AI security research / cases
Investigations, evidence and outcomes.
529 Cases · Page 26 of 27
20 matching records on this page
RubyGems confirms a large May spam-publishing campaign. Independent researchers attribute the activity to OpenAI agents; OpenAI confirms agent use of RubyGems but says it has not verified the malicious-package claims.
Before version 0.7.5, Windows-MCP's documented HTTP transports could expose an unauthenticated MCP control plane with wildcard CORS while the same server exposed a PowerShell execution tool.
AI-SDLC MCP GitHub issue and pull-request tools constructed shell commands using an untrusted repository parameter and execSync. The resulting shell string could interpret metacharacters as commands rather than as a repository identifier.
Chrome DevTools MCP checked an output path against an allowed workspace before appending an image extension and following a symlink. A path accepted before extension handling could resolve to another file location for the final image write.
KServe storage initialization accepted a user-supplied InferenceService storageUri as an outbound fetch location without adequately restricting internal network destinations. A selected internal address could receive a fetch from a more privileged cluster network zone, exposing reachable services to request-side effects.
LangGraph JS and TypeScript custom authorization handlers could rewrite a Store namespace to the signed-in user but later server execution used the original untrusted namespace. Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.
Mem0 combined agent, run and user identifiers with unescaped delimiter characters, allowing differently structured identities to produce the same underlying memory key. Colliding keys could mix recent messages into an extraction model and permit cross-principal memory reads, writes or eviction.
The MLflow CrewAI instrumentation serialized agent configuration objects and model attributes without reliably removing provider credentials. The published reproduction placed a synthetic API key in several attributes across two spans; trace visibility could disclose equivalent real secrets.
An MLflow model version source supplied as a relative path without a URI scheme could bypass prompt-source filtering and resolve a file on the server. The advisory demonstrates a local-file disclosure route under MLflow service privileges, potentially including authentication material if reachable.
MLflow imported a user-controlled Python scorer module from an allowed third-party module prefix before checking the request as a scoring job. The maintainer reproduced a command-execution marker running with the server process authority before an eventual HTTP 500 response.
MONAI model bundle loading passed an included logging.conf through Python logging.config.fileConfig before the model was initialized. Executable Python handler configuration can perform host-side actions during bundle import, even before a model run.
MONAI check_hash returned a successful result when the expected digest argument was None, despite documentation presenting the operation as an integrity check. A substituted model artifact could pass a nominal hash-checking step without actually being authenticated against known content.
The browser_upload action interpreted a model-selected source path on the n8n server while the human approval described the outbound destination. An approved upload could transmit server-readable files rather than files belonging to the person requesting the task.
An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication. The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
An Enterprise dynamic-credential authorization callback could associate an OAuth provider token with the n8n member who initiated the flow instead of the person who consented. The initiating account could receive a provider token belonging to the consenting user under its own dynamic credential record.
The OracleDB Vector Store node interpolated the metadata filter name into a SQL identifier even when the name originated from untrusted workflow input. A crafted name could change the generated query and access data with the node credential authority.
Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner. The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
The separate n8n-mcp legacy HTTP server treated its publicly documented placeholder AUTH_TOKEN as an acceptable production credential. A client knowing the default token could invoke exposed MCP server operations if the HTTP endpoint was reachable.
The n8n-mcp adapter sanitized some API requests but still serialized nested credential fields, JSON strings and certain malformed arguments into telemetry or error logs. Synthetic secret markers could pass into telemetry attributes or raw log prefixes where operators or processors might later read them.
The separate n8n-mcp adapter accepted workflow parameter and connection keys that could write reserved JavaScript prototype properties during update or autofix operations. Shared inherited state could be changed by one tenant and affect operations belonging to another, including preview-only validation flows.
No matches on this page.