Model Context Protocol

Cato Networks reports two critical flaws in the Cursor AI code editor, tracked as CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) and dubbed DuneSlide, that can lead to remote code execution outside the IDE's sandbox. The first abuses the working_directory parameter, which adds a non-default path to the allow list, letting a prompt injection delivered through an MCP server request make the LLM overwrite the cursorsandbox executable. The second uses symbolic links to bypass out-of-bounds write protections because of a path canonicalization flaw.

Cato Networks researchers found two flaws, CVE-2026-50548 and CVE-2026-50549, in the Cursor AI IDE that let prompt injection break out of its command execution sandbox and reach remote code execution. The exploit needs no prior user privileges or specific user interaction. It is triggered when a victim's innocuous prompt ingests an attacker-controlled payload from an untrusted source, such as an MCP server or a web search result.

Microsoft research shows attackers can hijack AI agents by poisoning the description of an MCP tool, causing the agent to quietly send company data to an outside server while each step looks routine. The work comes from Microsoft Incident Response and its Defender security research team. Microsoft says the weakness is a trust gap created by connecting outside tools, not a bug in Copilot itself.

Microsoft Incident Response describes an attack pattern against MCP tools, the fastest growing part of the agentic AI supply chain, in the third post of its AI Application Security series. The pattern is MCP tool poisoning, mapped to OWASP ASI02 (Tool Misuse) and ASI04 (Agentic Supply Chain Vulnerabilities), and it reflects techniques first disclosed by Invariant Labs in April 2025. The post supplies a playbook for detecting, containing and preventing it with Microsoft security controls.

A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957 (CVSS 8.5), let a malicious repository run commands and steal a developer's cloud credentials. Amazon Q read the MCP configuration file .amazonq/mcp.json from the open workspace and launched the servers it defined, and those processes inherited the developer's full environment, including AWS keys and cloud CLI tokens. Wiz Research found and reported the flaw, and Amazon has patched it.

Wiz Research found a high-severity flaw, CVE-2026-12957, in the Amazon Q Developer Extension for Visual Studio Code. Amazon Q loaded MCP server configurations from .amazonq/mcp.json in the workspace without user consent or a workspace trust check. Because spawned processes inherited the user's full environment, opening a malicious repository could lead to arbitrary code execution and cloud credential theft.

Microsoft fixed AutoJack, a vulnerability chain in AutoGen Studio, Microsoft's graphical interface for its open-source multi-agent AI framework. Three weaknesses (localhost-trusting MCP WebSocket, missing authentication on the MCP WebSocket endpoint, and an unvalidated base64-encoded server_params value passed to process launching) let a malicious webpage visited by a developer's browsing agent run arbitrary commands with the developer's account privileges. Microsoft says the code never shipped in a PyPI release, so only developers who built AutoGen Studio from the main GitHub branch during a limited window were exposed.

A weakness in BerriAI litellm up to 1.59.8 affects the function UserAPIKeyAuth in litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py, part of the MCP Proxy component. Manipulating this component can lead to improper authentication, and the attack can be launched remotely. A public exploit exists, and the vendor was contacted early about the disclosure.

Microsoft disclosed AutoJack, a technique in which a malicious webpage rendered by a browsing AI agent reaches a local Model Context Protocol (MCP) service in AutoGen Studio and runs arbitrary processes on the host. The attack chains three weaknesses in AutoGen Studio's MCP WebSocket implementation: an origin allowlist that a local browsing agent can satisfy, authentication that skipped MCP WebSocket paths, and a "server_params" URL value passed to process spawning without an executable allowlist. Microsoft says the vulnerable code existed only in development builds and was never shipped in the current PyPI release, and that the problem could affect a broader class of agentic frameworks.