Atlas/APIs · connectors · MCP

Tools & MCP

The actions an agent can take and the servers that provide them.

28 attacks and incidents29 defense records10 findings3 measured defense findings

Attacks and incidents

Jul 1, 2026

DuneSlide: two Cursor flaws let prompt injection escape the agent sandbox (CVE-2026-50548/50549)

AttackVulnerability disclosureCato Networks, Cursor

May 7, 2026

Microsoft details two Semantic Kernel flaws that let prompt injection escalate to code execution

AttackVulnerability disclosureMicrosoft

Apr 15, 2026

OX Security advisory: MCP STDIO configuration enables command execution across agent frameworks

AttackVulnerability disclosureOX Security, Anthropic

Apr 15, 2026

MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)

AttackVulnerability disclosurePluto Security, Recorded Future, nginx-ui project

Feb 2, 2026

VirusTotal finds hundreds of malicious OpenClaw agent skills distributing stealers and backdoors

AttackMalwareVirusTotal, OpenClaw

Jan 20, 2026

Cyata discloses three flaws in Anthropic's reference Git MCP server reachable via prompt injection

AttackVulnerability disclosureCyata, Anthropic

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

AttackVulnerability disclosureMiggo Security, Google

Nov 19, 2025

AppOmni shows second-order prompt injection recruiting privileged ServiceNow Now Assist agents

AttackVulnerability disclosureAppOmni, ServiceNow

Oct 8, 2025

CamoLeak: hidden PR comments let GitHub Copilot Chat leak private code via image proxy

AttackVulnerability disclosureLegit Security, GitHub

Sep 25, 2025

Malicious postmark-mcp npm package quietly copied every sent email to an outside address

AttackIncidentKoi Security, Postmark

Sep 25, 2025

ForcedLeak: Web-to-Lead prompt injection could make Salesforce Agentforce leak CRM data

AttackVulnerability disclosureNoma Security, Salesforce

Aug 26, 2025

s1ngularity: compromised Nx npm packages used local AI coding CLIs to hunt for secrets

AttackIncidentNx

Aug 20, 2025

Brave discloses indirect prompt injection in Perplexity Comet agentic browser

AttackVulnerability disclosureBrave, Perplexity

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Aug 5, 2025

MCPoison: Cursor trusted approved MCP configs even after their commands changed (CVE-2025-54136)

AttackVulnerability disclosureCheck Point Research, Cursor

Aug 1, 2025

CurXecute: prompt injection could make Cursor create MCP config and run commands (CVE-2025-54135)

AttackVulnerability disclosureAim Security, Cursor

Jul 23, 2025

Malicious agent instruction merged into Amazon Q Developer VS Code extension release 1.84.0

AttackIncidentAmazon Web Services

Jul 20, 2025

Replit coding agent deletes a user's production database during a declared code freeze

AttackIncidentReplit, Jason Lemkin (SaaStr)

Jul 9, 2025

JFrog finds critical OS command injection in mcp-remote when connecting to untrusted MCP servers

AttackVulnerability disclosureJFrog

Jul 8, 2025

General Analysis shows Supabase MCP with service-role access leaking tables via a support ticket

AttackVulnerability disclosureGeneral Analysis, Supabase

Jun 11, 2025

EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)

AttackVulnerability disclosureAim Security, Microsoft

May 26, 2025

Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

AttackVulnerability disclosureInvariant Labs, GitHub

May 22, 2025

Legit Security finds GitLab Duo prompt injection that could leak private source code

AttackVulnerability disclosureLegit Security, GitLab

Apr 1, 2025

Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

AttackVulnerability disclosureInvariant Labs

Aug 20, 2024

PromptArmor reports Slack AI can be steered to leak private-channel data via public-channel messages

AttackVulnerability disclosurePromptArmor, Salesforce

Nov 3, 2023

Google Bard Workspace extensions could be prompt-injected to leak chat data via rendered images

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Google

Feb 23, 2023

Researchers define indirect prompt injection against LLM-integrated apps including Bing Chat

AttackPaperCISPA Helmholtz Center for Information Security, sequire technology

Defense research

Sep 24, 2026

Google's PageBreak agent finds over 500 XSS bugs in its own web apps using deterministic validators

DefenseTool releaseGoogle

Aug 12, 2026

DeltaCert-Agent proposes selective security retesting of LLM agents after configuration changes

DefensePaperAuthor project page (Anubha Parashar)

Mar 16, 2026

CAISI, UK AISI and Gray Swan competition finds concealed indirect injections succeed on all 13 frontier models

DefensePaperGray Swan AI, US Center for AI Standards and Innovation, UK AI Security Institute

Mar 13, 2026

Microsoft's CTI-REALM benchmark tests agents turning threat intel into validated detection rules

DefenseBenchmarkMicrosoft

Mar 9, 2026

OSS-CRS makes AIxCC reasoning systems runnable locally; OpenSSF adopts it as a sandbox project

DefenseTool releaseGeorgia Institute of Technology, Microsoft, Team Atlanta

Feb 13, 2026

OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration

DefenseTool releaseOpenAI

Feb 5, 2026

Claude Opus 4.6 system card reports prompt injection rates by surface, attempts and safeguards

DefenseSystem cardAnthropic, Gray Swan AI

Jan 28, 2026

OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

DefenseTool releaseOpenAI

Jan 8, 2026

PNNL uses a Claude-based agent to speed adversary emulation against a water treatment plant model

DefensePaperAnthropic, Pacific Northwest National Laboratory, CISA

Oct 31, 2025

Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

DefenseFrameworkMeta

Oct 6, 2025

Google DeepMind introduces CodeMender, an agent that patches and hardens code, with 72 upstreamed fixes

DefenseTool releaseGoogle DeepMind, Google

Aug 25, 2025

Anthropic publishes prompt injection red-team rates for its Claude in Chrome browser agent pilot

DefenseEvaluation reportAnthropic

Aug 19, 2025

MCPTox benchmarks tool poisoning across 45 live MCP servers and 20 LLM agents

DefenseBenchmarkarXiv

Aug 5, 2025

Microsoft's Project Ire agent autonomously reverse engineers and classifies malware

DefenseTool releaseMicrosoft

Jul 28, 2025

Large public competition finds all 22 tested frontier agents vulnerable to prompt injection

DefenseBenchmarkGray Swan AI, UK AI Security Institute

Jul 14, 2025

Microsoft's ExCyTIn-Bench evaluates LLM agents on multi-step threat investigation over Sentinel logs

DefenseBenchmarkMicrosoft

Jun 17, 2025

SHADE-Arena measures whether agents can pursue hidden harmful side tasks without being caught by monitors

DefenseBenchmarkAnthropic, Redwood Research

Jun 16, 2025

Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration

DefenseFrameworkSimon Willison

Jun 11, 2025

LLMail-Inject releases data from an adaptive prompt injection challenge against an email agent

DefenseDatasetMicrosoft

Jun 10, 2025

Researchers from labs and industry publish design patterns for provably injection-resistant agents

DefenseFrameworkInvariant Labs, IBM, ETH Zurich

May 20, 2025

Google DeepMind reports lessons from continuously attacking Gemini with adaptive prompt injections

DefensePaperGoogle DeepMind

Apr 4, 2025

Google announces Sec-Gemini v1, an experimental model for security operations workflows

DefenseTool releaseGoogle

Mar 30, 2025

Survey maps Model Context Protocol landscape, server lifecycle and security risks

DefensePaperarXiv

Mar 24, 2025

Google DeepMind's CaMeL defeats prompt injections by design with capability-based control and data flow

DefensePaperGoogle DeepMind, Google, ETH Zurich

Mar 24, 2025

Microsoft announces Security Copilot agents for phishing triage, alert triage and remediation

DefenseTool releaseMicrosoft, OneTrust, Aviatrix

Jan 17, 2025

US AISI (later CAISI) shows red-team attacks and repeated attempts raise agent hijacking rates on AgentDojo

DefenseEvaluation reportNIST, US Center for AI Standards and Innovation, UK AI Security Institute

Oct 3, 2024

Agent Security Bench formalizes attacks and defenses across ten LLM agent scenarios

DefenseBenchmarkarXiv

Jun 19, 2024

AgentDojo: an extensible environment for prompt injection attacks and defenses on LLM agents

DefenseBenchmarkETH Zurich, Invariant Labs

Mar 5, 2024

InjecAgent benchmarks indirect prompt injection against tool-integrated LLM agents

DefenseBenchmarkUniversity of Illinois Urbana-Champaign

Findings

Mar 24, 2025

Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.

Revalidatemeasured1 evidence record1 linked finding

May 26, 2025

An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.

Corroboratedmeasured5 evidence records

Jun 10, 2025

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.

Corroboratedargued5 evidence records

Apr 15, 2026

An MCP endpoint exposed without authentication has been reported as exploited in the wild.

Reportedreported1 evidence record

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured5 evidence records

Jul 23, 2025

Malicious or compromised agent extensions, MCP servers, and skills have been published to public registries and used against real users.

Corroboratedobserved4 evidence records

Apr 1, 2025

Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.

Corroboratedmeasured4 evidence records

Apr 1, 2025

Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.

Corroboratedmeasured2 evidence records

Mar 5, 2024

Undefended tool-using agents follow injected instructions in a substantial share of benchmark cases.

Qualifiedmeasured4 evidence records1 linked finding

Nov 3, 2023

Content sent by outsiders, such as email, calendar invites, shared documents, or web forms, can trigger agent actions without the user clicking anything.

Corroboratedmeasured6 evidence records

Capability, policy, and guidance

Sep 11, 2026

Australia's ASD issues guidance on securing agentic AI harnesses, the layer around the model

PolicyGuidanceAustralian Signals Directorate (ACSC)

Aug 31, 2026

MITRE ATLAS adds autonomous attack techniques and case studies of agent-driven intrusions

PolicyStandardMITRE

Aug 3, 2026

OWASP releases 2026 edition of the GenAI LLM Top 10 mapped to the agentic list and ATLAS

PolicyStandardOWASP GenAI Security Project

May 20, 2026

NSA AI Security Center publishes security design considerations for Model Context Protocol deployments

PolicyGuidanceNSA Artificial Intelligence Security Center

May 1, 2026

CISA, ASD's ACSC and international partners publish joint guidance on careful adoption of agentic AI

PolicyGuidanceCISA, NSA, Australian Signals Directorate (ACSC)

Feb 17, 2026

NIST CAISI launches AI Agent Standards Initiative on interoperability, security and identity

PolicyProgramUS Center for AI Standards and Innovation, NIST, National Science Foundation

Jan 8, 2026

NIST CAISI requests public input on security considerations for AI agent systems

PolicyProgramUS Center for AI Standards and Innovation, NIST

Dec 9, 2025

OWASP publishes Top 10 for Agentic Applications (ASI01-ASI10)

PolicyStandardOWASP GenAI Security Project

Dec 8, 2025

UK NCSC says prompt injection may never be fully mitigated and urges impact reduction

PolicyGuidanceUK National Cyber Security Centre

Dec 3, 2025

CISA, ASD and partners issue principles for securely integrating AI, including agents, into OT

PolicyGuidanceCISA, Australian Signals Directorate (ACSC), NSA Artificial Intelligence Security Center

Sep 30, 2025

MITRE ATLAS 5.0 adds AI agent techniques such as context poisoning and exfiltration via tool invocation

PolicyStandardMITRE

Aug 14, 2025

NIST proposes SP 800-53 control overlays for securing AI, including single- and multi-agent systems

PolicyStandardNIST

Jun 18, 2025

MCP specification revision classifies servers as OAuth resource servers and adds security best practices

PolicyStandardModel Context Protocol project, Anthropic

Mar 24, 2025

NIST AI 100-2 E2025 taxonomy adds a dedicated section on security of AI agents

PolicyStandardNIST, UK AI Security Institute, US Center for AI Standards and Innovation

Feb 17, 2025

OWASP Agentic Security Initiative releases Agentic AI Threats and Mitigations v1.0

PolicyFrameworkOWASP GenAI Security Project

Feb 6, 2025

Cloud Security Alliance publishes MAESTRO seven-layer threat modeling framework for agentic AI

PolicyFrameworkCloud Security Alliance

Nov 17, 2024

OWASP releases 2025 Top 10 for LLM Applications with prompt injection first and Excessive Agency

PolicyStandardOWASP GenAI Security Project

Attacks and incidents

Defense research

Findings

Capability, policy, and guidance

Related research openings