Supply chain
Poisoned packages, models, extensions and registries in the AI toolchain.
-
Security brief: MCP Python SDK fixes arrive with the audit switch off, a LiteLLM key-reuse bug turns any user into an admin with a shell, and MLflow's default server gets a 9.8
The MCP Python SDK published three advisories on 27 Oct for fixes that shipped on 7 Sep, and the audience check that stops one service's token being accepted by another is off unless you turn it on. LiteLLM's proxy lets any internal user become admin, and from there run commands through its MCP stdio endpoint; MLflow's default no-login server has a 9.8 remote code execution flaw.
-
Security brief: LiteLLM's poisoned release traced to a leaked master key nobody revoked, ransomware affiliates caught running coding agents, and a Google ADK dev server any web page can drive
LiteLLM's 23 Oct root-cause account says an unrevoked Agent Platform master key, committed to a public repository in May, was the first link in the chain that ended in the poisoned 1.107.0 release. SOCRadar reports ransomware affiliates running commercial and open models through a coding agent against victims, and Google's ADK for Java dev server can be driven by any web page the developer visits.
-
Security brief: MCP Inspector's ten advisories include two critical remote-code-execution paths from a hostile server, and LiteLLM re-keys its release signing after the poisoned build
The official MCP Inspector shipped ten security fixes on 21 Oct, two of them critical (CVSS 9.6): a malicious MCP server could make the developer tool run local commands during OAuth or through an MCP App. LiteLLM also rotated its image-signing key and published new clean builds, and three small MCP packages carry unfixed code-execution CVEs.
-
Daily signal: MCP skills ship in the TypeScript SDK with a security section hosts must now implement, and a client-auth downgrade question reopens in CIMD
The MCP TypeScript SDK 2.4.0 shipped the Skills extension (SEP-2640, Final since 13 Sep), whose security section puts every defence on the host. In the specification repository the only live security discussion is SEP-3149, where reviewers ask whether required client-authentication methods can be downgraded later.
-
Daily signal: Agent Skills moves to a neutral foundation with security guidance still a roadmap item, and MCP's config and constraint proposals meet their security reviewers
Anthropic donated the Agent Skills standard to the Linux Foundation's Agentic AI Foundation on 22 Oct; the announcement lists security guidance for skill authors and installers only as a proposed roadmap item. In MCP, the shared mcp.json proposal and the schema type-constraints proposal both drew security-relevant review, and no SDK, A2A or frontier model release landed.
-
LiteLLM 1.107.0 was a poisoned build: a credential stealer ran on every Python start, on PyPI and in Docker images
On 21 Oct, seven PyPI wheels and the matching Docker images of the LiteLLM AI gateway shipped a credential stealer and a remote code loader that run whenever Python starts. The last clean release is 1.106.2; anything that ran 1.107.0 needs isolating and its secrets rotated.
-
Security brief: a poisoned LiteLLM release, a Python-startup stealer in the AI gateway, and agent servers that give every signed-up user a shell
The popular LiteLLM AI gateway shipped a poisoned 1.107.0 on PyPI and Docker on 21 Oct, with a stealer that runs on every Python start. Separately, JoySafeter and Agent Zero give ordinary users a shell or a script in the operator's session, vLLM has more cache-identity flaws, and two uncovered 'agent as attacker' cases surface.
-
Security brief: two supply-chain and abuse stories that never reached PADAWAN, and the 'it only listens on localhost' assumption failing again in MCP tooling
No new CISA KEV entry for agentic software and no new in-the-wild exploitation of an agent framework surfaced in the window. Two incidents from the week before were never covered here: a compromised tensorlake npm release that harvests AI-tool credentials and carries a destructive 'revoke and lose your files' trigger, and a CrowdStrike report on an operator who drove Claude Code and the ARTEX pentest agent against South Korean banks. The advisory sweep adds DBHub (CVSS 9.3), Headroom (8.8), Nginx UI's MCP tools (8.8), mcp-atlassian (7.7) and Vibe-Trading (critical, no CVE).
-
Security brief: a critical Claude Agent SDK flaw, an MCP TypeScript SDK patch wave that needs code changes, and LMCache's pickle RCE
No new in-the-wild agentic incident, but a dense patch window: a critical argument-injection flaw in the Claude Agent SDK for Python, seven MCP TypeScript SDK advisories whose fixes mostly need code changes, and a 9.8 unauthenticated RCE in the LMCache inference cache that now has a fix. Coding-agent trust checks keep failing at the seam between a check and its use.
-
How many MCP servers are exposed to the internet? Reading five censuses side by side
Censys, OX Security, Trend Micro, Knostic and a July 2026 arXiv study counted internet-exposed MCP servers with different methods. Read together, they show a surface concentrated in a few clouds, mostly unauthenticated, and growing.