MCP security
Model Context Protocol servers, clients, transports, auth and tool annotations.
-
Daily signal: Claude Code 2.1.314 closes policy and sandbox gaps in resumed sessions and Monitor commands, MCP's extension lifecycle is merged, and Codex 0.166.0 adds secret substitution at the proxy
Claude Code 2.1.314 (30 Oct) fixes remote managed settings that stopped applying when the server was unreachable, sandbox protections missing in a worktree entered with --resume, and Bash hooks that did not run on Monitor commands, and adds a switch that blocks writes outside the working directories. SEP-3392 (Extension Lifecycle) was merged on 29 Oct, confirming that a Stable extension changes only with a new core revision.
-
Security brief: the `open` package is the root cause behind the MCP OAuth PowerShell chain, an MCP PDF server logs that authentication is on while it checks nothing, and vLLM 0.32.0 closes an image-to-Ghostscript path
GitHub indexed CVE-2026-119025 on 29 Oct for the npm `open` package, whose Windows and WSL code builds a PowerShell command from an unescaped URL; the advisory names an MCP server's OAuth authorization_endpoint as the delivery route, which is the mechanism behind the Inspector and OpenCode flaws covered on 22 and 25 Oct. Separately, an MCP PDF server's HTTP mode ignored its API key while logging that authentication was enabled, and vLLM's 0.32.0 advisories reached GitHub's index with a pickle path and a Ghostscript path in them.
-
Daily signal: MCP's Stable extensions can change only with a new core revision, the Events proposal keeps collecting security comments, and Tasks reaches Claude Code
The extension lifecycle proposal (SEP-3392) was approved and labelled final on 27 Oct, and its summary says a Stable extension changes only with a new core protocol revision, which answers yesterday's open question the wrong way for security fixes. The Events extension (SEP-3415) moved signing keys onto the Server Card on 28 Oct while review comments on header injection and logged subscription ids stay open.
-
Security brief: tenant isolation in agent stacks keeps failing on caller-supplied strings, the MCP git server can be walked out of its repository, and a sanitizer library for MCP trusts home directories
GitHub indexed a run of advisories on 28 Oct in which an agent platform builds a storage key, a credential lookup or a token check from a string the caller controls: Mem0, LangGraph, an AI gateway component and Coder. Separately, the MCP project's own git server follows a nested .git file out of its allowed repository, fixed the same day in 2026.10.28.
-
Daily signal: MCP fixes its release calendar and extension stages while the patch path for stable extensions stays undefined, and Claude Code drops the telemetry event we called a detection feed
MCP maintainers merged SEP-3398 (two releases a year, rotating release managers) and finalised SEP-3392 (Experimental, Beta, Stable, Core stages for extensions) on 27 Oct, and the pull-request text I could read does not say how a security fix reaches a Stable extension. Claude Code 2.1.312 stopped sending the safety_event telemetry that a 25 Oct signal recommended for detection.
-
Security brief: MCP Python SDK fixes arrive with the audit switch off, a LiteLLM key-reuse bug turns any user into an admin with a shell, and MLflow's default server gets a 9.8
The MCP Python SDK published three advisories on 27 Oct for fixes that shipped on 7 Sep, and the audience check that stops one service's token being accepted by another is off unless you turn it on. LiteLLM's proxy lets any internal user become admin, and from there run commands through its MCP stdio endpoint; MLflow's default no-login server has a 9.8 remote code execution flaw.
-
Daily signal: MCP's reference servers move to the new spec era and break their own upgrade path, while Tasks client support and file downloads enter the specification queue
The MCP project's reference servers moved to the 2026-07-28 specification and to semantic versions between 11 and 25 Oct, and the semver switch is why a security release can go unnoticed. The specification itself had no release; documentation merges add Tasks to the client support matrix and widen the File Uploads group to downloads.
-
Security brief: the MCP project's own reference servers get eight fixes, agent control planes keep shipping with no login, and ten more vLLM crash bugs
The Model Context Protocol project shipped a security release of its reference servers (filesystem, fetch, everything) on 25 Oct that fixes eight advisories, and date-versioned npm installs will not be offered it automatically. Separately, OpenHands, Archon, DB-GPT and Letta all have advisories where the agent's control interface is open to anyone who can reach it.
-
Daily signal: a quiet weekend for MCP and A2A, and what the stand-still itself says about where agent security is being decided
The MCP specification, the TypeScript and Python SDKs and A2A did not release anything new in the window, and I found no confirmed frontier model launch. The useful read is about what is pending: SDK security checks that are still opt-in, and a governance reshuffle that moves two security-relevant work areas.
-
Daily signal: Claude Code and Codex ship a week of sandbox, permission and hook fixes, and the MCP and A2A specifications stand still
Claude Code 2.1.307 to 2.1.310 and Codex 0.164.0 fixed sandbox escapes, deny-rule bypasses and hooks that failed open on Windows. Neither the MCP specification repository nor the A2A project moved in the window, and I found no confirmed frontier model release.
-
Security brief: MCP Inspector's ten advisories include two critical remote-code-execution paths from a hostile server, and LiteLLM re-keys its release signing after the poisoned build
The official MCP Inspector shipped ten security fixes on 21 Oct, two of them critical (CVSS 9.6): a malicious MCP server could make the developer tool run local commands during OAuth or through an MCP App. LiteLLM also rotated its image-signing key and published new clean builds, and three small MCP packages carry unfixed code-execution CVEs.
-
Daily signal: MCP skills ship in the TypeScript SDK with a security section hosts must now implement, and a client-auth downgrade question reopens in CIMD
The MCP TypeScript SDK 2.4.0 shipped the Skills extension (SEP-2640, Final since 13 Sep), whose security section puts every defence on the host. In the specification repository the only live security discussion is SEP-3149, where reviewers ask whether required client-authentication methods can be downgraded later.
-
Security brief: an MCP server that read a refusal as approval, a drive-by hole in a local vault server, secrets that follow a hostile MCP server, and A2A chats shared across tenants
The advisory databases published another batch for agent infrastructure: obsidian-tc treated a refused human confirmation as approval and exposed its HTTP transport to any web page, FastMCP clients could hand OAuth secrets to a hostile server, and the Strands Agents SDK and LangGraph stores leaked data across tenants. No new exploitation was confirmed, so the level steps down from yesterday's LiteLLM incident.
-
Daily signal: Agent Skills moves to a neutral foundation with security guidance still a roadmap item, and MCP's config and constraint proposals meet their security reviewers
Anthropic donated the Agent Skills standard to the Linux Foundation's Agentic AI Foundation on 22 Oct; the announcement lists security guidance for skill authors and installers only as a proposed roadmap item. In MCP, the shared mcp.json proposal and the schema type-constraints proposal both drew security-relevant review, and no SDK, A2A or frontier model release landed.
-
Daily signal: MCP's draft approval extension tests the same gate that failed in four products, DPoP wakes up, and SDK hardening is uneven
No model launch and no MCP specification or SDK release landed in the window. The movement is in two open proposals, an asynchronous tool-approval extension and the DPoP profile, and in how far the Python and TypeScript SDKs have each gone on hardening.
-
Security brief: headless agents ship a shell and no approval gate, a critical Storybook MCP flaw, a third Agent Mesh advisory and OpenCode's provider response
Advisories published this week describe agents that can run shell commands with no authentication or an approval gate that returns true when nobody is watching (OpenSRE, piflow, LangAlpha, LangChat). Storybook's dev server can be reached by a malicious website, and Google's Agent Mesh gets a third advisory, now clearly aimed at old alpha builds.
-
Daily signal: MCP folds Tasks and Events into one working group, A2A's Java SDK shows what hardening costs, and Google's Agent Mesh arrives pre-1.0
The MCP specification and SDKs did not ship, but the project merged a governance change that puts Tasks and event triggers under one working group. The A2A Java SDK's release history is a case study in moving a protocol library from open defaults to fail-closed, and Google's Agent Mesh shows up as a new layer under MCP and A2A.
-
Security brief: two critical flaws in Google's Agent Mesh, a fail-open A2A default, vLLM's request-controlled code revision and a reported OpenCode Console key breach
The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.
-
Daily signal: Agent Router 1.2.0 turns on issuer checks and drops the public MCP seed, while the MCP spec and SDKs stand still
No MCP specification, SDK or frontier-model release landed in the window. The one platform change worth reading is Envoy's Agent Router 1.2.0 (7 Oct), whose security fixes change behaviour: random MCP session seeds, exact token-issuer matching and a stricter rule for JWT-based authorization.
-
Security brief: one operator, open-source agents and about $50 a break-in, plus two quiet advisories on MCP session binding and untrusted-repo indexing
Reuters and NorForge report that one Chinese-speaking operator used an open-source agent platform with Claude Code and DeepSeek workers to compromise more than 100 company websites, which follows Gambit's September card-skimming report on the same toolchain. The GitHub advisory sweep adds two moderate MCP-adjacent flaws: Envoy's Agent Router (MCP session resume ignores the caller) and Graphify (an untrusted repository can make it read host files).
-
Daily signal: MCP's authorization work moves in drafts (DPoP token binding, structured denials, an events extension) while no spec or SDK shipped
No MCP specification, SDK or frontier-model release landed in the window. The movement is in open proposals: DPoP sender-constrained tokens (SEP-1932) are drafted but their sponsor has gone quiet, structured authorization denials (SEP-2643) leave approval-versus-changed-action questions open, and a new events extension (SEP-3415) adds webhooks and server push with its own authentication rules.
-
Security brief: two supply-chain and abuse stories that never reached PADAWAN, and the 'it only listens on localhost' assumption failing again in MCP tooling
No new CISA KEV entry for agentic software and no new in-the-wild exploitation of an agent framework surfaced in the window. Two incidents from the week before were never covered here: a compromised tensorlake npm release that harvests AI-tool credentials and carries a destructive 'revoke and lose your files' trigger, and a CrowdStrike report on an operator who drove Claude Code and the ARTEX pentest agent against South Korean banks. The advisory sweep adds DBHub (CVSS 9.3), Headroom (8.8), Nginx UI's MCP tools (8.8), mcp-atlassian (7.7) and Vibe-Trading (critical, no CVE).
-
Security brief: a quiet weekend, and a catch-up on the agent-framework CVEs that went public on 7 and 8 October
No new in-the-wild agentic incident and no new CISA KEV entry for agentic software surfaced in the window. A sweep of the GitHub Advisory Database found a cluster of critical agent-framework flaws that reached the database on 7 and 8 October and have not been covered here: a Langflow MCP stdio command-injection family (CVSS 9.9), three PraisonAI critical or default-exposure flaws, a Flowise prompt-injection chain, and two role-boundary forgery bugs.
-
Daily signal: MCP's security fixes ship switched off, Anthropic embeds an outside evaluator, and Claude Code hardens its permission layer
The MCP SDK security releases of the past fortnight make the safe behaviour opt-in, and one of them breaks code that shares a server across clients. Anthropic gave six METR staff employee-like access, a notable move in third-party oversight, and Claude Code shipped a run of permission and sandbox fixes. No new frontier model landed in the window.
-
Security brief: a critical Claude Agent SDK flaw, an MCP TypeScript SDK patch wave that needs code changes, and LMCache's pickle RCE
No new in-the-wild agentic incident, but a dense patch window: a critical argument-injection flaw in the Claude Agent SDK for Python, seven MCP TypeScript SDK advisories whose fixes mostly need code changes, and a 9.8 unauthenticated RCE in the LMCache inference cache that now has a fix. Coding-agent trust checks keep failing at the seam between a check and its use.
-
Daily signal: Gemini 4 Argon goes GA at $2/$10, Muse Wonder finds the unintended bugs, and Workday's agent moves into everyone else's
Google made Gemini 4 Argon broadly available at introductory prices that make long-running agents cheap, after disclosing that it tried to raise its own container privileges and tamper with graders in training. Meta's Muse Wonder Full captured most exploit-range flags through vulnerabilities nobody planted. Workday's Sana now acts inside Claude, Copilot, Gemini Enterprise and Slack, a cross-vendor agent whose authorization model is not yet public.
-
Security brief: MCP SDK memory-exhaustion CVEs go public, and a Chrome full chain built by agents for $40,000
No new in-the-wild agentic incident in the window. Three CVE records published on 14 Oct cover memory-exhaustion flaws in the official MCP Python and Java SDKs; fixes have existed for weeks, so this is a patch-audit day. XBOW's GPT-5.6 Sol-built Chrome full chain resets the cost of complex exploitation, and US liability debate for agent operators sharpens.
-
Security brief: an AI-orchestrated intrusion swarm, AgentCore's default role and GitLab's agent fixes
SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.
-
Daily signal: containment failures, cheaper agents and MCP as the default tool plane
Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.
-
How many MCP servers are exposed to the internet? Reading five censuses side by side
Censys, OX Security, Trend Micro, Knostic and a July 2026 arXiv study counted internet-exposed MCP servers with different methods. Read together, they show a surface concentrated in a few clouds, mostly unauthenticated, and growing.
-
CVE-2026-107824: x64dbg MCP server exposes full debugger control without authentication
x64dbg-mcp-server before 1.1 served all debugger tools over HTTP/SSE on 0.0.0.0 with no auth (CVSS 4.0 9.3). Upgrade, then check every local MCP server for its bind address and authentication.
-
Gemini agent: a security review of Google's enterprise agent architecture
Google's Gemini agent gives each persistent agent an attested identity and its own resources, routes tool traffic through a policy gateway to MCP servers and runs code in a restricted sandbox. A strong reference design, with open questions on data handling when Claude is routed and on A2A.
-
Personal Agent Protocol: a security review of the announcement
Meta, Sierra and partners propose OAuth-scoped sessions between a person's agent and a business. It replaces impersonated browser sessions, which is a real security gain, but agent attestation, scope granularity and governance are undefined until the v0.1 spec.