German web host Mittwald says an attacker came in through the MCP server connecting customers' AI assistants to its platform and compromised 56 customer projects
Per The Record, Mittwald says 56 customer projects were compromised through its Model Context Protocol server and the attacker went undetected for eight days. Managing director Robert Meyer said "in some cases, only seconds passed between steps that would take significantly longer for a human attacker". The AI involvement in the attack itself is Mittwald's inference: The Record says Mittwald provided no other evidence of AI involvement and did not say whether the flaw was in its own code or in open-source MCP libraries. Mittwald's own post did not open to this run.
Symantec says it captured an attack tool built to run up to 100,000 actions without human approval, paid for with other people's model endpoints
Infosecurity Magazine reports that Symantec's Threat Hunter Team, using an AI honeypot imitating an unprotected internet-facing AI service, captured in summer 2026 the full instruction set of an attack tool designed to run up to 100,000 malicious actions without human approval - scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency miners and reinfecting compromised systems - with about 74 tools and layered instructions that override commercial models' safety controls by disguising credential theft as legitimate development work. The tool searches for exposed endpoints tied to LLMs, including self-hosted models, AI gateways and MCP servers, to use their compute without paying; Symantec says that "by routing its work through a stranger's endpoint or a stolen key, the operators shift that cost onto the victim", that none of the techniques is novel but that combining them into one self-directed agent lowers the skill needed to run a broad exploitation campaign, and that the model acts as "a reasoning engine that plans and drives the attack". The honeypot logged more than 127,000 external requests from tens of thousands of unique addresses and did not run the attacker's tools.
A malicious MCP server could run code on a developer's machine at OpenCode sign-in, Pillar Security says
Pillar Security, which reported the flaw privately on August 29 and disclosed it on October 19, describes a malicious or hijacked remote MCP server running code on Windows and WSL machines because OpenCode passed the server's OAuth authorization endpoint to a browser-opening helper that "built a PowerShell command around the address without escaping it", a step that "runs only when a developer starts the sign-in". Per The Hacker News's account, versions 1.0.137 through 1.18.32 are affected and the flaw was fixed in 1.18.33 on September 28, macOS and Linux are unaffected, Pillar proposes a severity of 9.8 but "did not request a CVE or publish a security advisory", and the security policy of Anomaly, the company behind OpenCode, treats configured MCP servers as "outside our trust boundary"; Pillar reported no signs the flaw has been used in attacks.
Exploitation of a 9.9 command-injection flaw in Langflow's MCP server feature began sixteen days before the CVE was published
Previdian's telemetry page for CVE-2026-105740 records 2,310 exploitation attempts from 30 unique attacker IP addresses in 17 countries over the 31 days to October 18, first observed on September 19 — sixteen days before the CVE was published on October 5 — and marks exploitation confirmed. The flaw, CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and fixed in Langflow 1.9.0, is OS command injection: before that release an authenticated user could add an MCP server with the “stdio” transport, and the command field was passed to bash -c “exec {command}” with no validation, allowlisting or sandboxing, running when the server list is fetched. The Hacker News, which reported the activity on October 15 with Previdian chief executive Ryan Dewhurst, gave 1,423 attempts from 27 addresses rising the same day to 1,706 from 28, and recorded a ramp-up from October 11; Previdian's page is a live counter, so the gap is elapsed time rather than a conflict. The page states the CVE is not in CISA's Known Exploited Vulnerabilities catalogue.
Bitsight finds an autonomous pentest platform sold on a closed forum that runs on the buyer's stolen OpenAI, Anthropic and Google keys
Bitsight's October 15 review of thousands of posts across sixteen underground communities from February through August 2026 describes MONST3R-AI, marketed on a highly restricted forum as an autonomous AI penetration-testing platform whose seller hosts no model of its own: a buyer pastes stolen OpenAI, Anthropic or Google keys into a bring-your-own-key panel, sets a budget cap and points the agent at a target list, so the key's owner pays for the scanning. The seller's dashboard claims 1,072 findings across 199 scanned hosts, which Bitsight says it could not verify. Across the period, mentions of AI agents, indirect prompt injection and MCP together rose 67% and AI-related discussion overall 45%, while ransomware mentions fell 49%, phishing 8% and branded malicious LLMs — WormGPT, FraudGPT, GhostGPT, DarkGPT and EvilGPT — 9%; Bitsight calls jailbreaking the largest genuine activity it tracked and gives no percentage for it. It also records a reseller, CloseRouter, offering flat-rate access to open-weight and commercial models at around ten cents per million tokens; a WormGPT breach earlier in 2026 that exposed roughly 19,000 users' emails, payment data and subscription tiers; and roughly 7,600 fraudulent GitHub repositories spreading SmartLoader in the FakeGit campaign attributed to “Water Kurita”, more than 800 of them disguised as AI skills or MCP servers.
A compromised npm SDK harvests Claude, Cursor and MCP configuration files, then republishes itself under the victim's own publishing identity
Researchers reported that version 0.5.144 of the npm package tensorlake — described by The Hacker News as “a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services” — was published with what Socket describes as “obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence.” The chain runs from a preinstall hook to package/lib/setup.mjs, an obfuscated loader, and a main payload at package/lib/Math_Symbol.js executed under the Bun runtime. What it takes includes npm and GitHub tokens, AWS credentials, HashiCorp Vault and Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets and messaging-app data, and — the part specific to this target — the configuration and MCP files for Claude, Cursor, Kiro, Windsurf and Zed; it also drops the HackBrowserData binary. Exfiltration goes first to an endpoint at iseekaigogo[.]com, and on failure the malware reads an Ethereum contract to find a command-and-control address, with GitHub as a further fallback where encrypted data is staged in a public repository. A PowerShell “hostage token” monitor polls the GitHub API with the stolen token and, if the token is revoked, runs an attacker-supplied handler that wipes the home directory. It spreads on its own: Socket says “the worm enumerates packages associated with the victim's publishing identity,” builds Sigstore provenance and republishes compromised versions, and StepSecurity reports that it “writes .claude/settings.json and .vscode/tasks.json files into repos it can reach” so that it runs again when the project is next opened in Claude Code or VS Code. On timing, the first rogue commit to the main branch of tensorlakeai/tensorlake was made at 01:20 UTC on October 7, 2026 under a maintainer's name, and the release workflow published 0.5.144 to npm about a day later; the version has since been removed from the registry. The activity is attributed to the ChainDrop / Shai-Hulud campaign, first documented in early August 2026, which compromised hundreds of npm packages including Keyv and Cacheable. No download count for the malicious version was published.
An open-source gateway holds the model and MCP credentials so the agent never has them, and checks each tool call as it is made
Tuskira released AI Agent Gateway, described by Help Net Security as “an open-source solution that sits between AI agents and everything they call.” The problem it is aimed at is the practice of copying model keys and MCP credentials into each agent's configuration file on every laptop and CI runner, where anyone who obtains the file obtains the credentials and nothing checks an agent's permissions at the moment it acts. Agents register the gateway as their MCP server and send a gateway key and a profile name with each request; the gateway checks that the key is tied to a tenant and a role and whether that profile may use the tool being requested, logs denied calls and returns an error without the call reaching the backend, and attaches the real credential from an encrypted store only on the way out, so the agent never holds the token itself. The check runs at call time rather than only by trimming the list of tools an agent can see. Model traffic can be routed through it by changing an SDK's base URL, with support for Anthropic directly or through AWS Bedrock, OpenAI and Gemini, and per-call records of tokens and estimated cost. By default it refuses connections to private and loopback addresses and always blocks the cloud metadata address; it runs on macOS and Linux, with Windows under WSL2 untested, and stored request and response bodies are capped at 1 MiB each in the demo stack. The controls are the developer's own description and no independent party has tested them.
Salt Labs took over an agentic AI platform with a single email, reaching a reverse shell and the victim's Gmail OAuth token
Salt Labs reports hijacking the agentic platform Manus with one email carrying a payload encoded in JSFuck, an obscure JavaScript obfuscation that writes programs using only a handful of punctuation characters. Processing the message, the victim's agent “invoked a Node.js runtime to process it” and ran the decoded code; the researchers “established a reverse shell from the sandbox environment” and found that “the environment had access to the Gmail MCP interface, including the OAuth token associated with the victim user,” with “sensitive credentials and tokens for additional integrations” also “exposed via environment variables.” The platform's own protection did fire, and fired too late: “this warning occurred after the decoding step had already executed the payload, meaning the system had already run the code before presenting the security prompt.” No click, link or attachment was needed. Salt says the issue “has since been resolved and is no longer exploitable” but gives no patch date. Salt's post carries no visible date; Dark Reading published the findings as an exclusive on September 24 and puts Manus at a $4 billion valuation. Dark Reading attributes the triage and fix to Meta, which does not own Manus — Meta's 2025 attempt to buy it is reported to have failed — so no fixer is named on this card.
A scan of public MCP configuration files finds one credential in eight hardcoded
Hush Security says it analysed roughly 82,000 publicly accessible Model Context Protocol configuration files and found hardcoded secrets in 12% of credential slots, 55% of them in formats carrying no vendor-recognisable token pattern, 24% both broad-scope and non-expiring, and 243 still readable in earlier Git commits after being removed from the current file. Chief executive Micha Rave is quoted saying “These files are meant to be committed; the secret never should be.”
Two chained flaws let unauthenticated callers reach data through Grafana's MCP server
Pillar Security reports that callers could generate locally-formatted session identifiers to invoke MCP tools with no credentials, reaching Grafana data through the server's own service account, and that the grafana_api_request tool let a caller control the destination, method, path and body of outbound requests including internal services. The issue is tracked as CVE-2026-19516 at CVSS 9.1, published August 11, with Grafana shipping v1.1.0 on August 10 adding optional bearer-token authentication. Pillar puts the server at more than 1.9 million cumulative Docker Hub downloads.
CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.
Metasploit ships public exploit modules for two AI application platforms
Rapid7's August 28 Metasploit release added 16 modules, two of them targeting AI application software: an unauthenticated remote code execution exploit for Langflow versions 1.10.0 and below, tracked as CVE-2026-9198, and a remote code execution exploit for the Flowise MCP server. CISA added the Langflow flaw to its known-exploited catalog on August 4; the module places a working exploit for it in a freely distributed offensive framework.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Fortinet buys an agentic-AI security vendor and does not disclose the price
Fortinet acquired Virtue AI, whose products cover agentic-system red-teaming across more than 50 sandboxed environments simulating prompt-injection and MCP attacks, discovery and governance of deployed agents, continuous validation across more than 1,000 risk categories, and runtime guardrails. Fortinet said “financial terms of the transaction are not disclosed, and the amount paid by Fortinet as consideration is immaterial to Fortinet's business.” Chairman and CEO Ken Xie: “AI is fundamentally changing enterprise computing, and security must evolve just as quickly.”
A malicious MCP server turns hostile only after an agent's third tool call
Pillar Security reports a GitHub account, zellkernel, opening 23 campaign-related pull requests in 74 minutes on August 10 that point projects at a remote MCP endpoint or a hidden local path. The server behaves normally until a connected client reaches three tool calls, after which its tool and prompt responses change to steer the agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity from the user.
HashiCorp patches CVSS 10.0 cross-tenant credential reuse flaw in Terraform MCP Server
HashiCorp advisory HCSEC-2026-23 disclosed three vulnerabilities in terraform-mcp-server, led by CVE-2026-16498, a cross-tenant credential reuse issue in streamable-HTTP stateless transport mode that allows one user's Terraform token to be used for subsequent users' tool calls. Versions 0.2.1 through 1.0.0 are affected and version 1.1.0 is the fix; the advisory also covers CVE-2026-16496 (stateful-mode authorization bypass) and CVE-2026-14869 (SSRF redirecting the server's bearer token).
"FakeGit" weaponizes ~7,600 repos against coding agents
Island researchers documented ~7,600 malicious GitHub repositories — 800+ disguised as AI skills or MCP servers — using an "AgentBaiting" technique so that LLM coding agents autonomously discover and execute repos that deliver SmartLoader and StealC.