Threat Feed

Researchers show that a malicious MCP server can embed adversarial instructions inside a tool's description metadata, which the host model reads as trusted context. Connected agents can be coerced into exfiltrating secrets or invoking other tools without the user ever seeing the injected text.

An autonomous coding agent processing a public issue tracker followed instructions hidden in a comment and pushed environment variables to an attacker-controlled endpoint. The injection succeeded because the agent treated fetched web content with the same trust as operator commands.

A scan of public repositories surfaced thousands of long-lived API keys and database credentials stored directly in .mcp.json and .env files committed alongside agent configs. Several keys were still valid and mapped to over-scoped non-human identities.

A widely installed community MCP server shipped a minor update that added covert data-collection logic to a previously benign file tool. Because most deployments had auto-approval enabled, the malicious version propagated before maintainers pulled it.

A flaw in an MCP server's Server-Sent Events transport allows command execution when the service is bound to 0.0.0.0 without authentication. Internet-exposed instances were discoverable through routine scanning of /sse endpoints.

A gateway authorisation gap allowed an agent in one tenant to call tools registered by another tenant by replaying a stale session scope. The issue stemmed from trusting client-supplied scope claims instead of re-deriving them server-side.

Attackers who phished a single developer harvested OAuth refresh tokens cached by an agent connector and used them to maintain access for weeks. The long-lived tokens carried broad scopes and were not bound to the originating device.

Research demonstrates that individually harmless tools — a file reader, a templating helper, and an outbound HTTP fetch — can be chained by a manipulated agent to stage and exfiltrate sensitive data. No single tool was vulnerable in isolation.

An internal audit found dozens of unsanctioned AI coding extensions with broad filesystem and network permissions running on developer machines. Most were installed outside any approval process and had never been inventoried.

A study shows that gradually reframing a request across several conversational turns can elicit restricted agent behaviour that single-message filters block. The attack relies on intent drift rather than any banned keyword.

A misconfigured MCP server returned full stack traces and internal endpoint names in error responses to agents. While not directly exploitable, the leaked detail meaningfully lowers the cost of reconnaissance for an attacker.

Newly published guidance addresses how transparency, logging, and human-oversight duties apply to agents that can take consequential actions. Organisations deploying agents with system access are pointed toward auditable records and clear accountability.