's /workspace is one writable volume shared across sessions, and a write that lands there crosses no sandbox boundary, so the auto-review reviewer…

• Busbar Calls Itself an Execution Boundary for AI. Read the Block Quote Before You Plan Around It.

  Busbar's README promises an execution boundary across models, MCP tools, and A2A agents, and its own callout says only the model plane is demonstrated today, so treat…

• codex-with-chatgpt Says Your Repository Is Never Uploaded. Read That Sentence Again.

  Codex-with-chatgpt's read-only MCP bridge is unusually careful security engineering, and its own reassuring line about never uploading your repository is true only about…

• Briefing · August 27, 2026 · morning

  The most detailed public account of agents defeating their own sandbox landed the same week that three separate vendors shipped controls deciding what an agent may run,…

• OpenWiki, LangSmith Engine, and the Admin Plugin All Shipped Receipts. None of Them Checks Who Asked.

  Agent systems now verify their own output with cheap deterministic checks, but none of them binds the actor's authority into the record, so a clean receipt is exactly…

• x64dbg-MCP Server Gives an Agent 71 Debugger Tools and Ships Listening on 0.0.0.0

  X64dbg-MCP Server proves agentic reverse engineering works today, and its hand-rolled static bearer token sent in cleartext to a default bind of 0.0.0.0 shows what…

• Cloudflare's Optional OAuth Scopes Make Partial Grants Normal, and Most Agents Will Break On Them

  Cloudflare's optional OAuth scopes turn partial grants into a routine outcome, so every agent and MCP server that assumes it received the scopes it requested now carries…

• Tencent's AI-Infra-Guard Will Scan Your Agent Stack. Its Own README Says Don't Put It on a Public Network.

  AI-Infra-Guard's skills and MCP scan is the most useful free thing you can point at an agent stack, but the platform running it holds your model API keys, reaches across…

• Microsoft Foundry Moved Agent Tool Permissions Into a Request Parameter, and the Denylist Fails Open

  Foundry moved agent tool governance into per-request parameters, and Microsoft's own operational checklist says the denylist form of that control warns instead of…

• Briefing · August 18, 2026 · morning

  AI now reviews code and attacks it, and only the attacking side gets to iterate against live feedback.

• OpenSandbox Credential Vault: Your Agent Runs With a Fake API Key and the Requests Still Work

  OpenSandbox's Credential Vault moves the secret out of the agent process entirely by handing the sandbox a fake key and letting an egress sidecar inject the real header…

• Briefing · August 15, 2026 · morning

  Three layers of the agent stack acquired maintainers this week, and none of those maintainers ships a model.

• chrome-devtools-mcp Shipped a CLI and a Skill. That Moved the Approval Gate.

  Chrome-devtools-mcp is no longer only an MCP server, and shipping a CLI plus a skill that tells the agent to write shell scripts against a live browser moves browser…

• MCP Server Security: 12,520 Exposed Servers and What the Scans Actually Found

  MCP's exposure problem is a deployment-default problem rather than a spec problem, because the protocol never required authentication and internet scan data shows a…

• Briefing · August 13, 2026 · afternoon

  The harness became the contested layer today, with DeepSeek open-sourcing its agent runtime under MIT while raising model prices up to 1,100 percent, NVIDIA shipping a…

• Claude Enterprise Inference Hooks Inspect Every Prompt. They Never Open Your Screenshots.

  Inference hooks finally gives a security team one inline checkpoint across chat, Claude Code, and Cowork with nothing installed on user devices, and Anthropic's own…

• CoreBreak and the Tool Call That Skips the Model Entirely

  CoreBreak is an authorization bug rather than a prompt attack, because three separate runtimes executed tool calls without ever checking that a model produced them,…

• The Azure DevOps MCP Server Ships a Prompt-Injection Guardrail. One Tool Doesn't Use It.

  Microsoft built the prompt-injection defense for its Azure DevOps MCP server and applied it to wiki and build-log tools but not to the one returning pull request…

• Briefing · August 1, 2026 · afternoon

  Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions…

• Ruflo's CVSS 10 Bug Got Patched in a Day. The Poisoned Agent Memory Did Not

  Seven of the eight steps in the RufRoot attack chain die with the patch and a key rotation, but the poisoned AgentDB pattern store survives both, which is why the…

• Briefing · July 31, 2026 · morning

  Four separate disclosures and shipments in seventy-two hours all turned on the same question, what an agent can reach on the network and whether anyone checked that…

• MCP 2026-07-28 Goes Stateless: The Session Didn't Disappear, It Moved Into Your Model's Context

  MCP's stateless rework deletes the session from the transport and rebuilds it as an explicit handle the model threads through tool arguments, which is a real…

• MCP Apps Let a Tool Server Draw the Interface You Click

  MCP Apps makes the server asking for permission the same party that renders the interface you grant it in, and half the safeguards in its security model are phrased as…

• The Coding Agent Became a Security Scanner This Week. It's Also the Thing Being Scanned.

  In-loop AI security scanners inherit the trust model of the session they run in, so the same agents now hunting vulnerabilities are themselves a fresh attack surface,…

• Briefing · July 23, 2026 · afternoon

  Security moved inside the coding agent this week from both directions, as vendors shipped scanners that run in the agent loop while fresh CVEs turned the exact…

• Briefing · July 21, 2026 · afternoon

  Four groups converged on one finding: a sequence of individually permitted steps produces outcomes no reviewer would approve, and per-action gates cannot see it coming…