The report
A session-resume value, a pinned plugin revision and a tool name look like ordinary metadata. In three disclosed agent-tool vulnerabilities, each instead influenced which code or tool received execution authority. The defects had different prerequisites, so none supports a claim that simply reading an untrusted webpage would compromise every affected agent.
Startup: session text became a CLI option
The Claude Agent SDK Python advisory describes a resume value forwarded without preventing interpretation as a command-line flag. In an application that let an attacker choose that value, an option-shaped identifier could direct Claude CLI to a custom MCP configuration. A configured stdio command could start during CLI initialization, before runtime model tool approval. This is argument injection across an application and subprocess boundary, not the model voluntarily choosing a malicious tool.
The vendor identifies versions before 0.2.121 as affected and 0.2.121 as patched. The advisory was published upstream in September and indexed with CVE-2026-96620 in October. Exploitability requires untrusted resume input to reach the vulnerable option; it is not evidence of a default unauthenticated attack on every SDK installation.
Installation: a pin did not verify the installed object
The Claude Code plugin advisory, CVE-2026-86063, describes another mistake. A marketplace entry supplied a 40-character commit hash, but an installer used git checkout without confirming that resolved HEAD equaled that immutable commit. On a host permitting a branch named like a commit hash, a repository-controlled attacker could steer checkout to mutable branch content. No cryptographic SHA collision was needed.
The documented prerequisites include attacker control of the plugin upstream, a compatible Git host and plugin installation by the user. 2.1.179 is the patched Claude Code version. The report establishes a pin-validation defect, not a known large-scale malicious plugin campaign.
Dispatch: one tool name, two definitions of identity
The Docker MCP Gateway advisory identifies a case-sensitive reserved-tool collision check beside case-insensitive enablement behavior. A server already installed and enabled by an operator could register an altered-case reserved name, potentially receiving calls a client intended for a gateway-owned tool. The client still had to select the impostor. 0.43.1 through 0.43.3 were affected and 0.44.1 supplies the reported fix. This is separate from Docker MCP Gateway's earlier malformed-metadata denial-of-service issue.
| Boundary | Who must control something? | Incorrect trust decision | Patch described |
|---|---|---|---|
| SDK startup | Attacker-influenced resume identifier in a vulnerable application | Data interpreted as CLI configuration | SDK 0.2.121 |
| Plugin installation | Malicious plugin upstream and accepted SHA-shaped branch | Checkout success treated as commit pin verification | Claude Code 2.1.179 |
| MCP tool dispatch | Enabled hostile server and client selecting colliding tool | Inconsistent case comparison across registration and use | MCP Gateway 0.44.1 |
The engineering lesson is conditional, not rhetorical. A validated session identifier prevents option-shaped input from becoming execution configuration. A checked-out Git object must match the promised commit. An MCP namespace must use the same identity rules at registration, authorization and dispatch. A model's final refusal cannot repair code already launched by its harness.