Browse All

Different AI orchestration frameworks (software layers that control how AI agents plan steps, call tools, and act autonomously) have significantly different security vulnerabilities, with compromise rates ranging from 11.9% to 31.1% across CrewAI, LangChain, AutoGen, and SmolAgents when running the same underlying model and attacks. The framework's architectural choices, such as how strictly it validates tool calls (instructions to external systems) and manages memory, directly determine how easily an attacker can compromise the agent, creating a 2.6x difference in security risk based purely on which framework is chosen. This means selecting an orchestration framework is fundamentally a security decision, not just an engineering preference.

Flowise has a security flaw where the text-to-speech API endpoint doesn't require login and doesn't check if a chatflow is public before allowing access to it. An attacker who knows a chatflow's ID can trick the system into using that chatflow's stored API credentials (like OpenAI or ElevenLabs keys) to generate unlimited audio without permission, costing the real owner money.

NVIDIA Triton Inference Server for Linux has a vulnerability where an attacker could read, write, or modify files outside the intended model repository by providing a specially crafted path in the model name to the MLflow plugin. This could lead to denial of service (making a system unavailable) and information disclosure (leaking sensitive data).

Flowise has a security flaw where the `GET /api/v1/credentials/:id` endpoint returns sensitive data in plaintext to any authenticated user with permission to view credentials. While a redaction function masks fields marked as `type: 'password'`, many credential types store secrets (like database URLs with passwords, Google service account keys, and AWS access keys) in fields marked as `type: 'string'`, which are returned without any protection.

Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 have a bug where the admin interface displays URLField (a field for storing web addresses) values as clickable links without checking if the URLs are safe, allowing cross-site scripting (injecting malicious code that runs in a user's browser). The vulnerability only affects applications that store invalid URL data directly in the database without running validation checks, such as through bulk imports or direct database writes.

marimo (a Python notebook tool) before version 0.23.15 has a configuration injection vulnerability (a flaw where untrusted settings override safe ones) that lets notebook creators steal API keys. An attacker can hide a malicious base_url (the server address an AI request goes to) in notebook metadata, and when an operator opens the notebook and makes an AI request, marimo sends the operator's OpenAI API key to the attacker's server instead of the legitimate one, without requiring any code to actually run.

Flowise has an IDOR vulnerability (insecure direct object reference, where an attacker can access resources by guessing or changing object IDs) in its payment source endpoint that allows logged-in attackers to view other customers' sensitive data like email addresses and account balances by changing the customerId parameter in the URL. The flaw exists because the server checks only that a user is logged in, not whether they own the specific customer ID they're requesting.

The Contest Gallery WordPress plugin before version 30.0.7 has a security flaw where it fails to check permissions and nonces (security tokens that prevent unauthorized actions) in one of its functions, allowing any logged-in user, even those with minimal access (Subscriber role), to view all stored OpenAI prompt history on the website.

The Amazon MQ MCP Server (a tool for managing message brokers) has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) to trick the system into sending RabbitMQ broker credentials or OAuth access tokens (digital keys that grant access to accounts) to a fake endpoint they control. This affects versions before 2.0.24 and requires a broker hostname to be set up in the client context.

The gemini-bridge tool had a security flaw in its inline mode where the `consult_gemini_with_files` function could read any file on the system (like SSH keys or passwords) without checking if the file was in the allowed directory, then send that file contents to Google's Gemini service. An attacker using the tool, or an AI that has been tricked through prompt injection (hiding malicious instructions in text input), could exploit this to steal sensitive files that the server process can access.

The Dynatrace MCP server has a template injection vulnerability (a security flaw where attackers can embed code in input fields that gets executed) in its `create_workflow_for_notification` tool. When a caller provides values for team name, problem type, or channel, these are inserted directly into a Dynatrace Workflow definition that uses Jinja2 templating (a system that evaluates expressions in double braces like {{ }}). This allows an attacker to embed Jinja2 expressions that extract sensitive event data and send it to attacker-controlled locations, and the malicious workflow persists in the tenant even after the user session ends.

The @dynatrace-oss/dynatrace-mcp-server package has a DQL injection vulnerability (a type of code injection where attackers insert malicious DQL commands, which is Dynatrace Query Language used to query data). Several tools insert user-supplied parameters directly into DQL queries without escaping them, allowing attackers to break out of the intended query by injecting extra DQL pipeline stages (processing steps added to queries) and bypassing security restrictions like field limits and time-window bounds that are supposed to be read-only.

IBM Langflow OSS versions 1.0.0 through 1.8.4 have broken access control vulnerabilities in its file handling API (a set of tools that lets software request files). One endpoint allows anyone to download image files without logging in, while another endpoint lets logged-in users access files belonging to other users by guessing file identifiers, potentially exposing sensitive data across multiple users.

Claude, Anthropic's AI assistant, experienced a worldwide outage on July 29 where users received "529 Overloaded" error messages, meaning the servers couldn't handle the volume of requests. Anthropic identified the issue and began working on a fix, with recovery already starting across most models by the time of the update, though some users might still experience errors.

Pydantic AI (a Python framework for building AI agent applications) has a security flaw in versions 1.88.0 through 1.107.0 and 2.0.0b1 through 2.4.x where the UI adapters fail to properly validate tool calls (requests for the AI to run functions) from untrusted users. When a client message is removed during cleanup, a preceding tool call that was never approved by the AI model can slip through and execute with user-supplied arguments instead of the model's arguments, potentially bypassing security checks that normally gate which tools can run.

Pydantic AI (a Python framework for building AI applications) had a security flaw in versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5 where attackers could access files they shouldn't by referencing them in message history. The problem was that UploadedFile references (pointers to files stored in cloud services like AWS S3 or Google Cloud Storage) were not checked before being sent to the server, allowing attackers to trick the server into reading files using its own permissions rather than the attacker's limited access.

MathLive, a math rendering library, has a vulnerability where the `\text{}` and `\mbox{}` commands don't properly escape HTML characters (like <, >, &, ") before inserting them into web pages, allowing XSS (cross-site scripting, where attackers inject malicious code that runs in users' browsers). This happens because the code sends raw, unescaped user input directly into the HTML markup and MathML output (a format for displaying mathematical notation).