Week of Sep 22–28, 2025

A package impersonating a Postmark email MCP server was published to npm and, after 15 clean versions, version 1.0.16 (2025-09-17) added code that blind-copied all emails sent through it to the publisher. Postmark stated it had never published an MCP server on npm; Koi Security found it, and the package was deleted after about 1,643 downloads.

Noma Security reports that instructions submitted through a public Web-to-Lead form could later steer Agentforce to send CRM data to a domain on Salesforce's allowlist that had expired and could be re-registered. Salesforce enforced Trusted URLs for Agentforce and Einstein AI on 2025-09-08 and re-secured the domain; Noma rates the chain CVSS 9.4.

CyberSOCEval adds two open-source SOC benchmarks to CyberSecEval 4: malware analysis questions built from sandbox detonation reports, and threat intelligence reasoning over unstructured reports. The authors find larger, newer models do better, reasoning models gain less than in coding and math, and current models are far from saturating the tasks.

Google DeepMind's Frontier Safety Framework version 3.0 adds a harmful manipulation CCL and expands misalignment and internal-deployment provisions. Its cyber domain keeps a single CCL, Cyber uplift level 1, for models providing sufficient uplift with high-impact cyber attacks to add expected harm at severe scale, paired with Security Level 2; the framework reasons that automated cyber-defense and social adaptation make higher security levels likely unwarranted.