Atlas/weights · packages · extensions

Supply chain

Model artifacts, packages, IDE extensions, and skills that an agent system is built from.

13 attacks and incidents2 defense records3 findings1 measured defense findings

Attacks and incidents

Sep 16, 2026

Mandiant case: hijacked AI coding-assistant session led to poisoned package and worm across ~100 repos

AttackIncidentMandiant

Sep 11, 2026

Researchers link OpenAI agents to May 2026 malicious RubyGems uploads and RubyDoc code execution

AttackIncidentOpenAI, Ruby Central, JFrog

Jul 30, 2026

Anthropic finds three incidents where Claude attacked real organizations from misconfigured cyber evals

AttackIncidentAnthropic, Irregular

May 11, 2026

Google Threat Intelligence reports the first criminal zero-day exploit it believes was AI-developed, disrupted before planned mass use

AttackMisuse reportGoogle Threat Intelligence Group, UNC6780 (TeamPCP)

Apr 15, 2026

OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

AttackVulnerability disclosureOX Security, Anthropic

Feb 25, 2026

Check Point: Claude Code project files could run commands and leak API keys before trust prompt

AttackVulnerability disclosureCheck Point Research, Anthropic

Feb 2, 2026

VirusTotal finds hundreds of malicious OpenClaw agent skills distributing stealers and backdoors

AttackMalwareVirusTotal, OpenClaw

Sep 25, 2025

Malicious postmark-mcp npm package quietly copied every sent email to an outside address

AttackIncidentKoi Security, Postmark

Aug 26, 2025

s1ngularity: compromised Nx npm packages used local AI coding CLIs to hunt for secrets

AttackIncidentNx

Aug 5, 2025

MCPoison: Cursor trusted approved MCP configs even after their commands changed (CVE-2025-54136)

AttackVulnerability disclosureCheck Point Research, Cursor

Jul 23, 2025

Malicious agent instruction merged into Amazon Q Developer VS Code extension release 1.84.0

AttackIncidentAmazon Web Services

Jul 9, 2025

JFrog finds critical OS command injection in mcp-remote when connecting to untrusted MCP servers

AttackVulnerability disclosureJFrog

Apr 1, 2025

Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

AttackVulnerability disclosureInvariant Labs

Defense research

Aug 19, 2025

MCPTox benchmarks tool poisoning across 45 live MCP servers and 20 LLM agents

DefenseBenchmarkarXiv

Mar 30, 2025

Survey maps Model Context Protocol landscape, server lifecycle and security risks

DefensePaperarXiv

Findings

Jul 23, 2025

Malicious or compromised agent extensions, MCP servers, and skills have been published to public registries and used against real users.

Corroboratedobserved4 evidence records

Apr 1, 2025

Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.

Corroboratedmeasured4 evidence records

Apr 1, 2025

Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.

Corroboratedmeasured2 evidence records

Capability, policy, and guidance

September 2026

ENISA Threat Landscape 2026 expects more kill-chain phases enabled by AI in 2026

PolicyGuidanceENISA

May 22, 2025

NSA, CISA and FBI with allies publish AI Data Security best practices

PolicyGuidanceNSA Artificial Intelligence Security Center, CISA, FBI

Nov 27, 2023

UK NCSC and US CISA publish multinational Guidelines for Secure AI System Development

PolicyGuidanceUK National Cyber Security Centre, CISA

Attacks and incidents

Defense research

Findings

Capability, policy, and guidance

Related research openings