AI Sec Watch

The @prompty/core Nunjucks renderer (a template engine for the Prompty framework) had a critical vulnerability where it could execute arbitrary JavaScript code when processing untrusted template files. An attacker could use special template syntax to access internal JavaScript properties and run malicious code on the server.

Suna versions before 0.9.102 have a broken access control vulnerability (a flaw where the system fails to properly verify who should be allowed to access data) in its message queue API (the interface for managing task queues). Authenticated attackers can exploit missing ownership checks to read, delete, or manipulate message queues belonging to other users, including injecting malicious prompts into another user's AI agent session to execute commands with that user's permissions.

Microsoft Kiota, a tool that generates AI plugin manifests from API descriptions, has a path traversal vulnerability (CWE-22, a security flaw where attackers access files outside intended directories) in how it validates file references. An attacker controlling the API description can use percent-encoding (a way of representing special characters as %XX codes) to bypass safety checks and reference files outside the plugin package, potentially exposing sensitive files like `/etc/passwd`. The initial fix in v1.32.5 failed because it checked the encoded string before decoding it, allowing attackers to hide traversal patterns in encoded form.

Jan (a software tool) versions up to 0.8.4 have a CORS misconfiguration vulnerability (a security flaw where cross-origin requests, which normally have restrictions, are incorrectly allowed) in its local API server. Attackers on the same network can bypass security restrictions by exploiting how the server handles trusted hosts, allowing them to use the API without authentication to run AI tasks, see what models are available, and access responses they shouldn't normally see.

BlenderMCP before commit 30a3308 has a path traversal vulnerability (a security flaw where attackers can access files outside intended directories) in its download_polyhaven_asset method. Attackers using MITM attacks (interception of network traffic between two parties) or prompt injection (tricking an AI by hiding instructions in its input) can inject malicious file paths like '../../.bashrc' to overwrite sensitive files and gain persistent code execution (the ability to run commands that stay active even after restarting).

AI coding agents sometimes generate fake names for software libraries, domains, or repositories that sound real but don't actually exist, a flaw called hallucination (when an AI generates plausible-sounding but incorrect information). Attackers can predict these fake names in advance, register them, and trap developers into using malicious code when their AI agents automatically fetch these nonexistent resources. This attack, known by three names—slopsquatting, phantom squatting, and hallusquatting—exploits the same core problem: systems trust outputs from AI models without verifying they actually exist.

OpenAI announced GPT-2 (a language model, or AI trained to predict and generate text) in 2019 but refused to release it publicly, claiming safety risks were too high. The author argues this announcement was primarily a marketing strategy to emphasize AI's power to investors rather than a genuine safety precaution, since the risks were likely overstated and the announcement prevented researchers from actually studying the model.

OpenAI's ChatGPT Workspace Agents had a critical vulnerability called AgentForger that allowed attackers to use a single phishing link to secretly create and deploy a rogue AI agent inside a victim's organization. The flaw exploited cross-site request forgery (CSRF, a type of attack where a malicious website tricks your browser into making unwanted requests) by embedding malicious instructions directly in a URL that would automatically execute when a logged-in employee clicked it, giving the attacker's agent access to the victim's connected apps like email and cloud storage without requiring approval.

AI agent security requires moving beyond just finding and listing agents to actively enforcing what they can do, since agents are dynamic systems that reason, plan, and take actions without human oversight. The challenge is that traditional access control models assume predictable workflows, but AI agents operate based on goals and adapt their behavior contextually, making static permission systems insufficient. Security teams must understand an agent's intent and purpose to properly enforce least privilege (limiting access to only what's necessary), rather than stopping at visibility alone.