Brief
A decoy puzzle is a denial of wallet
OverThink plants an ordinary-looking puzzle in a page a reasoning model will retrieve. The answer stays correct, the user notices nothing, and the model burns many times the reasoning tokens you are billed for.
A hallucinated package name is an open registration
Coding models invent dependency names, and they invent the same ones again. An attacker does not need to guess what your agent will install. They sample the model, find the names nobody owns, and register them first.
A poisoning budget does not scale with the corpus
Defenders assumed a bigger training set dilutes an attacker's samples. Anthropic, the UK AI Security Institute and the Alan Turing Institute found that about 250 documents backdoored models from 600M to 13B parameters, and the larger model saw twenty times more clean data.
A skill's prerequisites section is the payload
ClawHavoc filled an agent skill marketplace with polished documentation that ended in "install this first." The malware was never in the skill's code. It was a sentence the user, or the agent, was expected to follow.
A URL fragment is a prompt the server never sees
HashJack hides instructions after the "#" of a legitimate link. The fragment never leaves the browser, so the site, the WAF and the server logs see a clean request while the AI assistant reads the full URL as context.
Every response is a training label
Anthropic reports about 24,000 fraudulent accounts and more than 16 million exchanges used to distill Claude. Model extraction does not break the API. It uses it as designed, at a volume and in a pattern the product was never meant to serve.
The guardrail judged the message, not the conversation
Crescendo reaches a forbidden answer through turns that each look harmless. A per-message filter scores every one of them clean, because the violation exists only in the sequence.
The issue body ran with the maintainer's token
PromptPwnd found AI agents in CI that paste issue titles and pull request bodies straight into the prompt, then run with a write token and a shell. The attacker needs only a GitHub account and the ability to open an issue.
The MCP server added one BCC
The first widely reported malicious MCP server in the wild did not exploit the agent. It was a working email tool that, from one release on, quietly copied every message to the attacker.
The trusted config was the one the attacker could write
Two Cursor vulnerabilities targeted the same file. One let a prompt injection write a new MCP server into it without approval. The other let a repository swap an already-approved entry for a different command. In both, the config was the payload.
A checkpoint is not inert data
Loading a pickle-based model file runs whatever the file tells the unpickler to run. Attackers have shipped reverse shells on Hugging Face that fire on load, and one campaign broke its own file so the scanner errored after the payload had already executed.
Prompt secrecy is not a security control
OWASP LLM07 exists because a system prompt is configuration the model will happily recite. Treating its contents as a secret delegates the actual security decision to a text generator that has no mechanism to keep one.
The green check came from the wrong writer
A coding agent's PR can carry a passing status for a test it never ran when the merge gate trusts the check name but not its issuer.
A retrieved chunk is not a trusted source
RAG delegates judgment to retrieval, and retrieval answers with whoever sits nearest in vector space. An attacker who controls a single document controls the top-k that reaches the model — before any instruction is ever written down.
The install step ran the pull request
An agent's code-review transcript may be clean while a dependency install executes repository-controlled code before the first test.
A retrieved chunk is not a data point
RAG poisoning turns your own retriever into the injection vector. A chunk that ranks top-k for a benign query is data to the pipeline and instructions to the model — and nothing in the stack can tell the difference.
The guardrail only wrapped one kind of tool
A per-tool safety check can be correct on the route it covers and irrelevant on the route that makes the same consequential change.
A cache hit is not a trust grant
LLM serving caches the prefix and the answer, not the decision about them. What one tenant writes into the shared cache, another inherits — and the latency tells your adversary what you cached.
The budget reset with the conversation
Session-aware tool policy can remember a transfer, but a fresh conversation can forget it. Put durable limits at the resource that moves the money.
The hook went quiet; traffic did not
An inline AI policy can be configured and healthy-looking while requests pass uninspected. Measure enforcement coverage, not just denials.
The LLM API reseller is the new bulletproof host
The South Korea ARTEX campaign reached DeepSeek through xcai.pro, a proxy reseller. That one hop is why attribution and blocking both fail, and it is the supply-chain gap nobody is watching.
The artifact pointed somewhere else
An agent's file result can make the receiving assistant fetch under its own network identity. Treat artifact references as requests for access, not as files already received.
The callback said done
A workflow completion token can close a task without proving that the approved work happened. Verify the result at the boundary before an agent acts on it.
The screenshot is a prompt, not a witness
Vision-language agents act on what they read in pixels. An attacker who controls a single image controls the instruction stream.
A retry is not a replay
The harness tells the model to try again. The model has no memory of the key it minted. At-least-once becomes at-least-twice, and that repetition is an attacker primitive, not a reliability footnote.
The guardrail finished after the send
A parallel input check can reject a run after its tool has already sent data. Put the security decision ahead of dispatch, not beside it.
The trace sampler erased the denial
A security decision cannot be audited from a trace that was never exported. Keep a narrow action ledger outside the sampled observability path.
A tool result is not a system message
The return value of a tool call rides into context carrying execution authority. When the source is not yours, that value is a covert prompt channel.
The log line became an incident command
An investigation assistant can read an honest log record containing an adversary's words. Keep telemetry as evidence, not authority.
The specialist inherited the whole case
A handoff can transfer far more than the task. Decide what the receiving agent may see before it receives history.
A blocklist is not a jailbreak gate
String-match filters judge the surface of a prompt. Adversaries operate on the tokens the model actually reads.
The 8-stage ClickFix chain, decoded for defenders
Huntress caught a ChatGPT Custom GPT pushing a RAT through a Canon-signed DLL sideload. Here is each stage as an example a blue team can hunt for, from the ClickFix paste to the final payload.
The checkpoint did not undo the transfer
Replaying an agent workflow can repeat a real-world action unless the target recognizes the same operation.
The webhook kept listening
An A2A task can keep sending updates to a once-authorized subscriber after that subscriber loses access.
The revocation that never reached the gate
A centrally approved policy change does not revoke an agent's access until every consequential gate stops using the old revision.
When feedback becomes the test
A complaint can reveal a failure; it should not be able to rewrite the acceptance test that decides whether an agent is safe to release.
The folder picker did not confine the server
MCP roots describe where a server should work; they do not restrict what its process can read.
The link connected the wrong account
MCP URL elicitation keeps credentials out of the agent, but a copied authorization link can still bind a victim's account to the attacker's session.
A task ID is not an authorization boundary
A2A task handles identify work. They do not decide who may read its artifacts, cancel it, or receive its updates.
Inspected is not executed
A safety check on the raw command or code string does not prove the runtime will execute that same string.
A registry spawn is not a catalog read
Accepting an MCP client registration that carries a command is process start, not browsing a tool list.
Non-empty is not authenticated
A non-empty Authorization header is not proof that a verifier ran or that the credential is valid.
Allowlisted is not constrained
Matching the first path token against an allowlist does not prove the process will only run that program's intended verbs.
Denied on the sandbox is not denied on the loopback
A sandbox tools.deny entry is not a gate if the MCP loopback never applies it.
Rejected is not blocked
A finishReason of tool_rejected does not prove the tool never ran.
A browsing agent inherits localhost
An Origin allowlist for 127.0.0.1 does not stop JavaScript that a local agent just rendered.
A valid token is not your audience
A signature and expiry check does not prove the token was issued for this MCP server.
Validated is not pinned
A hostname that passed an SSRF check can still dial a different address on the next lookup.
URL validation is not egress
A deny-list in the fetch helper is not a network policy. The agent host still reaches what the process can reach.
A session ID is not a credential
Conversation continuity tracks state. It does not prove who is calling.
Syntax is not intent
A well-formed tool call can still be the wrong action. Clear syntax is not a policy verdict.
Visible text is not the filter string
What a person reads on screen is not the string that keyword, signature, or model-ingestion controls evaluate. Invisible Unicode can split both.
Approved metadata is not a frozen contract
A tools/list snapshot from install time is not a lasting grant. After ordinary use, the same server can rewrite what the agent trusts.
Unset is not deny
When the webhook secret is absent, an if-secret check never runs. A warning is not a closed gate.
Memory without provenance is delayed authority
A write that can steer later tool calls is a control-plane event. Without provenance and audit, you cannot govern what fires next.
An isolate is not a host boundary
A V8 isolate or a NodeVM box can still leave the host process writable.
There is no single AI kill switch
Incident response needs independent controls over authority, connectivity and execution.
The trace ended at the tool call
Detection fails when the agent, gateway and target each describe only their own success.
Logging that lies
A green success log is not proof that a policy gate ran.
The agent edited its own policy
A repository policy file can guide an AI coding agent. It cannot constrain the agent when the same identity can rewrite or bypass it.
A block rate is not a security outcome
Measure whether a guardrail prevented the unwanted action, whether responders saw it, and whether the same control broke legitimate work.
Cancelled is not contained
An A2A cancellation request does not prove that delegated work has stopped or that its credentials can no longer act.
The sandbox hid the workload
Stronger isolation can change what host sensors observe. Validate workload detection as part of the sandbox design.
Approval has to survive the handoff
A person approves one action. The dispatcher must prove it is still executing that action after a pause, retry or delegation.
The index kept the permission
Removing access at the source does not immediately remove it from an AI index, a cached answer or an existing conversation.
A2A without a receipt
An authenticated agent call still needs a record of the policy that allowed it.
The guardrail that waved traffic through
A green light on the model path is not containment if the tool can run without that path.
Sandbox on is not containment
A sandbox label does not mean the agent is cut off from the estate. If the host can reach the VPN and the cloud APIs, so can the agent.
An outbound token is not inbound auth
A stored upstream credential lets the MCP server act. It does not prove who is calling it. Two Critical advisories show the same residual when that gate is missing.
MCP preview paths are host execution
LiteLLM’s MCP connection-test endpoints spawned the caller’s command on the proxy host. A preview surface with host privileges is a control plane, not a sandbox.
Task utility is not harness safety
High task completion can sit next to high attack success. Safety is a property of the model and harness configuration, not the model alone.
Same-origin is not a tool-ownership boundary
The page origin is a DNS name, not a registrant. Ownership has to live in the browser, and the inspector cannot hold tools.
Admission-time trust is not runtime trust
A compromised MCP server can behave honestly while you vet it. Static scans never see the later defection.
Loopback is not a trust boundary
Binding an unauthenticated model API to every interface is not loopback. The sandbox can still hold while the agent is owned.
A hook is not a security boundary
If the host is trusted, a contract can prove that an action stopped. It cannot contain a host that never asks.
Deny has to mean deny
Framework callbacks observe. A governance contract has to stop the action, even if the guard crashes.
Two allowed actions can still be the breach
Per-tool permission is not an architecture. The control is which combinations you will not allow in one session.
MCP access is now an IdP problem
The privilege decision leaves the consent screen and sits in identity policy. The blast radius sits there too.