Beat: mcp-security

44 pieces filed under mcp-security, newest first.

• Briefing · October 24, 2026 · afternoon

  The agent releases that landed this week judge the work by the result you can observe from outside, not by the steps the agent reports taking.

• AI Agents Don't Need to Log In. The Storm-0940 Attack Shows Where to Look Instead

  The Storm-0940 campaign shows that once an AI agent holds an app's consented identity it works where sign-in defenses never look, so app-only identities need their own…

• LiteLLM 1.107.0 Shows Your AI Gateway Is a Credential Vault

  The LiteLLM 1.107.0 compromise shows that an AI gateway concentrates every model provider key a team owns, and because the malware ran from a .pth startup hook, having…

• Briefing · October 19, 2026 · morning

  As agents run longer with less human supervision, the weekend's releases keep moving the place where a person can still see what happened, into latent-thought…

• REA Turns Coding Agents Into Reverse Engineers. "Local" Doesn't Mean the Evidence Stays Put.

  REA's MCP server does its reverse engineering on your machine, but every finding it returns lands in the agent's conversation and travels to that agent's model provider,…

• Websites Are Hiding Instructions for AI Agents in HTTP Headers

  A scan of 217 million web responses shows sites already write instructions for AI agents into HTTP headers, and whether an agent ever sees them depends on its fetch…

• npm Provenance Turns a Malware Scare Into a Two-Command Check

  The Zod 4.6.6 scare was settled by npm's provenance record, which makes trusted publishing plus an attestation check the cheapest supply-chain habit a JavaScript team…

• Uber ADR Watches Your Coding Agents by Reading Their Logs, Secrets Included

  Uber's ADR detects risky coding-agent behavior by reading the session logs those agents already write to disk, so its sensor output becomes a second copy of every…

• Briefing · October 6, 2026 · morning

  Within two days an open-weight model arrived as an announcement without weights, agent-proposed semiconductors arrived with their key properties computed but unmeasured,…

• Claude Code 2.1.288 and the Error Path, Why Agent Permission Hooks Have to Fail Closed

  Claude Code 2.1.288 shows that an agent permission layer is only as strong as its error path, because the release turned a hook that fails to match into a block and…

• Briefing · October 3, 2026 · morning

  On October 2 Cloudflare and Anthropic shipped checkpoints between agents and what they can reach while Apple announced one, as Cloudflare added an opt-in email allowlist…

• Figma's MCP Allowlist Is Spec-Compliant, and That's the Real Problem

  Figma's 403 for unlisted MCP clients is allowed by the MCP authorization spec, which makes open client registration optional and lets servers keep allowlists, so MCP…

• NVIDIA OpenShell and the Blind Spot in Out-of-Band Agent Enforcement

  Out-of-band agent enforcement like NVIDIA OpenShell and Sentry governs what an agent sends and where, but its request rules default to audit and MCP server responses…

• Hister Indexes Everything You Read and Hands It to Your Agent. Its Own Docs Explain Why That Is a Problem.

  Hister is an MCP server where every record is attacker-authored by construction, and its answer is to label untrusted content rather than sanitize it, which moves the…

• An AI Agent Found a Live Admin Token in a 2023 Docker Image in 25 Minutes. Yours Is Probably Still There.

  This week's scoped-token launches govern credentials minted from now on, but the credential that gets you was baked into a container's build history years ago, and…

• MCP's destructive_hint Is Not a Security Boundary, and LangChain v1.4.0 Just Made It Easier to Forget

  MCP tool annotations are self-declarations by the server you are trying to constrain, so they belong in your UX and never in your safety guarantee, which has to live in…

• Claude Code 2.1.259 Changed What Your MCP Allowlist Covers, and the Docs Still Say Otherwise

  Claude Code 2.1.259 narrowed allowedMcpServers to servers users add, so a managed-mcp.json server your allowlist used to filter out now loads on upgrade, while the…

• CL4R1T4S Has 48,000 Stars and a Prompt Injection at the Bottom of Its README

  CL4R1T4S argues you cannot trust an output whose input you have not read, and then proves it by ending a one-screen README with a prompt-injection payload that the…

• ChatGPT Work Mounts One Filesystem Into Every Session You Have Running

  ChatGPT Work Cloud's /workspace is one writable volume shared across sessions, and a write that lands there crosses no sandbox boundary, so the auto-review reviewer…

• Busbar Calls Itself an Execution Boundary for AI. Read the Block Quote Before You Plan Around It.

  Busbar's README promises an execution boundary across models, MCP tools, and A2A agents, and its own callout says only the model plane is demonstrated today, so treat…

• codex-with-chatgpt Says Your Repository Is Never Uploaded. Read That Sentence Again.

  Codex-with-chatgpt's read-only MCP bridge is unusually careful security engineering, and its own reassuring line about never uploading your repository is true only about…

• Briefing · August 27, 2026 · morning

  The most detailed public account of agents defeating their own sandbox landed the same week that three separate vendors shipped controls deciding what an agent may run,…

• OpenWiki, LangSmith Engine, and the Admin Plugin All Shipped Receipts. None of Them Checks Who Asked.

  Agent systems now verify their own output with cheap deterministic checks, but none of them binds the actor's authority into the record, so a clean receipt is exactly…

• x64dbg-MCP Server Gives an Agent 71 Debugger Tools and Ships Listening on 0.0.0.0

  X64dbg-MCP Server proves agentic reverse engineering works today, and its hand-rolled static bearer token sent in cleartext to a default bind of 0.0.0.0 shows what…

• Cloudflare's Optional OAuth Scopes Make Partial Grants Normal, and Most Agents Will Break On Them

  Cloudflare's optional OAuth scopes turn partial grants into a routine outcome, so every agent and MCP server that assumes it received the scopes it requested now carries…

• Tencent's AI-Infra-Guard Will Scan Your Agent Stack. Its Own README Says Don't Put It on a Public Network.

  AI-Infra-Guard's skills and MCP scan is the most useful free thing you can point at an agent stack, but the platform running it holds your model API keys, reaches across…

• Microsoft Foundry Moved Agent Tool Permissions Into a Request Parameter, and the Denylist Fails Open

  Foundry moved agent tool governance into per-request parameters, and Microsoft's own operational checklist says the denylist form of that control warns instead of…

• Briefing · August 18, 2026 · morning

  AI now reviews code and attacks it, and only the attacking side gets to iterate against live feedback.

• OpenSandbox Credential Vault: Your Agent Runs With a Fake API Key and the Requests Still Work

  OpenSandbox's Credential Vault moves the secret out of the agent process entirely by handing the sandbox a fake key and letting an egress sidecar inject the real header…

• Briefing · August 15, 2026 · morning

  Three layers of the agent stack acquired maintainers this week, and none of those maintainers ships a model.

• chrome-devtools-mcp Shipped a CLI and a Skill. That Moved the Approval Gate.

  Chrome-devtools-mcp is no longer only an MCP server, and shipping a CLI plus a skill that tells the agent to write shell scripts against a live browser moves browser…

• MCP Server Security: 12,520 Exposed Servers and What the Scans Actually Found

  MCP's exposure problem is a deployment-default problem rather than a spec problem, because the protocol never required authentication and internet scan data shows a…

• Briefing · August 13, 2026 · afternoon

  The harness became the contested layer today, with DeepSeek open-sourcing its agent runtime under MIT while raising model prices up to 1,100 percent, NVIDIA shipping a…

• Claude Enterprise Inference Hooks Inspect Every Prompt. They Never Open Your Screenshots.

  Inference hooks finally gives a security team one inline checkpoint across chat, Claude Code, and Cowork with nothing installed on user devices, and Anthropic's own…

• CoreBreak and the Tool Call That Skips the Model Entirely

  CoreBreak is an authorization bug rather than a prompt attack, because three separate runtimes executed tool calls without ever checking that a model produced them,…

• The Azure DevOps MCP Server Ships a Prompt-Injection Guardrail. One Tool Doesn't Use It.

  Microsoft built the prompt-injection defense for its Azure DevOps MCP server and applied it to wiki and build-log tools but not to the one returning pull request…

• Briefing · August 1, 2026 · afternoon

  Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions…

• Ruflo's CVSS 10 Bug Got Patched in a Day. The Poisoned Agent Memory Did Not

  Seven of the eight steps in the RufRoot attack chain die with the patch and a key rotation, but the poisoned AgentDB pattern store survives both, which is why the…

• Briefing · July 31, 2026 · morning

  Four separate disclosures and shipments in seventy-two hours all turned on the same question, what an agent can reach on the network and whether anyone checked that…

• MCP 2026-07-28 Goes Stateless: The Session Didn't Disappear, It Moved Into Your Model's Context

  MCP's stateless rework deletes the session from the transport and rebuilds it as an explicit handle the model threads through tool arguments, which is a real…

• MCP Apps Let a Tool Server Draw the Interface You Click

  MCP Apps makes the server asking for permission the same party that renders the interface you grant it in, and half the safeguards in its security model are phrased as…

• The Coding Agent Became a Security Scanner This Week. It's Also the Thing Being Scanned.

  In-loop AI security scanners inherit the trust model of the session they run in, so the same agents now hunting vulnerabilities are themselves a fresh attack surface,…

• Briefing · July 23, 2026 · afternoon

  Security moved inside the coding agent this week from both directions, as vendors shipped scanners that run in the agent loop while fresh CVEs turned the exact…

• Briefing · July 21, 2026 · afternoon

  Four groups converged on one finding: a sequence of individually permitted steps produces outcomes no reviewer would approve, and per-action gates cannot see it coming…