Model Context Protocol

Pillar Security found an agent-to-agent attack method in Google's Agent Development Kit for Python (google/adk-python) that could expose secrets and enable pull request poisoning. A public-facing low-privileged agent could be manipulated into passing a prompt to a high-privileged maintainer agent, which exposed its tools via the MCP server and allowed remote command execution and extraction of its GitHub token. Google addressed the issue through hardening but did not consider it eligible for a bug bounty, and a later remote code execution flaw in the Antigravity-SDK-based agent's automation features was fixed in late July.

Noma Security reported CVE-2026-59726, dubbed RufRoot, a critical flaw (CVSS 10.0) in Ruflo versions prior to 3.16.3. An unauthenticated MCP Bridge, exposed by default, accepts tool invocations at its /mcp endpoint, letting attackers run commands, steal LLM API keys, read user conversations and poison AgentDB memory with a single HTTP request. The researchers validated the attack chain against a default Ruflo deployment on AWS EC2.

Researchers at Noma Labs disclosed CVE-2026-59726 (CVSS 10.0), dubbed RufRoot, in Ruflo, an open-source agent meta-harness for Claude Code and Codex, affecting all versions before 3.16.3. The default docker-compose.yml binds port 3001 to 0.0.0.0, exposing an unauthenticated MCP bridge that exposes 233 tools, including terminal_execute. A single unauthenticated POST to /mcp allows remote code execution, enabling theft of LLM provider API keys, reading of stored conversations, and poisoning of AgentDB memory.

Wiz Research examined MCP servers left reachable from the Internet, often without authentication, and found several run by Fortune 500 companies. These exposed employee PII, internal business records, write and delete operations, and in some cases code execution and cloud credentials. Roughly 1 in 6 cloud environments where MCP was found exposed at least one server.

A hidden HTML comment in an Azure DevOps pull request description can hijack a reviewer's AI coding agent through Microsoft's official Azure DevOps MCP server. The repo_get_pull_request_by_id tool returns descriptions without the spotlighting guardrail that other tools in the server already apply, which Manifold Security says is the gap. In a proof of concept run on a local build of v2.7.0, the injected instructions led the agent to trigger a pipeline in another project, read a confidential wiki page, and post it back to the PR.

Cybersecurity researchers found nearly 7,600 malicious GitHub repositories created by about 6,600 profiles, more than 800 of which pose as AI skills or Model Context Protocol (MCP) servers to deliver SmartLoader malware in a campaign called FakeGit. The campaign then pushes secondary payloads such as StealC, an information stealer. Island's tests found Anthropic Claude Code, Google Gemini and OpenAI ChatGPT susceptible to surfacing these repositories, a technique it calls AgentBaiting.

A Go botnet called NadMesh targets exposed AI services such as ComfyUI, Ollama, n8n, Open WebUI, Langflow and Gradio, and its operator's dashboard claims 3,811 unique AWS keys. XLab, the QiAnXin research group, published a report on the malware and noted that its figures are internally inconsistent. Per the source, the bots mainly harvest cloud keys, Kubernetes service account tokens and config files, with MCP tool calls such as execute_command ranked high in the controller's exploitation priorities.

Cato Networks reports two critical flaws in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) and dubbed DuneSlide, that can lead to remote code execution outside the IDE's sandbox. The first abuses the working_directory parameter, which adds a non-default path to the allow list, letting a prompt injection delivered through an MCP server request make the LLM overwrite the cursorsandbox executable. The second uses symbolic links to bypass out-of-bounds write protections because of a path canonicalization flaw.

Cato Networks researchers found two flaws, CVE-2026-50548 and CVE-2026-50549, in the Cursor AI IDE that let prompt injection break out of its command execution sandbox and reach remote code execution. The exploit needs no prior user privileges or specific user interaction. It is triggered when a victim's innocuous prompt ingests an attacker-controlled payload from an untrusted source, such as an MCP server or a web search result.

Microsoft research shows attackers can hijack AI agents by poisoning the description of an MCP tool, causing the agent to quietly send company data to an outside server while each step looks routine. The work comes from Microsoft Incident Response and its Defender security research team. Microsoft says the weakness is a trust gap created by connecting outside tools, not a bug in Copilot itself.

Microsoft Incident Response describes an attack pattern against MCP tools, the fastest growing part of the agentic AI supply chain, in the third post of its AI Application Security series. The pattern is MCP tool poisoning, mapped to OWASP ASI02 (Tool Misuse) and ASI04 (Agentic Supply Chain Vulnerabilities), and it reflects techniques first disclosed by Invariant Labs in April 2025. The post supplies a playbook for detecting, containing and preventing it with Microsoft security controls.

A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957 (CVSS 8.5), let a malicious repository run commands and steal a developer's cloud credentials. Amazon Q read the MCP configuration file .amazonq/mcp.json from the open workspace and launched the servers it defined, and those processes inherited the developer's full environment, including AWS keys and cloud CLI tokens. Wiz Research found and reported the flaw, and Amazon has patched it.

Wiz Research found a high-severity flaw, CVE-2026-12957, in the Amazon Q Developer Extension for Visual Studio Code. Amazon Q loaded MCP server configurations from .amazonq/mcp.json in the workspace without user consent or a workspace trust check. Because spawned processes inherited the user's full environment, opening a malicious repository could lead to arbitrary code execution and cloud credential theft.