Comment and Control: AI Workflow Hijacking
Systems: Anthropic Claude Code, Google Gemini, Microsoft Copilot
Research: Technical write-up · Paper
Prompt injection through collaboration content exposed credentials in AI-assisted workflows. The work was accepted at ACM CCS 2026 and subsequently used in independent guidance, security tests, and defensive software.
Agentgateway: Cross-Route Session Authorization Bypass
Advisory: GHSA-mvgg-jvj2-4frq
Analysis: Technical write-up · AAIF article
A stateful MCP session could combine one route’s upstream connection with another route’s authorization policy. Agentgateway v1.4.0 binds sessions to their selected backends.
Agent SkillSlip: Unsafe Skill Installation Paths
Systems: Google Gemini CLI, Anthropic Claude Code, Vercel add-skill
Analysis: Blog post
Research on skill metadata, path traversal, and symlink handling in AI assistant installers.
Strix: Prompt Injection in an AI Security Scanner
Analysis: Blog post and demonstration
A malicious project file steered the AI pentesting assistant into exposing cloud credentials while it analyzed the project.
Claude Code: Second Network Sandbox Bypass
Analysis: Blog post and reproduction
A hostname-parsing mismatch bypassed the sandbox’s network allowlist. The write-up documents the failure and the upstream correction.
CVE-2025-66479: Sandbox Bypass in Anthropic Claude Code
Project: anthropics/claude-code
Type: Network Isolation Bypass
CVE: CVE-2025-66479
CVSS: 1.8 (Low - disputed)
Affected: Claude Code < v2.0.55
Analysis: Blog Post
Critical sandbox misconfiguration where allowedDomains: [] (documented as “no network access”) actually allowed unrestricted network connections. Despite fixing the issue, Anthropic did not assign a CVE to Claude Code or publish a security advisory for users.
Command Injection in Google Gemini CLI
Project: google-gemini/gemini-cli
Type: Command Injection • 4 Bypass Techniques
Status: Google Cloud VRP, Bounty Confirmed
Discovered critical command injection vulnerability with 4 distinct bypass techniques in Google’s official Gemini CLI tool on its first day of release. Successfully reported through Google Cloud VRP with bounty confirmed.
Current Working Directory Bypass in Google Gemini CLI
Project: google-gemini/gemini-cli
Type: Path Restriction Bypass
Status: Google Cloud VRP
Discovered path restriction bypass allowing unauthorized file system access beyond intended working directory boundaries in Google Gemini CLI.
Path Traversal in Microsoft Azure NLWeb
Project: Microsoft Azure NLWeb (Agentic Web Protocol)
Type: Path Traversal
Status: Publicly reported in August 2025; Microsoft confirmed an update
Media: The Verge + 30 international outlets
Analysis: Blog post
Discovered classic path traversal vulnerability in Microsoft’s Agentic Web protocol that could expose API keys and credentials. Featured in exclusive interview with The Verge and subsequently covered by 30+ international media outlets across 15+ countries in 10+ languages.
CVE-2024-39693: Denial of Service in Next.js
Project: vercel/next.js
Type: Denial of Service (DoS)
CVE: CVE-2024-39693
CVSS: 8.7 (High)
Affected: < 13.5
High-severity denial of service vulnerability in Next.js, one of the most popular React frameworks affecting thousands of production applications worldwide.
Path Traversal & RCE in Anthropic MCP Servers
Project: modelcontextprotocol/servers
Type: Path Traversal & Remote Code Execution
Fix: Pull Request #2726
Analysis: Memory Server · Git Server · Git Server follow-up
Discovered multiple vulnerabilities in Anthropic’s Model Context Protocol servers: Path Traversal in Git MCP and JSON Config Injection in Memory MCP enabling potential RCE.
CVE-2025-55322: RCE in Microsoft OmniParser
Project: microsoft/OmniParser
Type: Remote Code Execution
CVE: CVE-2025-55322
Root Cause: Authentication Failure & DNS Rebinding
Analysis: Blog post
Remote code execution vulnerability in Microsoft’s OmniParser GUI agent combining authentication bypass with DNS rebinding attacks.
CVE-2025-27508: Weak Cryptography in NSA Emissary Project
Project: NationalSecurityAgency/emissary
Type: Weak Cryptographic Algorithm
CVE: CVE-2025-27508
CVSS: 7.5 (High)
Affected: < 8.24.0
Weak cryptographic algorithms in NSA’s distributed P2P data-driven workflow system affecting confidentiality and integrity of distributed communications.
Responsible Disclosure
All vulnerabilities are reported through responsible disclosure processes, working directly with vendors to ensure proper remediation before public disclosure. Active relationships maintained with major security teams including Google, Microsoft, Anthropic, and open source projects.