https://agentic-cyber-explorer.pages.dev/topics/tool-and-mcp-security/ New records, findings, and answers on tools & mcp, from Fide AI's Agentic Cyber Explorer. en Fide AI. Data licensed CC BY 4.0. Sat, 26 Sep 2026 12:00:00 GMT https://agentic-cyber-explorer.pages.dev/findings/malicious-agent-packages-in-the-wild/ correction:malicious-agent-packages-in-the-wild:2026-09-25:corroborated Fri, 25 Sep 2026 12:00:00 GMT Correction Correction: the Nx compromise was a malicious build-tool package that invoked installed AI CLIs, not a malicious agent extension, MCP server or skill. Corroboration rests on the malicious postmark-mcp server (found by Koi Security, disclosed by Postmark), independent of the Amazon Q incident. https://agentic-cyber-explorer.pages.dev/events/asd-agentic-ai-harnesses-guidance-2026/ event:asd-agentic-ai-harnesses-guidance-2026 Fri, 11 Sep 2026 12:00:00 GMT Policy & standards The Australian Signals Directorate's ACSC published guidance on agentic AI harnesses, the software layer that connects a model with organisational data, tools and systems and manages context, memory, tool access and execution privileges. According to coverage, it says some risks, including prompt injection, cannot be addressed within the model alone, that no harness is inherently secure, and recommends least privilege, human oversight for high-impact actions, audit logging and validating agent outputs before execution. It moves government guidance from model behavior to the tool, memory and permission layer where most agent compromises occur. https://agentic-cyber-explorer.pages.dev/events/deltacert-agent-selective-recertification-2026/ event:deltacert-agent-selective-recertification-2026 Wed, 12 Aug 2026 12:00:00 GMT Defense & research An author project page describes DeltaCert-Agent, which maps configuration changes in tool-using LLM agents to affected security claims and reruns only scoped tests plus sentinel checks, escalating to full recertification when impact cannot be bounded. The author reports 75.02% regression-detection recall versus 55.01% for equal-budget random selection while running 61.35% fewer tests, using four small locally hosted models. Continuous agent changes make full security re-evaluation costly, and this work tests a cheaper recertification strategy. https://agentic-cyber-explorer.pages.dev/events/nsa-mcp-security-design-considerations-2026/ event:nsa-mcp-security-design-considerations-2026 Wed, 20 May 2026 12:00:00 GMT Policy & standards The NSA's Artificial Intelligence Security Center released a cybersecurity information sheet on the Model Context Protocol, warning that adoption has outpaced safeguards. It recommends vetting MCP tools, least-privilege access and isolation, validating outputs where one model's output feeds another, and detailed logging integrated with security monitoring, and it lists poor approval workflows among the risks. It is signals-intelligence agency guidance specific to the protocol many agents use to reach tools and data. https://agentic-cyber-explorer.pages.dev/events/microsoft-semantic-kernel-prompt-to-rce-2026/ event:microsoft-semantic-kernel-prompt-to-rce-2026 Thu, 07 May 2026 12:00:00 GMT Attacks & incidents Microsoft's Defender security research team described two vulnerabilities in its open-source Semantic Kernel agent framework in which attacker-influenced prompts could reach code execution on the host. One involved unsafe string interpolation in an in-memory vector store filter; the other exposed a code-execution plugin function that allowed arbitrary file writes outside its sandbox. Both were fixed in updated SDK releases. Shows that agent framework plumbing, not just the model, can turn a prompt injection into host compromise. https://agentic-cyber-explorer.pages.dev/events/ox-mcp-stdio-supply-chain-advisory-2026/ event:ox-mcp-stdio-supply-chain-advisory-2026 Wed, 15 Apr 2026 12:00:00 GMT Attacks & incidents OX Security reports that MCP's STDIO transport turns configuration into OS command execution, and that frameworks exposing that configuration to users, networks or prompt injection inherited remote code execution, with 12+ CVEs across projects such as LangFlow, LiteLLM, Flowise and Windsurf. The Hacker News reports Anthropic characterized the protocol behavior as expected and did not change the reference design. It traces a single protocol design choice into a cluster of downstream agent-platform CVEs. https://agentic-cyber-explorer.pages.dev/events/nginx-ui-mcpwn-cve-2026-33032-2026/ event:nginx-ui-mcpwn-cve-2026-33032-2026 Wed, 15 Apr 2026 12:00:00 GMT Attacks & incidents Pluto Security found that nginx-ui's MCP integration left a message endpoint effectively unauthenticated under default settings, letting anyone reach its administrative MCP tools and take over the web server. The flaw (CVSS 9.8) was fixed in version 2.3.4 on 2026-03-15, and Recorded Future listed it among actively exploited vulnerabilities in March 2026. It is an early case of an MCP interface itself being exploited in the wild as a server-takeover path. https://agentic-cyber-explorer.pages.dev/events/checkpoint-claude-code-project-files-cves-2026/ event:checkpoint-claude-code-project-files-cves-2026 Wed, 25 Feb 2026 12:00:00 GMT Attacks & incidents Check Point Research found that a cloned repository's Claude Code configuration could run hooks, start MCP servers before the user approved them, and redirect API traffic so the user's Anthropic API key was sent to an attacker (CVE-2025-59536, CVE-2026-21852). Anthropic fixed the issues between August and December 2025 by deferring execution and API calls until after the trust dialog. Repository-level agent configuration is executable attack surface that triggers when a developer simply opens a project. https://agentic-cyber-explorer.pages.dev/events/nist-ai-agent-standards-initiative-2026/ event:nist-ai-agent-standards-initiative-2026 Tue, 17 Feb 2026 12:00:00 GMT Policy & standards CAISI, with NIST's Information Technology Laboratory, launched an initiative to support industry-led standards and open protocols for AI agents and research on agent security and identity. Announced deliverables included the agent security RFI, an AI agent identity and authorization concept paper with comments due April 2, 2026, and sector listening sessions from April 2026. It is the main US government program for agent identity, authorization and security standards. https://agentic-cyber-explorer.pages.dev/events/cyata-anthropic-git-mcp-server-cves-2026/ event:cyata-anthropic-git-mcp-server-cves-2026 Tue, 20 Jan 2026 12:00:00 GMT Attacks & incidents Cyata found path-validation and argument-injection flaws in Anthropic's mcp-server-git (CVE-2025-68143, -68144, -68145) that, chained with the Filesystem MCP server, allowed file access and code execution by anyone able to influence what the assistant reads. Anthropic removed the git_init tool and added path validation in fixed releases. Even the protocol author's reference servers carried injection-reachable code execution paths. https://agentic-cyber-explorer.pages.dev/events/owasp-top-10-agentic-applications-2025/ event:owasp-top-10-agentic-applications-2025 Tue, 09 Dec 2025 12:00:00 GMT Policy & standards The OWASP GenAI Security Project released its Top 10 for Agentic Applications, a list of ten risk categories specific to agents that plan, hold memory, call tools and act with delegated authority. The release came with an updated Agentic Threats and Mitigations taxonomy (v1.1) and a capture-the-flag practice platform. It is OWASP's agent-specific risk list, complementing its Top 10 for LLM applications. https://agentic-cyber-explorer.pages.dev/events/mitre-atlas-v5-agent-techniques-2025/ event:mitre-atlas-v5-agent-techniques-2025 Tue, 30 Sep 2025 12:00:00 GMT Policy & standards MITRE ATLAS version 5.0.0 added a set of techniques for attacks on AI agents, including agent context poisoning of memory and threads, modifying agent configuration, credential theft from agent configuration, and exfiltration via agent tool invocation, and renamed LLM Plugin Compromise to AI Agent Tool Invocation. Version 5.1.0 (November 6, 2025) added agent-specific mitigations such as tool permission configuration and human-in-the-loop for agent actions. ATLAS is the ATT&CK-style reference defenders use to map detections, and these versions made agent compromise a first-class part of it. https://agentic-cyber-explorer.pages.dev/events/postmark-mcp-malicious-npm-2025/ event:postmark-mcp-malicious-npm-2025 Thu, 25 Sep 2025 12:00:00 GMT Attacks & incidents A package impersonating a Postmark email MCP server was published to npm and, after 15 clean versions, version 1.0.16 (2025-09-17) added code that blind-copied all emails sent through it to the publisher. Postmark stated it had never published an MCP server on npm; Koi Security found it, and the package was deleted after about 1,643 downloads. Koi Security, which found it, called it the first malicious MCP server seen in the wild, showing that MCP packages are already a live supply-chain target. https://agentic-cyber-explorer.pages.dev/events/mcptox-tool-poisoning-benchmark-2025/ event:mcptox-tool-poisoning-benchmark-2025 Tue, 19 Aug 2025 12:00:00 GMT Defense & research Wang and colleagues build MCPTox from 45 real MCP servers and 353 authentic tools, generating 1,312 malicious test cases across 10 risk categories. Across 20 LLM agents the highest attack success rate was 72.8% (o1-mini), and refusals were rare, with the highest refusal rate under 3% (Claude 3.7 Sonnet). It quantifies tool poisoning on real servers and suggests stronger instruction-followers can be more exposed. https://agentic-cyber-explorer.pages.dev/events/safebreach-gemini-calendar-invite-promptware-2025/ event:safebreach-gemini-calendar-invite-promptware-2025 Wed, 06 Aug 2025 12:00:00 GMT Attacks & incidents SafeBreach researchers showed that instructions in calendar invite titles or email subjects, retrieved when a user asked Gemini about their schedule, could trigger tool misuse such as deleting events, opening URLs, exfiltrating email subjects, and controlling connected smart-home devices. They disclosed to Google in February 2025, and Google deployed layered mitigations including confirmations, URL handling policies and injection classifiers. It extended assistant prompt injection from data leaks to actions on physical devices and apps. https://agentic-cyber-explorer.pages.dev/events/zenity-agentflayer-zero-click-2025/ event:zenity-agentflayer-zero-click-2025 Wed, 06 Aug 2025 12:00:00 GMT Attacks & incidents Zenity Labs presented at Black Hat USA 2025 a set of zero- and one-click prompt injection chains, including a shared document causing ChatGPT Connectors to search a victim's Google Drive for API keys and leak them through image rendering, and a poisoned email steering a Copilot Studio agent to disclose CRM data. CSO Online reports that OpenAI and Microsoft deployed fixes for the specific demonstrated techniques. Connectors give injected instructions the reach of every service the user has linked. https://agentic-cyber-explorer.pages.dev/events/cursor-mcpoison-cve-2025-54136-2025/ event:cursor-mcpoison-cve-2025-54136-2025 Tue, 05 Aug 2025 12:00:00 GMT Attacks & incidents Check Point Research found that Cursor bound MCP approval to a configuration's name rather than its contents, so a collaborator with repository write access could swap an approved harmless command for a malicious one that ran on each project open. Cursor 1.3, released 2025-07-29, prompts for approval on any MCP configuration change. Approval that does not follow content changes becomes a persistence mechanism in shared repositories. https://agentic-cyber-explorer.pages.dev/events/cursor-curxecute-cve-2025-54135-2025/ event:cursor-curxecute-cve-2025-54135-2025 Fri, 01 Aug 2025 12:00:00 GMT Attacks & incidents Cursor's advisory states that the agent could create new workspace dotfiles without approval, so injected instructions arriving via an external MCP source could write an MCP configuration that launched attacker commands. Aim Security researchers reported it; it is rated CVSS 8.5 and fixed in Cursor 1.3.9. An agent that can edit its own tool configuration can convert a prompt injection into code execution. https://agentic-cyber-explorer.pages.dev/events/mcp-remote-cve-2025-6514-2025/ event:mcp-remote-cve-2025-6514-2025 Wed, 09 Jul 2025 12:00:00 GMT Attacks & incidents JFrog reported CVE-2025-6514 (CVSS 9.6) in mcp-remote, a proxy used by MCP clients to reach remote servers, where a malicious server could supply a crafted OAuth authorization URL that led to command execution on the client machine. Versions 0.0.5 to 0.1.15 are affected and 0.1.16 fixes the issue. Connecting an agent client to an untrusted MCP server could compromise the developer host, not just the conversation. https://agentic-cyber-explorer.pages.dev/events/supabase-mcp-sql-leak-2025/ event:supabase-mcp-sql-leak-2025 Tue, 08 Jul 2025 12:00:00 GMT Attacks & incidents General Analysis demonstrated a Cursor agent connected to Supabase MCP with a service-role key, which bypasses row-level security, following instructions in a customer support ticket to read a secrets table and write the contents back into the attacker-visible ticket. Supabase later responded that agents should not be connected to production data and described guardrails that reduced but did not eliminate risk. It is a clean example of private data, untrusted input and an outbound channel combining in one agent session. https://agentic-cyber-explorer.pages.dev/events/mcp-spec-authorization-update-2025/ event:mcp-spec-authorization-update-2025 Wed, 18 Jun 2025 12:00:00 GMT Policy & standards The 2025-06-18 revision of the Model Context Protocol specification classifies MCP servers as OAuth resource servers with protected resource metadata, and requires clients to implement RFC 8707 resource indicators so malicious servers cannot obtain tokens meant for others. It also clarifies authorization security considerations and adds a security best practices page. It is the main protocol-level change addressing token misuse between MCP clients and servers. https://agentic-cyber-explorer.pages.dev/events/design-patterns-securing-agents-prompt-injection-2025/ event:design-patterns-securing-agents-prompt-injection-2025 Tue, 10 Jun 2025 12:00:00 GMT Defense & research Authors from Invariant Labs, IBM, ETH Zurich, Swisscom, Google, Microsoft and others propose six design patterns that limit what injected text can do, such as action-selector, plan-then-execute, dual LLM, LLM map-reduce, code-then-execute and context minimization. They discuss utility and security trade-offs and illustrate the patterns with ten application case studies. It gives builders architecture-level mitigations that do not depend on the model detecting injections. https://agentic-cyber-explorer.pages.dev/events/invariant-github-mcp-toxic-agent-flow-2025/ event:invariant-github-mcp-toxic-agent-flow-2025 Mon, 26 May 2025 12:00:00 GMT Attacks & incidents Invariant Labs demonstrated that a malicious issue in a public repository could lead an agent using the GitHub MCP server to read the user's private repositories and publish the data in a public pull request. The firm tested with Claude 4 Opus and argues there is no server-side patch because the flaw lies in agent permissions, recommending per-session repository scoping and runtime monitoring. It is a canonical 'toxic agent flow' where legitimate tools and a broad token combine into a data leak. https://agentic-cyber-explorer.pages.dev/events/invariant-mcp-tool-poisoning-2025/ event:invariant-mcp-tool-poisoning-2025 Tue, 01 Apr 2025 12:00:00 GMT Attacks & incidents Invariant Labs describes tool poisoning, in which instructions hidden in an MCP tool's description are visible to the model but not to the user, and shows proof-of-concept exfiltration of local files through an MCP client. It also describes rug pulls, where a server changes tool descriptions after approval, and shadowing, where one server's descriptions alter how the agent uses another server's tools. Recommended mitigations include showing full tool descriptions, pinning tool versions with checksums, and cross-server isolation. It named the core MCP attack classes that later benchmarks, the OWASP MCP list and client mitigations address. https://agentic-cyber-explorer.pages.dev/events/mcp-security-landscape-survey-2025/ event:mcp-security-landscape-survey-2025 Sun, 30 Mar 2025 12:00:00 GMT Defense & research Hou, Zhao, Wang and Wang survey MCP's architecture, industry adoption and server lifecycle. The first version (March 2025) split the lifecycle into creation, operation and update phases and discussed security risks in each. A revision in October 2025 expanded this to four phases with 16 activities and a threat taxonomy of four attacker types and 16 threat scenarios, with case studies and per-phase safeguards. It was an early systematic threat model for MCP as tool connectors spread through agent products. https://agentic-cyber-explorer.pages.dev/events/owasp-agentic-ai-threats-and-mitigations-2025/ event:owasp-agentic-ai-threats-and-mitigations-2025 Mon, 17 Feb 2025 12:00:00 GMT Policy & standards OWASP's Agentic Security Initiative published a threat-model-based reference of emerging threats to LLM-powered autonomous agents and corresponding mitigations. It became the taxonomy underpinning the later OWASP Top 10 for Agentic Applications, which shipped with an updated v1.1 of this guide. It is a community taxonomy built specifically for agents rather than chat applications. https://agentic-cyber-explorer.pages.dev/events/owasp-llm-top-10-2025-edition-2024/ event:owasp-llm-top-10-2025-edition-2024 Sun, 17 Nov 2024 12:00:00 GMT Policy & standards The OWASP GenAI Security Project released the 2025 edition of its Top 10 for LLM Applications. Prompt injection remains the top risk, and the list includes Excessive Agency (LLM06) covering systems granted the ability to call functions and take actions, along with system prompt leakage and vector and embedding weaknesses. It is OWASP's practitioner checklist for LLM application risk and the direct predecessor of its agent-specific lists. https://agentic-cyber-explorer.pages.dev/events/agent-security-bench-asb-2024/ event:agent-security-bench-asb-2024 Thu, 03 Oct 2024 12:00:00 GMT Defense & research Zhang and colleagues release Agent Security Bench (ASB), covering 10 scenarios, 10 agents and over 400 tools, and benchmark attack and defense methods, including prompt injection, memory poisoning and a new backdoor attack, across 13 LLMs (23 methods in the first version, 27 in the ICLR 2025 version). They report a highest average attack success rate of 84.30% and limited effectiveness of current defenses. The paper was accepted at ICLR 2025. ASB broadens agent security benchmarking beyond indirect injection to memory poisoning and backdoors in the agent loop. https://agentic-cyber-explorer.pages.dev/events/agentdojo-benchmark-2024/ event:agentdojo-benchmark-2024 Wed, 19 Jun 2024 12:00:00 GMT Defense & research Debenedetti and colleagues (ETH Zurich, Invariant Labs) release AgentDojo, a dynamic environment with 97 realistic user tasks across workspace, banking, travel and Slack suites and 629 security test cases. It measures both utility and targeted attack success, and reports that existing attacks break some security properties but not all. It became the standard testbed used by CaMeL, US AISI/CAISI, LlamaFirewall and adaptive-attack studies. Most later agent prompt-injection defense claims, and the adaptive attacks against them, are reported on AgentDojo. https://agentic-cyber-explorer.pages.dev/events/injecagent-benchmark-2024/ event:injecagent-benchmark-2024 Tue, 05 Mar 2024 12:00:00 GMT Defense & research Zhan, Liang, Ying and Kang release InjecAgent, a benchmark of 1,054 test cases spanning 17 user tools and 62 attacker tools, covering direct harm to users and exfiltration of private data. They evaluate 30 LLM agents and find a ReAct-prompted GPT-4 agent vulnerable in about a quarter of cases. It was an early systematic measurement showing that tool-using agents follow instructions embedded in tool outputs. https://agentic-cyber-explorer.pages.dev/events/google-bard-extensions-exfiltration-2023/ event:google-bard-extensions-exfiltration-2023 Fri, 03 Nov 2023 12:00:00 GMT Attacks & incidents Researcher Johann Rehberger reported that a shared Google Doc carrying hidden instructions could cause Bard, with Workspace extensions enabled, to render images whose URLs carried conversation data to an attacker endpoint. The researcher reports disclosure on 2023-09-19 and a Google fix on 2023-10-19. An early case showing that connecting an assistant to email and documents turns shared files into an exfiltration channel.