Patch Copilot in Visual Studio against code execution
Johann Rehberger published details and demos of a Copilot remote-code-execution flaw in Visual Studio that Microsoft rates CVSS 8.8.
Trusting agents & AI input
Agents read web pages, files, emails and tool output that can hide instructions. Give agents the fewest permissions possible and approve anything that runs commands, sends data, deletes or pays.
15 items · 0 stories · 15 security incidents
Lock down MCP servers that can deploy
Apiiro disclosed a CVSS 10 vulnerability in argocd-mcp, the MCP server linking AI coding agents to Argo CD; exposed HTTP servers could allow unauthorized deployments.
Guard agents that read public web forms
Zenity Labs showed prompt injection placed in a public web form could make Agentforce read private account data when an employee asked it to review the lead, then leak it.
Keep Cursor updated against prompt injection
Security news reported critical Cursor flaws where prompt injection could escape the sandbox and run commands.
Isolate MCP fetch tools from internal networks
A CVE describes the reference fetch MCP server fetching internal network and cloud metadata addresses. A public exploit exists; the poster says the fix was still awaiting merge.
Stop an agent from revealing its API key
An AI research org's vibe-coded dashboard had an authentication flaw that exposed an agent; an attacker prompted it to reveal its API key and used about $600K of provider credits over three weeks. The provider covered the credits.
Require approval before agents run shell commands
A CVSS 10 flaw was reported in the open-source MaxKB assistant, where untrusted chat or ingested content could trigger shell commands without human approval.
Be careful opening untrusted repos in Claude Code
Check Point disclosed two CVEs where malicious Claude Code project settings (hooks, MCP config, base URL) could run commands or send the API key elsewhere. Anthropic patched both before disclosure.
Watch what coding agents read from the web
PromptArmor showed a poisoned web page could make the Antigravity agent collect credentials and code from the workspace and send them out through a URL.
Know how assistants can leak data through rendered content
A researcher showed indirect prompt injection could make M365 Copilot hide data in a clickable Mermaid diagram that sent it to an attacker. Microsoft fixed it.
Use Supabase MCP read-only and away from production
Researchers showed that a prompt hidden in a customer support ticket could make a coding agent, running Supabase MCP with the service_role key, read private tables and post them back into the ticket.
Understand zero-click leaks in AI assistants
Aim Security found a crafted email could make M365 Copilot leak data from the user's context without any click (CVE-2025-32711). Microsoft fixed it server-side.
Limit what a GitHub MCP token can reach
Invariant Labs showed a malicious issue in a public repo could make an agent using the GitHub MCP server copy data from the user's private repos into a public pull request.
Know how prompt injection leaks private chat data
PromptArmor showed a message in a public channel could trick Slack AI into putting data from private channels into a phishing-style link.
Learn the basic prompt-injection data leak pattern
A researcher showed a shared Google Doc could inject instructions into Bard and leak chat history through an image URL. Google fixed it.