Vanta signs a definitive agreement to buy Pillar Security, which tests and protects AI agents (via Unite.AI)
Pillar Security says Vanta has signed a definitive agreement to acquire it; no price or closing date was disclosed.
Pillar Security says Vanta has signed a definitive agreement to acquire it; no price or closing date was disclosed.
Pillar Security, which reported the flaw privately on August 29 and disclosed it on October 19, describes a malicious or hijacked remote MCP server running code on Windows and WSL machines because OpenCode passed the server's OAuth authorization endpoint to a browser-opening helper that "built a PowerShell command around the address without escaping it", a step that "runs only when a developer starts the sign-in". Per The Hacker News's account, versions 1.0.137 through 1.18.32 are affected and the flaw was fixed in 1.18.33 on September 28, macOS and Linux are unaffected, Pillar proposes a severity of 9.8 but "did not request a CVE or publish a security advisory", and the security policy of Anomaly, the company behind OpenCode, treats configured MCP servers as "outside our trust boundary"; Pillar reported no signs the flaw has been used in attacks.
A Cloud Security Alliance research note describes CVE-2026-93348, found by Pillar Security, in which a newline injected into a model's config.json model_type field reaches exec() in unsloth-zoo versions from 2025.9.9 up to 2026.8.14, and states that "trust_remote_code=False does not protect affected versions"; it is fixed in unsloth-zoo 2026.8.14 and unsloth 2026.8.20, and no exploitation is reported.
Pillar Security reports that callers could generate locally-formatted session identifiers to invoke MCP tools with no credentials, reaching Grafana data through the server's own service account, and that the grafana_api_request tool let a caller control the destination, method, path and body of outbound requests including internal services. The issue is tracked as CVE-2026-19516 at CVSS 9.1, published August 11, with Grafana shipping v1.1.0 on August 10 adding optional bearer-token authentication. Pillar puts the server at more than 1.9 million cumulative Docker Hub downloads.
Pillar Security reports that an automated triage workflow running Gemini CLI with the --yolo flag used a deprecated coreTools key instead of the current tools.core schema, so its allowlist was ignored and an injected issue could invoke run_shell_command freely. The runner held Workload Identity Federation credentials in plain text, which could be used to mint GCP tokens and, through a project-wide roles/iam.serviceAccountTokenCreator grant, reach Editor-level access; Google tightened tool scoping, added the credentials file to .geminiignore and narrowed the role to a single service account.
Pillar Security reports a GitHub account, zellkernel, opening 23 campaign-related pull requests in 74 minutes on August 10 that point projects at a remote MCP endpoint or a hidden local path. The server behaves normally until a connected client reaches three tool calls, after which its tool and prompt responses change to steer the agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity from the user.
Pillar Security disclosed that Google's Agent Development Kit shipped CI/CD workflows in which a public issue-triage AI agent could be prompted, via a crafted GitHub issue, to post a fix command as the trusted adk-bot account; a separate privileged workflow then acted on that command after checking only who posted it, not whether an outsider had manipulated the account — allowing code execution on CI runners and exfiltration of a bot token, a Google API key and service-account credentials. Google removed the affected workflows and confirmed the fix; no CVE was assigned.
Pillar Security published seven sandbox escapes across four AI coding agents — three in Cursor, one in OpenAI's Codex CLI, one in Google's Gemini CLI and two in Google's Antigravity — in which the agent stays inside its sandbox and writes a file that a trusted tool outside the sandbox later runs, loads or scans. The routes include a workspace-controlled hook configuration, an agent editing a virtual environment's interpreter, a git-metadata bypass through fsmonitor, a “safe” command allowlist that trusted a git subcommand by name, Docker socket access reaching unsandboxed execution, a macOS Seatbelt denylist bypass and a VS Code task configuration. Pillar says the trigger is prompt injection planted in a README, an issue, a dependency or a diff, and that “an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts.”