Model Context Protocol

Microsoft fixed AutoJack, a vulnerability chain in AutoGen Studio, Microsoft's graphical interface for its open-source multi-agent AI framework. Three weaknesses (localhost-trusting MCP WebSocket, missing authentication on the MCP WebSocket endpoint, and an unvalidated base64-encoded server_params value passed to process launching) let a malicious webpage visited by a developer's browsing agent run arbitrary commands with the developer's account privileges. Microsoft says the code never shipped in a PyPI release, so only developers who built AutoGen Studio from the main GitHub branch during a limited window were exposed.

Microsoft disclosed AutoJack, a technique in which a malicious webpage rendered by a browsing AI agent reaches a local Model Context Protocol (MCP) service in AutoGen Studio and runs arbitrary processes on the host. The attack chains three weaknesses in AutoGen Studio's MCP WebSocket implementation: an origin allowlist that a local browsing agent can satisfy, authentication that skipped MCP WebSocket paths, and a "server_params" URL value passed to process spawning without an executable allowlist. Microsoft says the vulnerable code existed only in development builds and was never shipped in the current PyPI release, and that the problem could affect a broader class of agentic frameworks.

Researchers at Mitiga Labs published an attack chain in which a malicious npm package's post-install hook rewrites ~/.claude.json, redirecting Claude Code's MCP traffic to attacker-controlled infrastructure and intercepting the OAuth bearer tokens stored there in plaintext. Mitiga reported the issue to Anthropic on April 10, and Anthropic replied on April 12 that it was out of scope; the article states no patch exists as of writing. It also recalls two earlier Claude Code flaws, CVE-2025-59536 and CVE-2026-21852, disclosed by Check Point Research in February 2026 and patched by Anthropic.

Researchers at Obsidian Security disclosed CVE-2026-40933, a one-click remote code execution flaw in self-hosted Flowise deployments through its implementation of MCP stdio servers. Flowise lets users configure stdio servers with arbitrary commands, which the operating system then runs with the Flowise process's privileges, and a malicious chatflow import can trigger this before any save or run. The flaw is rated 9.9 CVSS, and Flowise Cloud is not affected because stdio MCP is disabled there.

Permiso Security disclosed ChatGPhish, a technique in which a web page that a user asks ChatGPT to summarize can cause the chatgpt.com response renderer to display attacker-controlled Markdown links, image URLs, fake security alerts and QR codes as live elements in the assistant's UI. The renderer auto-fetches attacker-hosted images, which can leak the victim's IP, User-Agent and Referer. Separately, Adversa AI documented SymJack and TrustFall, which target AI coding agents and can lead to code execution through malicious repositories and MCP servers.

A single malformed character in the Host header lets an unauthenticated attacker bypass host-validation protections in Starlette, the Python framework underlying FastAPI, tracked as CVE-2026-48710. Starlette rebuilds the request URL by joining the Host header to the path, and a slash, question mark or hash in the Host header shifts where the path begins, so middleware reads a different path than the one routed. Researchers at X41 D-Sec rated the flaw 7.0 (High), while Starlette's maintainer rated it 6.5 (Moderate), and they said downstream applications built on FastAPI, including AI model-serving tools, gateways and MCP servers, can be affected.

Adversa AI describes SymJack, an attack that uses a malicious repository to turn AI coding agents into delivery mechanisms for supply chain attacks. A malicious symlink, renamed to look innocuous, is used with a cp command to plant a payload in the agent's configuration, registering a malicious MCP server whose startup command runs attacker code as the user on the next restart. Adversa reports the method worked in all five coding agents it tested, including Claude Code, Gemini CLI, Cursor Agent CLI, Grok Build CLI and GitHub's Copilot CLI.

Knostic researchers found 1,862 MCP servers exposed to the public internet, and in a manual check of 119 instances every one allowed unauthenticated access to internal tool listings. Some exposed production systems had write access to financial databases, social media accounts and CRM platforms. The article also covers EchoLeak (CVE-2025-32711), a zero-click exploit disclosed by Aim Security in June 2025, and CVE-2025-6514 in the mcp-remote package, which JFrog disclosed in July 2025.

Mitiga Labs reported that a tailored npm package can redirect Claude Code MCP traffic through an attacker's proxy, exposing OAuth tokens stored in plain text in ~/.claude.json. The attack requires installing the package on a machine where Claude Code is configured with dynamic authorization MCP servers, and the post-install hook persists across token rotation. Mitiga reported the issue to Anthropic on April 10, 2026, and Anthropic replied on April 12, 2026 that it was out of scope.