AI security research / cases
Investigations, evidence and outcomes.
591 Cases · Page 30 of 30
11 matching records on this page
The MCP Inspector advisory describes a remote server supplying an OAuth authorization URL that entered an unescaped PowerShell double-quoted argument on Windows or WSL, permitting subexpression execution before any model tool call.
A security reporter demonstrates that Mini-Agent 0.1.0 with Qwen2.5-3B-Instruct executed a shell command embedded in a malicious MCP weather response; the same attempted injection was refused in a DeepSeek test.
Northflank states that multiple customers reported unauthorized use of AI provider credentials previously supplied to its platform and instructs users to rotate all stored environment secrets.
GitHub advisory GHSA-q344-5v34-gm84 says @sylphx/pdf-reader-mcp versions 2.2.0 before 3.0.1 accepted unauthenticated HTTP /mcp requests even when MCP_API_KEY was set.
The Poisoned Skills study reports that an attacker-authored skill file raised mean harmful completion rates from approximately 0.5 percent without injection to 45 percent with injection across the tested models and prompts.
Presenton security issues report that the desktop build defaulted to DISABLE_AUTH=true and served its application-data directory over unauthenticated local HTTP, including files containing AI provider API keys.
The trust-region study reports that placing the same adversarial instruction in different repository or workflow locations changes how often a tested AI agent follows it.
GHSA-w9x9-j56r-h98r describes a Volto chatbot API route that accepted unauthenticated requests and forwarded them to Danswer using the server-configured credential, until version 2.0.4.
In the 108-flaw VulnBench 2.0 study, Snyk Code matched 89 issues, Claude Code Opus 5 at high effort matched 85, and their union matched 101, while harness reporting policies excluded some real vulnerability classes.
Wiz observed roughly 800,000 unauthorized Amazon Bedrock requests over thirty hours for one stolen customer credential, with approximately 90 percent succeeding.
Wiz observed a second stolen credential used for approximately 1.7 million Bedrock calls over thirteen hours after an actor adapted requests to its permitted US regional inference profiles.
No matches on this page.