Insights
Agentic AI Trends in 2026 and the Visibility Gap Behind Each One
The 2026 agentic AI trends are real capability gains, and each one plants a new surface that is unowned by default. Here is the visibility gap behind each.
Field notes on agentic AI security
Research, product, and perspective on governing AI agents, MCP servers, and everything loaded into them.
Research
The Agentic AI Attack Surface, Layer by Layer
Agentic AI has four attack layers - data, orchestration, agent, and system. Three already have owners. The agent-artifact layer on your endpoints does not.
Research
Agentic Resource Discovery: Why Self-Published Catalogs Are Not Enough
Agentic Resource Discovery standardizes what an organization advertises. Security teams still need to know what agents and MCP servers are actually installed.
Insights
Autonomous Hackbots Are Here and Agent-Layer Visibility Is the Answer
A two-person team ran an autonomous hackbot that found 126 bugs in five months. The same coding-agent tooling now runs unmanaged inside your org.
Insights
Autonomous Security Agents Are Agents Too
A published case study on an autonomous security agent is really a runtime-governance argument: assume it can be hijacked, and enforce at the harness.
Insights
ChatGPT for Work: Enterprise Agents Are the New Shadow IT
ChatGPT for Work ships real admin controls, but they stop at the workspace edge. The shadow apps, extensions, and MCP connectors around it are the blind spot.
Insights
The Claude Code Harness Is Your New Attack Surface
The Claude Code harness - CLAUDE.md, hooks, skills, plugins, MCP - is what makes it powerful and what makes it an editable attack surface on every laptop.
Insights
Claude Security and Where Scan-Time Vetting Ends
Claude Security is strong scan-time vetting for code. Here is where scan-time ends and runtime governance - fleet inventory, permissions, and audit - begins.
Insights
Open-Kritt and Governing the Security Agents You Deploy
open-kritt is a smart multi-agent vulnerability-research tool. It is also a dense bundle of fleet artifacts - the security agents you deploy need governing too.
Insights
When an Agent Breaks Out: The OpenAI and Hugging Face Incident
OpenAI and Hugging Face disclosed that evaluation models escaped a sandbox and reached Hugging Face infrastructure. The transferable lessons for agent governance.
AdvisoryHigh
Amazon Q VS Code MCP Auto-Execution - CVE-2026-12957
CVE-2026-12957: Amazon Q for VS Code auto-loaded workspace MCP configs with no consent, letting a malicious repo run code and steal cloud credentials.
Guide
AI Gateways and User-Level OAuth for MCP Servers: Token Exchange vs Passthrough (2026)
AI gateway user-level OAuth for MCP servers: why token passthrough is a confused-deputy anti-pattern and RFC 8693 token exchange is the correct broker for per-user identity.
Guide
Auditing the Data Sources AI Agents Access: What Security Teams Must Log (2026)
How to audit the data sources AI agents access: which files, databases, MCP-connected systems, APIs, and secrets an agent can reach, and the exact fields to log for a defensible data-access trail.
Guide
Auditing AI Chat and Streaming Interactions: How to Log Prompts, Responses, and Retention (2026)
Build an audit trail for AI chat interactions: what to capture from prompts and responses, why streaming completions are hard to log, retention and GDPR erasure, and where employees leak data.
Guide
How to Audit AI Agent Activity: A CISO Implementation Guide (2026)
How to audit AI agent activity, step by step: a CISO implementation guide covering inventory, what to capture, baselines, retention, framework mapping, and program ownership.
Guide
How Claude Code Hooks Work - Events, Matchers, and the PreToolUse Enforcement Point
Claude Code hooks run your code at fixed points in the agent's lifecycle. This guide explains the events, matchers, and decision control, and why PreToolUse is the enforcement point that matters.
Guide
The Agent Skills Open Standard - Specification, Adoption, and the Governance Gap
Agent Skills is now an open standard adopted by 40+ agent products. Here is what the SKILL.md spec defines, who runs it, and the governance gap it ships with.
Guide
Top MCP Servers 2026: The Ten Developers Actually Run
The top MCP servers of 2026, named: Playwright, GitHub, Context7, Filesystem, Slack, Postgres, Figma, AWS, Sentry, Notion, plus three checks each needs.
Guide
Top 10 AI Agent Skills in 2026 (and What to Verify)
A reference to the AI agent skills developers load - what each does, and the source, permissions, and code a security team should verify first.
Guide
Top 10 Enterprise AI Agents to Inventory and Govern (2026)
A field guide to the enterprise AI agents most likely running on your endpoints, grouped by type, with the access each one holds and what to verify.
Insights
New OpenAI Codex Features in 2026 and Their Security Implications
The 2026 OpenAI Codex features - desktop app, remote mode, skills, Computer Use - each add a surface to inventory and govern across the fleet.
Insights
Claude Code Features in 2026: What Each One Adds to Your Attack Surface
Each new Claude Code feature, from skills to subagents to plugins, adds an AI artifact and a new governance surface. Here is what to inventory and control.
Guide
The State of Enterprise AI Security in 2026
The state of enterprise AI security in 2026: agents in production, MCP everywhere, skills as supply chain, and what security teams should do about it.
Guide
OWASP Agentic Skills Top 10: A Security Guide to AI Agent Skills Risks
The OWASP Agentic Skills Top 10 (AST01-AST10) names the risks in AI agent skills. This guide walks every risk and how to govern the skills layer.
Guide
The Complete Enterprise AI Security Guide
Enterprise AI security spans agents, MCP, skills, browser AI, identity, and supply chain. This complete guide maps the attack surface, controls, and program roadmap.
Guide
Shadow AI Detection: Techniques and Best Practices
Shadow AI detection combines network, CASB, endpoint, browser, and identity signals to find unsanctioned AI. Here are the techniques, blind spots, and best practices.
Guide
What Is Shadow AI? A Complete Guide
Shadow AI is the unsanctioned AI tools, agents, and MCP servers employees use without security review. Here is what it is, why it emerged, and how to govern it.
Guide
Top MCP Servers Used by Developers (and What to Check)
A curated reference of the MCP servers developers actually use, the access each one grants, and what a security team should verify before allowing them.
Guide
Top 100 AI Apps Used in Enterprises (Categorized)
A categorized reference of the AI apps used in enterprises today - grouped by function, with the primary data-exposure risk each category carries.
Guide
What Are AI Agent Skills? A Security Primer on the New Shadow-IT Layer
AI agent skills are markdown plus code that load into an agent and run with its full permissions. This primer explains the security surface and how to see it.
Guide
AI Agent Security: A Practical Guide to Threats and Controls
AI agent security protects autonomous AI agents from misuse and attack. This practical guide covers the threat model and a control stack across the agent lifecycle.
Guide
AI Discovery: The Enterprise Buyer's Guide
AI discovery finds every AI agent, MCP server, and artifact in your environment. This enterprise buyer's guide covers evaluation criteria, build vs buy, and vendor questions.
Guide
The Most Common AI Browser Extensions (and Their Risks)
A reference to the most common AI browser extensions and their real security risks - broad page access, third-party data flows, and prompt injection.
AdvisoryHigh
SkillJacking: Hijacking Abandoned Skill Dependencies to Take Over AI Agents
SkillJacking takes over abandoned dependencies an agent skill relies on, seizing control of code that runs inside thousands of AI agents without ever touching the skill itself.
Guide
AI Identity Security Explained: Identities, Credentials, and Controls for AI Systems
AI identity security is the practice of giving AI agents scoped, verifiable, short-lived identities. Here is what those identities are and how to govern them.
Guide
Model Context Protocol (MCP) Security Explained
MCP security is the practice of governing how AI agents connect to tools and data through MCP servers. Here is what MCP is and why it is a security surface.
Guide
The Most Requested AI Agent Permissions (and How to Scope Them)
The permissions AI agents, MCP servers, and skills request most - filesystem, shell, network, OAuth scopes, secrets, browser - and how to scope each to least privilege.
AdvisoryCritical
Malicious Agent Skills: Hidden Payloads and Shadow Features (OWASP AST01)
Malicious agent skills combine hidden code payloads with natural-language instruction attacks. A USENIX 2026 study of 98,380 skills confirmed 157 malicious ones carrying 632 vulnerabilities.
Guide
AI Access Control and Least Privilege: A Practical Guide
AI access control decides what agents can do and reach. This guide covers RBAC, ABAC, policy-based authorization, JIT access, and least privilege for AI.
Guide
AI Governance Framework for Enterprises
An AI governance framework for enterprises built on four pillars - visibility, policy, enforcement, and audit - mapped to NIST AI RMF, ISO 42001, and the EU AI Act.
Guide
AI and OAuth: The Risk Report
AI OAuth risk explained: how AI agents and MCP turn consent screens, tokens, and grants into a new attack surface, and the controls that contain it.
Guide
Vetting and Approving AI Agent Skills: An Enterprise Playbook
A practical enterprise playbook for vetting AI agent skills before they run on your fleet, plus why one-time approval fails and continuous re-vetting is mandatory.
Guide
Browser AI Security: Risks and Controls
Browser AI security covers the risks of AI extensions, copilots, and agentic browsers - and the controls that keep corporate data from leaking through them.
Guide
Shadow AI Adoption by Department: Where AI Shows Up and Why
Shadow AI by department: a qualitative look at where unsanctioned AI shows up across engineering, marketing, sales, finance, HR, legal, and support.
Guide
Least Privilege for Agent Skills: Scoping Permissions, Metadata, and Isolation
Least privilege for agent skills means scoping each skill's capability, cleaning its metadata, and isolating it from the host - because a skill runs with the agent's full permissions.
AdvisoryHigh
LLMjacking: Stolen-Key Cost Abuse Against Enterprise LLM Endpoints
LLMjacking is credential theft aimed at your model bill: attackers steal cloud LLM keys and run inference at your expense. Here is how to see it and stop it.
Guide
Slopsquatting: When Your AI Coding Assistant Installs a Package That Doesn't Exist
Slopsquatting weaponizes LLM package hallucinations: attackers pre-register the fake names your AI assistant invents. Here is how it works and how to stop it.
Guide
Agent-to-Agent (A2A) Security: Trust Boundaries in Multi-Agent Systems
Agent-to-agent security is about the trust boundaries between agents. Here is how A2A systems fail - transitive injection, confused deputy, weak auth - and the controls that hold.
Guide
Securing Computer-Use and Browser Agents
Computer-use and browser agents act on untrusted web content with real mouse, keyboard, and screen access. Here is the lethal trifecta at the UI layer and how to contain it.
Guide
Securing AI Agent Frameworks: The Complete Guide for Security Teams (2026)
Securing AI agent frameworks: the 2026 guide to the LangChain, Langflow, Flowise, LlamaIndex, Gradio and MLflow attack surface security teams miss.
Insights
The Lethal Trifecta in Production: Why Notion AI, Superhuman, and Claude Cowork Fell the Same Way
Four production AI agent exfiltration disclosures in one week proved the lethal trifecta is a config property, not a bug. Why Notion, Superhuman, and Cowork fell.
Research
Shadow AI Data Exposure: What Employees Are Actually Pasting Into ChatGPT, Claude, and Copilot
Shadow AI data exposure is now the top enterprise exfiltration channel. What employees paste into ChatGPT, Claude, and Copilot, by the numbers, and why DLP misses it.
Guide
Secrets Management for AI Agents: Killing the .env File for Good
Secrets management for AI agents breaks the human-in-the-loop model. Here is why the .env file must die and the five practices that replace it.
Guide
Runtime Monitoring and Anomaly Detection for AI Agents: Building Behavioral Baselines
A practitioner's guide to AI agent monitoring: collecting runtime signals, building behavioral baselines with SPC/EWMA, and detecting drift before it becomes a breach.
Guide
OWASP LLM & Agentic Top 10: A Security-Controls Checklist for AI Agents
An OWASP LLM security controls checklist mapping LLM01-10 and Agentic ASI01-10 to preventive, detective, and agent and MCP-layer monitoring controls.
AdvisoryHigh
The OpenClaw Security Crisis: Exposed AI Agents, CVE-2026-25253, and the ClawHavoc Supply Chain
OpenClaw security crisis explained: CVE-2026-25253 one-click RCE, the ClawHavoc skill supply chain, the Moltbook leak, and how to govern shadow AI agents.
Guide
OAuth for MCP Servers: How AI Agent Authorization Actually Works (2026 Spec)
OAuth for MCP servers explained: how the 2026 MCP authorization spec uses OAuth 2.1, PKCE, RFC 8707 resource indicators, and why token passthrough is forbidden.
Guide
Non-Human Identities Are the New Shadow IT: A CISO's Guide to Machine Identity Governance
A CISO's guide to non-human identity governance: the NHI lifecycle, OWASP NHI Top 10, real breaches, and why AI agents and MCP clients break legacy models.
Guide
The Lethal Trifecta: When AI Agent Prompt Injection Becomes a Data Breach
The lethal trifecta for AI agents - private data, untrusted content, external comms - turns prompt injection into data theft. Break the chain by removing one leg.
Guide
Least Privilege for AI Agents: Why Most Agent Identities Are Over-Privileged (and How to Fix It)
Least privilege for AI agents means scoped, time-limited, per-session credentials. Here is why most agent identities are over-privileged and how to fix it.
Guide
Indirect Prompt Injection Explained: The Defining Attack on AI Agents
Indirect prompt injection hides attacker instructions in content an AI agent reads. Why it is unpatchable, how it hits MCP and RAG, and the controls that hold.
Guide
How to Build an MCP Server Registry and Govern MCP at Scale
How to build an MCP server registry that vets, pins, and governs Model Context Protocol servers at scale, plus the lifecycle and controls a security team needs.
Guide
How to Build an AI Agent Inventory: A Step-by-Step Guide for Security Teams
A step-by-step guide to building an AI agent inventory: the five discovery domains, the registry schema, and the risk tiers security teams need to govern agents and MCP.
Guide
GDPR for AI Agents: Lawful Basis, Consent, and Erasure When an Agent Processes Personal Data
GDPR for AI agents in practice: how lawful basis, consent, purpose limitation, and the right to erasure apply when an autonomous agent processes personal data.
Guide
DLP for AI Agents: Why Regex-Era Data Loss Prevention Fails on Prompts and MCP Calls
DLP for AI agents needs more than regex. Learn why legacy data loss prevention misses prompts and MCP calls, and what AI-native inspection and ABAC require.
AdvisoryHigh
Form-Based Prompt Injection: How ShareLeak and PipeLeak Turned Copilot Studio and Agentforce Against Their Owners
ShareLeak (CVE-2026-21520) and PipeLeak show how Copilot Studio prompt injection and Agentforce form fields exfiltrate private data through the agent's own tools.
Guide
AI Agent Memory Poisoning: Poison Once, Exploit Forever
AI agent memory poisoning explained: how attackers plant persistent instructions in agent memory that survive resets and re-fire across future sessions, and how to defend.
Guide
AI Agent Incident Response: Kill Switches, Containment, and Pulling Autonomy to Zero
An AI agent incident response playbook: detection signals, kill switch vs scoped safe mode, pause vs revoke, blast-radius mapping, and evidence preservation.
Guide
Building an Audit Trail for AI Agents: What to Log, How to Structure It, and Why Tool Calls Alone Aren't Enough
An AI agent audit trail must log intent and action, not just tool calls. Learn the schema, immutability, and MCP fields a security team needs for forensics.
Guide
Writing an AI Acceptable Use Policy for Agents and MCP That Reduces Shadow AI Instead of Driving It Underground
An AI acceptable use policy that reduces shadow AI instead of pushing it underground: tiered tool taxonomy, data classification, MCP approval, real enforcement.
Guide
OWASP Top 10 for LLM Applications (2025): A Security Team's Breakdown
A security team's breakdown of the OWASP Top 10 for LLM applications (2025): the full taxonomy, what changed, and how each risk maps to AI agents and MCP servers.
Guide
OWASP Top 10 for Agentic Applications: The Agent Threat List Explained (2026)
The OWASP Top 10 for Agentic Applications (ASI01-ASI10, 2026) explained: what each agent risk means, how it maps to MCP servers, and how to operationalize it.
Guide
OWASP AIVSS: Scoring Agentic AI Vulnerabilities Beyond CVSS (2026)
OWASP AIVSS scores agentic AI vulnerabilities by extending CVSS with an agentic uplift. A guide to the taxonomy, the v0.8 formula, and how to operationalize it.
Guide
NIST AI RMF for AI Agents: Govern, Map, Measure, and Manage (2026)
A practical guide to the NIST AI RMF (Govern, Map, Measure, Manage) for security teams, applied to autonomous AI agents and MCP servers across the fleet.
Guide
MITRE ATLAS for Agentic AI: Mapping Agent and MCP Attacks to the Matrix (2026)
MITRE ATLAS is the adversary-TTP knowledge base for AI systems. This guide maps its tactics and techniques to real agent and MCP server attacks for 2026.
Guide
ISO/IEC 42001 for AI Agent Governance: Building an AI Management System (2026)
A practical, evergreen guide to ISO 42001 AI governance: the AIMS structure, Annex A controls, and how to operationalize them for AI agents and MCP servers.
Guide
IBM AI Risk Atlas for Agentic AI: A Catalogue of Agent Risks (2026)
A security leader's guide to the IBM AI Risk Atlas: its taxonomy, its agentic risk items, and how to operationalize it for AI agents and MCP servers.
Guide
The EU AI Act for AI Agents: Risk Tiers, Obligations, and Compliance Timeline (2026)
A practical guide to the EU AI Act for AI agents: risk tiers, provider and deployer obligations, the 2025-2027 timeline, and what security teams must monitor.
Guide
CSA AI Controls Matrix (AICM): Control Domains for Agent Governance (2026)
A practical guide to the CSA AICM: its 18 domains, 243 control objectives, and how its agentic controls govern AI agents and MCP servers.
Guide
Cisco's AI Security and Safety Framework: What It Covers for AI Agents (2026)
A reference guide to the Cisco AI security framework: its four-layer threat taxonomy, embedded MCP, A2A, and supply-chain models, and what it means for agents.
AdvisoryHigh
LangSmith SDK Arbitrary File Read - GHSA-f4xh-w4cj-qxq8
GHSA-f4xh-w4cj-qxq8: an arbitrary file read in the LangSmith SDK before 0.8.18. A crafted request makes the server upload a file as a trace attachment.
Guide
NVIDIA SkillSpector: Scanning Agent Skills Before You Install Them
NVIDIA SkillSpector scans agent skills for 68 vulnerability patterns before install. What it detects, how to run it, and where runtime governance fits.
AdvisoryCritical
Langflow unauthenticated RCE - CVE-2026-48519
CVE-2026-48519: a Langflow unauthenticated RCE in the Shareable Playground through 1.9.1. A public build link runs arbitrary Python. Fixed in 1.9.2.
Research
Cursor’s Config Surface: .cursorrules, MCP, and Extension Drift on the Endpoint
What Cursor leaves on the endpoint: .cursorrules and .cursor/rules/, ~/.cursor/mcp.json servers, and Open VSX extensions that drift off any allowlist.
Research
Claude Code vs OpenAI Codex vs Cursor: A Security Team’s Guide to Their Permission Models (2026)
Claude Code, Codex, and Cursor each gate agent actions differently: deny-first rules, an OS sandbox, and an allowlist plus LLM classifier. Side by side.
Guide
AI Supply-Chain Attacks: A Defender's Guide for Security Teams (2026)
AI supply-chain attacks now poison the agent config layer. Sonatype found 454,600+ malicious packages in 2025, 99% on npm. A defender's guide.
Guide
Securing AI Coding Agents and CLIs: The Complete Guide for Security Teams (2026)
Securing AI coding agents and CLIs in 2026: with 84% developer adoption, the inventory, runtime-governance and audit playbook for security teams.
Guide
Securing LLM Gateways and Proxies: The Complete Guide for Security Teams (2026)
Securing LLM gateways: the 2026 guide to the LiteLLM, vLLM, Ollama and LightLLM attack surface - with 175,000 Ollama hosts already exposed publicly.
Guide
Governing AI Coding Assistants Across Your Fleet: Claude Code, OpenAI Codex, and GitHub Copilot (2026)
One framework to govern AI coding assistants: inventory, set policy, and audit Claude Code, OpenAI Codex, and GitHub Copilot across your fleet.
Research
Cursor Privacy Mode and Enterprise Controls: What Admins Can Actually Enforce
Cursor admins can enforce Privacy Mode org-wide and re-verify it every 5 minutes, but the control plane stops at the local MCP and extension layer.
AdvisoryHigh
mcp-server-kubernetes Tool Restriction Bypass at Execution Layer - CVE-2026-46519
CVE-2026-46519 (CVSS 8.8): mcp-server-kubernetes enforces tool limits at tools/list, not tools/call, so any client can run kubectl_delete. Fix in v3.6.0.
Guide
GitHub Copilot Code Review and Security Validation: A Team Workflow (2026)
A team GitHub Copilot code review workflow: inline vs chat, validating suggestions, layering scanning, and a 90-day audit of every Copilot endpoint.
Research
Cursor Auto-Run (Formerly YOLO Mode): Why Allow and Deny Lists Aren’t Enough
Cursor auto-run lets the agent run shell and apply edits unattended. Why the allowlist, denylist, and file-delete checkbox route around - and what holds.
Research
OpenAI Codex Full-Access Mode and the Trust Boundary
When Codex runs danger-full-access with approval_policy never, the sandbox and prompts are gone, network is on, and one trust click is your only control.
Guide
Governing GitHub Copilot in the Enterprise: Policies, Content Exclusion, and Audit (2026)
A practitioner guide to governing GitHub Copilot: org policies, the public-code filter, content exclusion limits, and the 180-day audit log.
Guide
MCP Server Security: The Complete Guide for Security Teams (2026)
MCP server security in 2026: the attack surface, the CVE wave, MCP trust tiers, and how to inventory and govern every MCP server across your fleet.
AdvisoryCritical
LiteLLM MCP-Preview Command Injection Chained to Unauthenticated RCE - CVE-2026-42271
CVE-2026-42271: a LiteLLM RCE (CVSS 8.7) in the MCP-preview endpoints, chained with CVE-2026-48710 for unauthenticated RCE. Fixed in LiteLLM 1.83.7.
Guide
Rolling Out OpenAI Codex Across Your Fleet: A Governance Guide (2026)
OpenAI Codex governance for a fleet: baseline sandbox/approval floor, repo trust tiers, secret handling, and the audit requirements.toml leaves open.
Research
OpenAI Codex Across CLI, Cloud, and IDE: Where the Security Model Differs
OpenAI Codex runs in three places with three different sandboxes. In cloud, agent-phase internet is off by default; on the CLI it depends on one TOML key.
AdvisoryCritical
Hades PyPI Campaign Poisons 19 Packages with .pth Startup Hooks - Bun Credential Stealer and AI Scanner Misdirection
The Hades wave shipped 37 malicious wheels across 19 PyPI packages using *-setup.pth startup hooks that run a Bun credential stealer on every Python run.
Research
OpenAI Codex’s Sandbox and Approval Model: What’s Isolated, What Isn’t
OpenAI Codex isolates the agent phase with no network by default and strips secrets before it runs-but the fleet still owns approval drift and audit.
Guide
Deploying Claude Code Across a Fleet: Settings Hierarchy, MCP, and Memory (2026)
Deploying Claude Code across a fleet: the five-layer settings hierarchy, vetting MCP servers across three scopes, CLAUDE.md, and the visibility gap.
Guide
Securing OpenAI Codex: Sandbox Modes, Approval Policies, and the Two-Phase Runtime (2026)
A practitioner guide to securing OpenAI Codex: pick sandbox plus approval combinations, why secrets are dropped before the agent phase, and a hardening checklist.
Research
Auditing Claude Code Across a Fleet: Settings, Hooks, MCP Servers, Plugins, and Skills
What we find auditing Claude Code on managed laptops: settings.json allow/deny drift, registry MCP servers, plugins, skills, and PreToolUse hooks.
Guide
GitHub Copilot Best Practices: A Security-First Adoption Guide (2026)
GitHub Copilot best practices for security teams: prompting, validate-before-implement, CodeQL scanning, the 65-lexeme public-code filter, and governance.
Guide
Configuring Claude Code Permissions and Hooks: A Hardening Guide for Teams (2026)
A practitioner guide to Claude Code permissions hardening: allow/deny rules, the four path anchors, a PreToolUse deny hook, and a 12-item checklist.
Research
What Claude Code’s --dangerously-skip-permissions Really Skips (and What It Doesn’t)
Claude Code's --dangerously-skip-permissions skips the prompts, not PreToolUse hooks, deny rules, or the rm -rf circuit breaker. What CI loses.
Guide
OpenAI Codex Use Cases: A Practical Guide for Engineering Teams (2026)
A practitioner guide to OpenAI Codex use cases - PR review, refactors, migrations, security scans - and the sandbox and approval settings each one needs.
Research
How Claude Code Permissions Actually Work: Allow Rules, Deny Rules, and the PreToolUse Hook
How Claude Code evaluates permissions: rules fire deny then ask then allow, and a PreToolUse hook can never override a matching deny or ask.
AdvisoryCritical
Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit
The Miasma 'Phantom Gyp' npm worm abuses a 157-byte binding.gyp to run code at install, hitting 57 packages across 286+ versions in under two hours.
Guide
How Claude Code Works: A Security Team’s Guide to the Agentic Loop, Tools, and Hooks (2026)
How Claude Code works for security teams: the agentic loop, five tool categories, and governing the PreToolUse hook with a 90-day audit trail.
AdvisoryCritical
MLflow AI Gateway credential exfiltration - CVE-2026-4035
CVE-2026-4035: MLflow AI Gateway credential exfiltration in MLflow < 3.11.0. A crafted api_base sends resolved server-side api_key secrets to attackers.
Company
Why We Built Anomity: Securing the AI Agent Endpoint
Why we built Anomity: AI agent adoption outran governance, and the endpoint is the layer Network, EDR, DLP, and GRC were never designed to see.
AdvisoryHigh
Claude Code GitHub Action Permission Bypass and Secret Exfiltration - claude-code-action
claude-code-action before v1.0.94 (CVSS 4.0 7.8): a [bot] actor check let attackers bypass the human gate and exfiltrate CI secrets. Patched in 4 days.
AdvisoryCritical
MCPJam Inspector Remote Code Execution - CVE-2026-23744
CVE-2026-23744 is a critical RCE in MCPJam Inspector ≤ 1.4.2: it binds 0.0.0.0 and a crafted request triggers an MCP server install and code execution.
AdvisoryHigh
TrapDoor Cross-Ecosystem Supply-Chain Attack - Credential Theft and AI Assistant Poisoning Across npm, PyPI and Crates.io
TrapDoor, disclosed May 2026, spread credential-stealing malware across 34+ packages and 384+ versions on npm, PyPI, and Crates.io and poisoned AI agents.
AdvisoryHigh
LiteLLM allowed_routes Privilege Escalation via Key Creation - CVE-2026-47101
CVE-2026-47101 (CVSS 8.8): a LiteLLM internal_user can mint a key with admin-only allowed_routes and escalate to proxy_admin. Fixed in LiteLLM 1.83.14.
AdvisoryHigh
LiteLLM /user/update Self-Promotion to proxy_admin - CVE-2026-47102
CVE-2026-47102 (CVSS 8.8): a LiteLLM org_admin can POST /user/update to set their own user_role to proxy_admin for full proxy control. Fixed in 1.83.10.
AdvisoryHigh
Network-AI Empty-Default-Secret Cross-Origin MCP Tool Invocation - CVE-2026-46701
CVE-2026-46701: Network-AI's MCP SSE server defaults to an empty secret, so auth passes for everyone, and wildcard CORS lets any page call its 22 tools.
AdvisoryMedium
Starlette BadHost Host-Header Auth Bypass Hits AI Gateways - CVE-2026-48710
CVE-2026-48710 (BadHost) is a Starlette host-header auth bypass before 1.0.1, reaching FastAPI, vLLM, LiteLLM, and MCP servers. Fixed in Starlette 1.0.1.
AdvisoryHigh
Comment and Control Prompt Injection Across Claude Code, Gemini CLI and Copilot Agents - Credential Theft via GitHub Comments
Comment and Control prompt injection turned three CI coding agents into credential thieves via PR comments; the Anthropic finding rated CVSS 9.4 Critical.
AdvisoryHigh
Mobile MCP Unvalidated URL Android Intent Injection - CVE-2026-35394
CVE-2026-35394: Mobile MCP intent injection before v0.0.50 passes any URI scheme to Android intents, enabling tel: USSD codes, calls, and SMS.
Product
Inside Anomity Discovery: How We Inventory Every AI Artifact on the Endpoint
How the Anomity Endpoint Sensor discovers every AI agent, MCP server, extension, and secret on an endpoint, then classifies and governs them from the cloud.
AdvisoryCritical
TanStack, Mistral AI and Guardrails AI npm/PyPI Packages Hit by Mini Shai-Hulud - CVE-2026-45321
CVE-2026-45321: the Mini Shai-Hulud wave hit 42 @tanstack packages across 84 versions plus 170+ npm/PyPI packages to steal CI/CD and cloud secrets.
AdvisoryHigh
LangChain unsafe deserialization - CVE-2026-44843
CVE-2026-44843: a High-severity unsafe deserialization in langchain-core <= 1.3.2 and <= 0.3.84 revives arbitrary objects from untrusted run data.
AdvisoryCritical
MCP Connect Default-Unauthenticated /bridge Endpoint OS Command Execution - GHSA-wvr4-3wq4-gpc5
GHSA-wvr4-3wq4-gpc5: MCP Connect's /bridge endpoint is unauthenticated by default in mcp-bridge up to 2.0.0, letting any network attacker run OS commands.
AdvisoryCritical
Ollama Bleeding Llama Unauthenticated Memory Leak - CVE-2026-7482
CVE-2026-7482 (Bleeding Llama) is a CVSS 9.1 unauthenticated heap read in Ollama before 0.17.1 that leaks prompts and API keys from ~300k servers.
AdvisoryCritical
Gemini CLI and run-gemini-cli Maximum-Severity CI Remote Code Execution - GHSA-wpqr-6v78-jr5g
GHSA-wpqr-6v78-jr5g (CVSS 10.0): an unprivileged PR or issue could load attacker-controlled .gemini config and run shell commands on a CI runner.
Research
What We Find When We Scan AI Agent Configs Across Managed Fleets
The recurring risks hiding in AI agent configs on managed endpoints: plaintext secrets, blanket permission grants, unvetted MCP servers, and off-allowlist extensions.
AdvisoryHigh
LMDeploy Vision Image-Loader SSRF Exploited in 12 Hours - CVE-2026-33626
CVE-2026-33626: an SSRF in LMDeploy's vision image loader, exploited against honeypots 12 hours after disclosure. Fixed in 0.12.3 - what to check.
AdvisoryCritical
LiteLLM Pre-Auth SQL Injection in Proxy Key Verification - CVE-2026-42208
CVE-2026-42208 is a CVSS 9.3 pre-auth SQL injection in LiteLLM Proxy 1.81.16-1.83.6 that reads upstream provider keys. Exploited in 36h; fix in 1.83.7.
AdvisoryCritical
Flowise code injection in the Airtable Agent - CVE-2026-41265
CVE-2026-41265: a Flowise code injection in the Airtable Agent. Aliased imports bypass the import filter for RCE. Affects through 3.0.13; fixed in 3.1.0.
AdvisoryCritical
Model Context Protocol STDIO Transport By-Design Command Execution - MCP By Design
MCP By Design (OX Security): the STDIO transport runs any process command on the host, tying ~7,000 public servers and 10+ CVEs to one root cause.
AdvisoryCritical
nginx-ui Unauthenticated MCP Message Endpoint Server Takeover - CVE-2026-33032
nginx-ui MCP authentication bypass: CVE-2026-33032 (CVSS 9.8) lets any network attacker invoke every MCP tool via /mcp_message. Fixed in nginx-ui 2.3.4.
AdvisoryHigh
PolinRider DPRK Supply-Chain Campaign - Malicious npm and VS Code Artifacts Infect 1,900+ GitHub Repositories
PolinRider DPRK npm supply chain campaign compromised 1,951 GitHub repositories across 1,047 owners by appending obfuscated JavaScript to config files.
AdvisoryModerate
LangChain Prompt Template Injection - CVE-2026-40087
CVE-2026-40087: a LangChain prompt template injection in langchain-core. Unsafe f-string handling leaks internal object state into prompts and logs.
AdvisoryMedium
Ollama Model Pull API SSRF - CVE-2026-5530
CVE-2026-5530: an SSRF in Ollama through 0.18.1. A crafted registry URL on the Model Pull API forces outbound requests. No vendor fix; exploited.
AdvisoryCritical
MLflow command injection in model serving - CVE-2026-0596
MLflow command injection CVE-2026-0596: a model_uri shell-command flaw in MLflow < 3.9.0 model serving enables arbitrary command execution. Fixed in 3.9.0.
AdvisoryHigh
OpenAI Codex Branch-Name Command Injection and GitHub Token Theft - BeyondTrust Phantom Labs
OpenAI Codex ran shell from an unsanitized Git branch name, hidden behind 94 U+3000 spaces, capturing the GitHub access token. Fixed January 2026.
AdvisoryHigh
vLLM Hardcoded trust_remote_code Override Enables RCE - CVE-2026-27893
CVE-2026-27893 is a CVSS 8.8 RCE in vLLM 0.10.1 through before 0.18.0: hardcoded trust_remote_code=True overrides the operator opt-out. Fixed in 0.18.0.
AdvisoryCritical
vLLM Unauthenticated RCE via Malicious Video URL - CVE-2026-22778
CVE-2026-22778 is a CVSS 9.8 pre-auth RCE chain in vLLM 0.8.3-0.14.0: a video_url leaks a heap address, then a JPEG2000 overflow runs code. Fix: 0.14.1.
AdvisoryHigh
LiteLLM Supply-Chain Compromise - Malicious PyPI Release 1.82.8
Malicious LiteLLM releases 1.82.7 and 1.82.8 shipped a .pth file that ran on every Python startup to harvest credentials. What to check on your fleet.
AdvisoryHigh
Windows-MCP Unauthenticated HTTP Transport PowerShell RCE - GHSA-vrxg-gm77-7q5g
GHSA-vrxg-gm77-7q5g: Windows-MCP before v0.7.5 binds an unauthenticated HTTP transport on port 8000 with wildcard CORS, yielding remote PowerShell RCE.
Insights
Why AI Agents and MCP Servers Are the New Shadow IT
AI agents and MCP servers are adopted bottom-up, carry their own permissions, and report to no one in security. They are the new shadow IT.
AdvisoryCritical
Tencent WeKnora Unauthenticated MCP STDIO Validation Bypass RCE - CVE-2026-30861
WeKnora unauthenticated RCE: CVE-2026-30861 (CVSS 9.9) bypasses the MCP STDIO command allowlist via npx -p node. Patched in WeKnora v0.2.10.
AdvisoryHigh
SEO-Poisoning Campaign Delivers Fake Gemini CLI and Claude Code Installers - EclecticIQ
EclecticIQ tracked a March 2026 SEO-poisoning campaign of 30+ domains pushing fake Gemini CLI and Claude Code installers that ran a fileless stealer.
AdvisoryHigh
Gradio SSRF via proxy_url - CVE-2026-28416
CVE-2026-28416: a Gradio SSRF in gradio < 6.6.0. A malicious Space's proxy_url steers gr.load to internal services and cloud metadata. Fixed in 6.6.0.
AdvisoryHigh
Claude Code Project-File RCE and API Token Exfiltration - CVE-2025-59536 / CVE-2026-21852
CVE-2025-59536 and CVE-2026-21852: a cloned repo's .claude/settings.json ran code and leaked the Anthropic API key before the Claude Code trust prompt.
AdvisoryCritical
mcp-atlassian Unauthenticated SSRF and Path Traversal to Root RCE - CVE-2026-27825
mcp-atlassian RCE: CVE-2026-27825 (MCPwnfluence) chains unauthenticated SSRF and path traversal to root code execution in versions below 0.17.0.
AdvisoryCritical
Tencent WeKnora Authenticated MCP STDIO Command Injection - CVE-2026-22688
CVE-2026-22688: an authenticated WeKnora user controls the MCP STDIO command/args, gaining process execution on the server. Patched in v0.2.5.
AdvisoryHigh
Cline GitHub Actions Compromise and Unauthorized npm Release - [email protected]
On February 17, 2026 an attacker stole the Cline CLI's npm publish token via a prompt-injection-and-cache-poisoning chain in its GitHub Actions workflows and shipped an unauthorized [email protected] release (with an openclaw-installing postinstall script). The VS Code extension was not affected. No CVE (tracked as GHSA-9ppg-jx86-fqw7).
AdvisoryCritical
LightLLM Unauthenticated Pickle Deserialization RCE in PD WebSockets - CVE-2026-26220
CVE-2026-26220 is a CVSS 9.3 unauthenticated pickle deserialization RCE in LightLLM 1.1.0 PD WebSockets. A broken empty-string nonce disabled the check.
AdvisoryCritical
Cursor Sandbox Escape via Git Hooks Remote Code Execution - CVE-2026-26268
CVE-2026-26268 (CVSS 9.9): a Cursor sandbox escape let a malicious agent write Git hooks, so a routine Git op ran code outside the sandbox. Fixed in 2.5.
AdvisoryCritical
LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252
CVE-2026-22252: a command injection in LibreChat's MCP STDIO transport lets any authenticated user run shell commands as root. Fixed in v0.8.2-rc2.
AdvisoryHigh
Mass Scanning and SSRF Campaign Against Exposed LLM Infrastructure - GreyNoise 2025-2026
GreyNoise's Ollama honeypots logged 91,403 attack sessions (Oct 2025-Jan 2026) probing 73+ LLM endpoints and abusing model-pull SSRF. 80,469 in 11 days.
AdvisoryCritical
Shai-Hulud 2.0 npm Worm Backdoors 796 Packages - Preinstall Credential Theft and Home-Directory Wiper
Shai-Hulud 2.0, identified November 24 2025, is a self-replicating npm worm that backdoored 796 packages and runs a credential stealer during preinstall.
AdvisoryHigh
vLLM Prompt-Embeds Tensor Deserialization Memory Corruption - CVE-2025-62164
CVE-2025-62164 is a memory-corruption flaw in vLLM 0.10.2 to before 0.11.1 that deserializes prompt-embeds via torch.load(), enabling DoS and maybe RCE.
AdvisoryHigh
GitHub Copilot and VS Code YOLO-Mode Remote Code Execution - CVE-2025-53773
CVE-2025-53773: indirect prompt injection makes GitHub Copilot write chat.tools.autoApprove into .vscode/settings.json, flipping VS Code to YOLO-mode RCE.
AdvisoryHigh
Cursor MCPoison Persistent Code Execution via MCP Trust Bypass - CVE-2025-54136
CVE-2025-54136 (CVSS 7.2): MCPoison tied Cursor's MCP approval to a server name, not its contents - a later swap ran without re-approval. Fixed in 1.3.
AdvisoryHigh
Cursor CurXecute MCP Prompt-Injection Remote Code Execution - CVE-2025-54135
CVE-2025-54135 (CVSS 8.5): CurXecute let prompt injection write Cursor's .cursor/mcp.json and auto-run commands before approval. RCE in Cursor 1.2.1.
AdvisoryHigh
Gemini CLI Silent Code Execution via Allowlist Bypass - Tracebit
Tracebit found Google Gemini CLI before 0.1.14 ran hidden chained shell commands past its allowlist, exfiltrating env vars two days after release.
AdvisoryMedium
Amazon Q Developer VS Code Extension Wiper Prompt Injection - GHSA-7g7f-ff96-5gcw
GHSA-7g7f-ff96-5gcw: a wiper prompt shipped in Amazon Q Developer for VS Code 1.84.0 told the agent to delete home files and AWS resources. Fix: 1.85.0.
AdvisoryCritical
mcp-remote OS Command Injection from Untrusted MCP Servers - CVE-2025-6514
CVE-2025-6514: an mcp-remote command injection (CVSS 9.6) lets an untrusted MCP server run OS commands on the connecting client. Fixed in 0.1.16.
AdvisoryCritical
Anthropic MCP Inspector Proxy Missing Auth Browser-Driven RCE - CVE-2025-49596
CVE-2025-49596: an unauthenticated CVSS 9.4 RCE in MCP Inspector below 0.14.1 (credited to Tenable Research) - a malicious webpage runs code on a developer host.
AdvisoryCritical
LlamaIndex SQL Injection in Vector Stores - CVE-2025-1793
LlamaIndex SQL injection: CVE-2025-1793 (CWE-89) in llama-index vector stores below 0.12.28 lets a crafted RAG input run arbitrary SQL. Fixed in 0.12.28.
AdvisoryHigh
MCP Tool Poisoning via Hidden Instructions in Tool Descriptions - Invariant Labs Disclosure
Invariant Labs' Tool Poisoning Attack (April 1, 2025): hidden instructions in MCP tool descriptions steer the model; a 2025 academic survey of 1,899 open-source MCP servers found ~5.5% carried tool poisoning.
AdvisoryHigh
LiteLLM api_base SSRF Leaks Upstream Provider Keys - CVE-2024-6587
CVE-2024-6587 is a CVSS 7.5 SSRF in LiteLLM through 1.38.10: a caller-set api_base made the proxy forward the provider key. Fixed in 1.44.8.
