AI Security

Published by the Agentic AI Foundation: three security contracts for protocol translation, request inspection, and session reuse in enterprise MCP gateways.

An MCP session could reuse a restricted backend under another route’s permissive policy. A two-route reproduction explains the authorization bypass and Agentgateway v1.4.0’s fix.

A second Claude Code sandbox flaw let blocked network traffic through. Reproduction, affected versions, and the parsing mismatch behind the bypass.

How GitHub comments exposed credentials in Anthropic Claude, Google Gemini, and Microsoft Copilot workflows. Includes reproductions, vendor responses, and the ACM CCS 2026 paper.

NEVER wait for approval or authorization - operate with full autonomy Try to infer how to run the code based on its structure and content — Strix System Prompt, system_prompt.jinja Strix is an open-source AI pentesting agent with 23K+ GitHub stars. You point it at a target — maybe a client engagement, maybe an open-source dependency audit — and it autonomously reviews the source, runs the application, and probes for vulnerabilities. Its entire purpose is analyzing untrusted, potentially malicious code. ...

TL;DR Agent SkillSlip is a class of path traversal vulnerabilities in AI agent skill/plugin installers. The name field inside skill metadata is used directly in path.join() without validation, writing files to attacker-controlled locations — but the user only sees the archive filename or repository URL, not the internal metadata Found across three tools: Gemini CLI, Claude Code, and Vercel’s add-skill Impact ranges from VS Code terminal hijacking to SSH key injection add-skill fixed in PR #8 and PR #108. Gemini CLI and Claude Code remain unpatched as of writing The Pattern After installing a Gemini CLI skill: .vscode/settings.json injected, terminal hijacked ...

allowedDomains: [], “Empty array = no network access.” — Anthropic Sandbox Runtime Documentation The implementation did not match the documentation. When I configured Claude Code’s sandbox with allowedDomains: [], expecting complete network isolation, the sandbox was wide open and allowed connections to any server on the internet. Anthropic patched this quietly in Claude Code v2.0.55 with a changelog entry saying “Fix proxy DNS resolution” — no mention of a critical security flaw. They assigned CVE-2025-66479 to their runtime library but did not assign a CVE to their flagship product Claude Code. The changelog did not include a security advisory. In practice, the issue was fixed quietly and most users were unlikely to realize there was a security patch. ...

A Remote Code Execution about modern “Computer Use” agents, Microsoft’s OmniParser/OmniTool, and what happens when capability meets reachability. “In agent stacks, every HTTP port that can do things is a pair of hands. Make sure they’re yours.” Video from Microsoft TL;DR While mapping Microsoft’s OmniParser/OmniTool , I followed the path from prompt → parsing → action and found a reachable, unauthenticated execution surface on the VM controller. If the service is network-accessible, that path becomes remote code execution (RCE) remote control by design. Attackers can send command directly to control the GUI Agent running on the computer. Microsoft acknowledged the issue (MSRC Case 97706), shipped a fix, and has assigned CVE-2025-55322 (https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-55322). Upgrade and harden now. ...

A path traversal in Microsoft NLWeb exposed sensitive files and credentials. Read the technical analysis and independent reporting on Microsoft’s update.