Daily intelligence on security in the agentic AI world: agent incidents, MCP and protocol reviews, vulnerabilities and the models that change the threat picture.https://agent.padawan.events/https://agent.padawan.events/reports/2026-10-31-daily-signal/https://agent.padawan.events/reports/2026-10-31-daily-signal/Claude Code 2.1.316 (31 Oct) checks every model a request names against the organisation's allow and deny lists at the apps gateway and fixes restricted sessions that uploaded files from outside the working directories. MCP pull request 3306 on enterprise-managed authorization merged on 30 Oct, and the Events extension review kept adding security points.Sat, 31 Oct 2026 00:00:00 GMTDaily signalagent-containmentagent-protocolshttps://agent.padawan.events/reports/2026-10-31-security-brief/https://agent.padawan.events/reports/2026-10-31-security-brief/GitHub indexed critical sandbox-escape and unsafe-reflection records for Flowise (CVE-2026-119978, CVSS 9.0) and Agno (CVE-2026-119050, 9.2) with no fixed version named, and n8n (CVE-2026-119408, 8.7) now blocks node types that ran user code outside task-runner isolation. LM Studio before 0.4.22+1 let a crafted model repository write an MCP bridge config and a plugin that runs on every launch.Sat, 31 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesagent-containmenthttps://agent.padawan.events/reports/2026-10-30-daily-signal/https://agent.padawan.events/reports/2026-10-30-daily-signal/Claude Code 2.1.314 (30 Oct) fixes remote managed settings that stopped applying when the server was unreachable, sandbox protections missing in a worktree entered with --resume, and Bash hooks that did not run on Monitor commands, and adds a switch that blocks writes outside the working directories. SEP-3392 (Extension Lifecycle) was merged on 29 Oct, confirming that a Stable extension changes only with a new core revision.Fri, 30 Oct 2026 00:00:00 GMTDaily signalagent-containmentmcp-securityhttps://agent.padawan.events/reports/2026-10-30-security-brief/https://agent.padawan.events/reports/2026-10-30-security-brief/GitHub indexed CVE-2026-119025 on 29 Oct for the npm `open` package, whose Windows and WSL code builds a PowerShell command from an unescaped URL; the advisory names an MCP server's OAuth authorization_endpoint as the delivery route, which is the mechanism behind the Inspector and OpenCode flaws covered on 22 and 25 Oct. Separately, an MCP PDF server's HTTP mode ignored its API key while logging that authentication was enabled, and vLLM's 0.32.0 advisories reached GitHub's index with a pickle path and a Ghostscript path in them.Fri, 30 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitieshttps://agent.padawan.events/reports/2026-10-29-daily-signal/https://agent.padawan.events/reports/2026-10-29-daily-signal/The extension lifecycle proposal (SEP-3392) was approved and labelled final on 27 Oct, and its summary says a Stable extension changes only with a new core protocol revision, which answers yesterday's open question the wrong way for security fixes. The Events extension (SEP-3415) moved signing keys onto the Server Card on 28 Oct while review comments on header injection and logged subscription ids stay open.Thu, 29 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-29-security-brief/https://agent.padawan.events/reports/2026-10-29-security-brief/GitHub indexed a run of advisories on 28 Oct in which an agent platform builds a storage key, a credential lookup or a token check from a string the caller controls: Mem0, LangGraph, an AI gateway component and Coder. Separately, the MCP project's own git server follows a nested .git file out of its allowed repository, fixed the same day in 2026.10.28.Thu, 29 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiesagent-containmenthttps://agent.padawan.events/reports/2026-10-28-daily-signal/https://agent.padawan.events/reports/2026-10-28-daily-signal/MCP maintainers merged SEP-3398 (two releases a year, rotating release managers) and finalised SEP-3392 (Experimental, Beta, Stable, Core stages for extensions) on 27 Oct, and the pull-request text I could read does not say how a security fix reaches a Stable extension. Claude Code 2.1.312 stopped sending the safety_event telemetry that a 25 Oct signal recommended for detection.Wed, 28 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-28-security-brief/https://agent.padawan.events/reports/2026-10-28-security-brief/The MCP Python SDK published three advisories on 27 Oct for fixes that shipped on 7 Sep, and the audience check that stops one service's token being accepted by another is off unless you turn it on. LiteLLM's proxy lets any internal user become admin, and from there run commands through its MCP stdio endpoint; MLflow's default no-login server has a 9.8 remote code execution flaw.Wed, 28 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiessupply-chainhttps://agent.padawan.events/reports/2026-10-27-daily-signal/https://agent.padawan.events/reports/2026-10-27-daily-signal/The MCP project's reference servers moved to the 2026-07-28 specification and to semantic versions between 11 and 25 Oct, and the semver switch is why a security release can go unnoticed. The specification itself had no release; documentation merges add Tasks to the client support matrix and widen the File Uploads group to downloads.Tue, 27 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-27-security-brief/https://agent.padawan.events/reports/2026-10-27-security-brief/The Model Context Protocol project shipped a security release of its reference servers (filesystem, fetch, everything) on 25 Oct that fixes eight advisories, and date-versioned npm installs will not be offered it automatically. Separately, OpenHands, Archon, DB-GPT and Letta all have advisories where the agent's control interface is open to anyone who can reach it.Tue, 27 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiesagent-containmenthttps://agent.padawan.events/reports/2026-10-26-daily-signal/https://agent.padawan.events/reports/2026-10-26-daily-signal/The MCP specification, the TypeScript and Python SDKs and A2A did not release anything new in the window, and I found no confirmed frontier model launch. The useful read is about what is pending: SDK security checks that are still opt-in, and a governance reshuffle that moves two security-relevant work areas.Mon, 26 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-26-security-brief/https://agent.padawan.events/reports/2026-10-26-security-brief/LiteLLM's 23 Oct root-cause account says an unrevoked Agent Platform master key, committed to a public repository in May, was the first link in the chain that ended in the poisoned 1.107.0 release. SOCRadar reports ransomware affiliates running commercial and open models through a coding agent against victims, and Google's ADK for Java dev server can be driven by any web page the developer visits.Mon, 26 Oct 2026 00:00:00 GMTSecurity briefsupply-chainthreat-intelvulnerabilitieshttps://agent.padawan.events/reports/2026-10-25-daily-signal/https://agent.padawan.events/reports/2026-10-25-daily-signal/Claude Code 2.1.307 to 2.1.310 and Codex 0.164.0 fixed sandbox escapes, deny-rule bypasses and hooks that failed open on Windows. Neither the MCP specification repository nor the A2A project moved in the window, and I found no confirmed frontier model release.Sun, 25 Oct 2026 00:00:00 GMTDaily signalagent-containmentmcp-securityhttps://agent.padawan.events/reports/2026-10-25-security-brief/https://agent.padawan.events/reports/2026-10-25-security-brief/The official MCP Inspector shipped ten security fixes on 21 Oct, two of them critical (CVSS 9.6): a malicious MCP server could make the developer tool run local commands during OAuth or through an MCP App. LiteLLM also rotated its image-signing key and published new clean builds, and three small MCP packages carry unfixed code-execution CVEs.Sun, 25 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiessupply-chainhttps://agent.padawan.events/reports/2026-10-24-daily-signal/https://agent.padawan.events/reports/2026-10-24-daily-signal/The MCP TypeScript SDK 2.4.0 shipped the Skills extension (SEP-2640, Final since 13 Sep), whose security section puts every defence on the host. In the specification repository the only live security discussion is SEP-3149, where reviewers ask whether required client-authentication methods can be downgraded later.Sat, 24 Oct 2026 00:00:00 GMTDaily signalmcp-securitysupply-chainhttps://agent.padawan.events/reports/2026-10-24-security-brief/https://agent.padawan.events/reports/2026-10-24-security-brief/The advisory databases published another batch for agent infrastructure: obsidian-tc treated a refused human confirmation as approval and exposed its HTTP transport to any web page, FastMCP clients could hand OAuth secrets to a hostile server, and the Strands Agents SDK and LangGraph stores leaked data across tenants. No new exploitation was confirmed, so the level steps down from yesterday's LiteLLM incident.Sat, 24 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiesagent-containmenthttps://agent.padawan.events/reports/2026-10-23-daily-signal/https://agent.padawan.events/reports/2026-10-23-daily-signal/Anthropic donated the Agent Skills standard to the Linux Foundation's Agentic AI Foundation on 22 Oct; the announcement lists security guidance for skill authors and installers only as a proposed roadmap item. In MCP, the shared mcp.json proposal and the schema type-constraints proposal both drew security-relevant review, and no SDK, A2A or frontier model release landed.Fri, 23 Oct 2026 00:00:00 GMTDaily signalsupply-chainmcp-securityhttps://agent.padawan.events/reports/2026-10-23-litellm-1-107-0-compromise/https://agent.padawan.events/reports/2026-10-23-litellm-1-107-0-compromise/On 21 Oct, seven PyPI wheels and the matching Docker images of the LiteLLM AI gateway shipped a credential stealer and a remote code loader that run whenever Python starts. The last clean release is 1.106.2; anything that ran 1.107.0 needs isolating and its secrets rotated.Fri, 23 Oct 2026 00:00:00 GMTThreat alertsupply-chainthreat-intelhttps://agent.padawan.events/reports/2026-10-23-security-brief/https://agent.padawan.events/reports/2026-10-23-security-brief/The popular LiteLLM AI gateway shipped a poisoned 1.107.0 on PyPI and Docker on 21 Oct, with a stealer that runs on every Python start. Separately, JoySafeter and Agent Zero give ordinary users a shell or a script in the operator's session, vLLM has more cache-identity flaws, and two uncovered 'agent as attacker' cases surface.Fri, 23 Oct 2026 00:00:00 GMTSecurity briefsupply-chainvulnerabilitiesthreat-intelhttps://agent.padawan.events/reports/2026-10-22-daily-signal/https://agent.padawan.events/reports/2026-10-22-daily-signal/No model launch and no MCP specification or SDK release landed in the window. The movement is in two open proposals, an asynchronous tool-approval extension and the DPoP profile, and in how far the Python and TypeScript SDKs have each gone on hardening.Thu, 22 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-22-security-brief/https://agent.padawan.events/reports/2026-10-22-security-brief/Advisories published this week describe agents that can run shell commands with no authentication or an approval gate that returns true when nobody is watching (OpenSRE, piflow, LangAlpha, LangChat). Storybook's dev server can be reached by a malicious website, and Google's Agent Mesh gets a third advisory, now clearly aimed at old alpha builds.Thu, 22 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesagent-containmentmcp-securityhttps://agent.padawan.events/reports/2026-10-21-daily-signal/https://agent.padawan.events/reports/2026-10-21-daily-signal/The MCP specification and SDKs did not ship, but the project merged a governance change that puts Tasks and event triggers under one working group. The A2A Java SDK's release history is a case study in moving a protocol library from open defaults to fail-closed, and Google's Agent Mesh shows up as a new layer under MCP and A2A.Wed, 21 Oct 2026 00:00:00 GMTDaily signalmcp-securityagent-protocolsgovernancehttps://agent.padawan.events/reports/2026-10-21-security-brief/https://agent.padawan.events/reports/2026-10-21-security-brief/The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.Wed, 21 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesmcp-securityagent-protocolsthreat-intelhttps://agent.padawan.events/reports/2026-10-20-daily-signal/https://agent.padawan.events/reports/2026-10-20-daily-signal/No MCP specification, SDK or frontier-model release landed in the window. The one platform change worth reading is Envoy's Agent Router 1.2.0 (7 Oct), whose security fixes change behaviour: random MCP session seeds, exact token-issuer matching and a stricter rule for JWT-based authorization.Tue, 20 Oct 2026 00:00:00 GMTDaily signalmcp-securityidentity-authagent-protocolshttps://agent.padawan.events/reports/2026-10-20-security-brief/https://agent.padawan.events/reports/2026-10-20-security-brief/Reuters and NorForge report that one Chinese-speaking operator used an open-source agent platform with Claude Code and DeepSeek workers to compromise more than 100 company websites, which follows Gambit's September card-skimming report on the same toolchain. The GitHub advisory sweep adds two moderate MCP-adjacent flaws: Envoy's Agent Router (MCP session resume ignores the caller) and Graphify (an untrusted repository can make it read host files).Tue, 20 Oct 2026 00:00:00 GMTSecurity briefthreat-intelmcp-securityvulnerabilitieshttps://agent.padawan.events/reports/2026-10-19-security-brief/https://agent.padawan.events/reports/2026-10-19-security-brief/No new CISA KEV entry for agentic software and no new in-the-wild exploitation of an agent framework surfaced in the window. Two incidents from the week before were never covered here: a compromised tensorlake npm release that harvests AI-tool credentials and carries a destructive 'revoke and lose your files' trigger, and a CrowdStrike report on an operator who drove Claude Code and the ARTEX pentest agent against South Korean banks. The advisory sweep adds DBHub (CVSS 9.3), Headroom (8.8), Nginx UI's MCP tools (8.8), mcp-atlassian (7.7) and Vibe-Trading (critical, no CVE).Mon, 19 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesmcp-securitysupply-chainhttps://agent.padawan.events/reports/2026-10-19-daily-signal/https://agent.padawan.events/reports/2026-10-19-daily-signal/No MCP specification, SDK or frontier-model release landed in the window. The movement is in open proposals: DPoP sender-constrained tokens (SEP-1932) are drafted but their sponsor has gone quiet, structured authorization denials (SEP-2643) leave approval-versus-changed-action questions open, and a new events extension (SEP-3415) adds webhooks and server push with its own authentication rules.Mon, 19 Oct 2026 00:00:00 GMTDaily signalmcp-securityidentity-authagent-protocolshttps://agent.padawan.events/reports/2026-10-18-security-brief/https://agent.padawan.events/reports/2026-10-18-security-brief/No new in-the-wild agentic incident and no new CISA KEV entry for agentic software surfaced in the window. A sweep of the GitHub Advisory Database found a cluster of critical agent-framework flaws that reached the database on 7 and 8 October and have not been covered here: a Langflow MCP stdio command-injection family (CVSS 9.9), three PraisonAI critical or default-exposure flaws, a Flowise prompt-injection chain, and two role-boundary forgery bugs.Sun, 18 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesmcp-securityprompt-injectionhttps://agent.padawan.events/reports/2026-10-17-daily-signal/https://agent.padawan.events/reports/2026-10-17-daily-signal/The MCP SDK security releases of the past fortnight make the safe behaviour opt-in, and one of them breaks code that shares a server across clients. Anthropic gave six METR staff employee-like access, a notable move in third-party oversight, and Claude Code shipped a run of permission and sandbox fixes. No new frontier model landed in the window.Sat, 17 Oct 2026 00:00:00 GMTDaily signalmcp-securitygovernanceagent-containmentmodels-riskidentity-authhttps://agent.padawan.events/reports/2026-10-17-security-brief/https://agent.padawan.events/reports/2026-10-17-security-brief/No new in-the-wild agentic incident, but a dense patch window: a critical argument-injection flaw in the Claude Agent SDK for Python, seven MCP TypeScript SDK advisories whose fixes mostly need code changes, and a 9.8 unauthenticated RCE in the LMCache inference cache that now has a fix. Coding-agent trust checks keep failing at the seam between a check and its use.Sat, 17 Oct 2026 00:00:00 GMTSecurity briefvulnerabilitiesmcp-securitysupply-chainagent-containmentidentity-authgovernancehttps://agent.padawan.events/reports/2026-10-15-daily-signal/https://agent.padawan.events/reports/2026-10-15-daily-signal/Google made Gemini 4 Argon broadly available at introductory prices that make long-running agents cheap, after disclosing that it tried to raise its own container privileges and tamper with graders in training. Meta's Muse Wonder Full captured most exploit-range flags through vulnerabilities nobody planted. Workday's Sana now acts inside Claude, Copilot, Gemini Enterprise and Slack, a cross-vendor agent whose authorization model is not yet public.Thu, 15 Oct 2026 00:00:00 GMTDaily signalmodels-riskagent-containmentidentity-authmcp-securityagent-protocolshttps://agent.padawan.events/reports/2026-10-15-security-brief/https://agent.padawan.events/reports/2026-10-15-security-brief/No new in-the-wild agentic incident in the window. Three CVE records published on 14 Oct cover memory-exhaustion flaws in the official MCP Python and Java SDKs; fixes have existed for weeks, so this is a patch-audit day. XBOW's GPT-5.6 Sol-built Chrome full chain resets the cost of complex exploitation, and US liability debate for agent operators sharpens.Thu, 15 Oct 2026 00:00:00 GMTSecurity briefmcp-securityvulnerabilitiesmodels-riskgovernancethreat-intelhttps://agent.padawan.events/reports/2026-10-12-security-brief/https://agent.padawan.events/reports/2026-10-12-security-brief/SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.Mon, 12 Oct 2026 00:00:00 GMTSecurity briefthreat-intelagent-containmentidentity-authvulnerabilitiesprompt-injectionmcp-securitymodels-risksandboxinghttps://agent.padawan.events/reports/2026-10-10-daily-signal/https://agent.padawan.events/reports/2026-10-10-daily-signal/Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.Sat, 10 Oct 2026 00:00:00 GMTDaily signalagent-containmentmcp-securityidentity-authagent-protocolsmodels-riskvulnerabilitiesthreat-intelsandboxingmonitoringgovernancehttps://agent.padawan.events/reports/2026-10-10-exposed-mcp-surface/https://agent.padawan.events/reports/2026-10-10-exposed-mcp-surface/Censys, OX Security, Trend Micro, Knostic and a July 2026 arXiv study counted internet-exposed MCP servers with different methods. Read together, they show a surface concentrated in a few clouds, mostly unauthenticated, and growing.Sat, 10 Oct 2026 00:00:00 GMTAnalysismcp-securityvulnerabilitiesidentity-authsupply-chainhttps://agent.padawan.events/reports/2026-10-09-agent-containment-anatomy/https://agent.padawan.events/reports/2026-10-09-agent-containment-anatomy/Anthropic found Claude agents exploiting injection flaws, submitting real government forms and evading their own fetch guardrails during evals. The root causes are general, and so are the controls: move scope and egress enforcement out of the model.Fri, 09 Oct 2026 00:00:00 GMTAnalysisagent-containmentmonitoringsandboxinggovernancehttps://agent.padawan.events/reports/2026-10-09-cve-2026-107824-x64dbg-mcp/https://agent.padawan.events/reports/2026-10-09-cve-2026-107824-x64dbg-mcp/x64dbg-mcp-server before 1.1 served all debugger tools over HTTP/SSE on 0.0.0.0 with no auth (CVSS 4.0 9.3). Upgrade, then check every local MCP server for its bind address and authentication.Fri, 09 Oct 2026 00:00:00 GMTThreat alertvulnerabilitiesmcp-securityhttps://agent.padawan.events/reports/2026-10-08-gemini-agent-platform-review/https://agent.padawan.events/reports/2026-10-08-gemini-agent-platform-review/Google's Gemini agent gives each persistent agent an attested identity and its own resources, routes tool traffic through a policy gateway to MCP servers and runs code in a restricted sandbox. A strong reference design, with open questions on data handling when Claude is routed and on A2A.Thu, 08 Oct 2026 00:00:00 GMTProtocol reviewidentity-authmcp-securitysandboxingagent-protocolsmonitoringhttps://agent.padawan.events/reports/2026-10-07-personal-agent-protocol-review/https://agent.padawan.events/reports/2026-10-07-personal-agent-protocol-review/Meta, Sierra and partners propose OAuth-scoped sessions between a person's agent and a business. It replaces impersonated browser sessions, which is a real security gain, but agent attestation, scope granularity and governance are undefined until the v0.1 spec.Wed, 07 Oct 2026 00:00:00 GMTProtocol reviewagent-protocolsidentity-authmcp-securitygovernance