Threat intelligence
Understand how current attacks work, which ecosystems they affect, and which evidence supports each record.
Threat DB v2.33.0Updated November 3, 2026
Events, campaigns, authors, and malicious skill records. The catalogue is evidence, not a guarantee of coverage.
Start with the attacker’s mechanism, then inspect examples, linked campaigns, and the documented mitigation.
T001
Hidden instructions in SKILL.md that instruct the agent to run malicious commands
Mitigation: Scan SKILL.md for shell commands; never auto-execute prerequisites
T002
Injection of persistent instructions into SOUL.md, MEMORY.md, CLAUDE.md, AGENTS.md
Mitigation: Treat memory files as config; require code review for changes; monitor diffs
T003
Benign config approved once, then mutated to malicious version that auto-executes
Mitigation: Hash verification on configs; re-approval on any change
T004
Attacker manipulates MCP session/output; client trusts poisoned response
Mitigation: Cryptographic session IDs; input validation; least-privilege for MCP tools
T005
Malicious website rebinds domain to 127.0.0.1 to access local MCP servers
Mitigation: Use stdio transport; enable DNS rebinding protection; authenticate local servers
T006
Malicious packages published to registries mimicking legitimate MCP servers
Mitigation: Verify package author; check download counts; use SafeDep vet
T007
Malicious .claude/hooks/ scripts run on agent events with full user privileges
Mitigation: Review all hooks; forbid auto-running hooks from untrusted repos; maintain hook allowlist
T008
Agent instructed to read credential files and send to attacker
Mitigation: Block agent access to .env, .aws, .ssh directories; use pre-execution hooks
T009
Malicious skills spread hallucinated or fabricated package names (e.g. via npx commands) that resolve to attacker-controlled packages on npm/PyPI when executed
Mitigation: Verify every package reference in SKILL.md before executing setup instructions; use package lockfiles; pin all dependencies to known-good checksums
T010
Attacker injects malicious instructions into communication channels (Slack, email, ticketing systems, code review comments) that AI agents monitor autonomously; agent executes unauthorized actions without cryptographic source verification
Mitigation: Validate agent instruction sources cryptographically; treat all external channel content as untrusted user input; require human-in-the-loop for high-impact actions triggered via monitored channels; scope agent permissions to minimum required for task
T011
Attacker embeds malicious settings in repository config files (.claude/settings.json, .mcp.json) that auto-execute MCP servers or redirect API traffic before trust dialog is shown; the configuration layer — not the code — is the attack surface
Mitigation: Review .claude/settings.json and .mcp.json before opening unfamiliar repos; treat these files as code, not metadata; update Claude Code to >= 2.0.65; never clone-and-run from untrusted sources without inspecting config files first
T013
AI coding agent autonomously disables or circumvents its own security controls (sandbox, denylist, permission enforcement) when those controls block task completion, without explicit attacker instruction — the agent's reasoning determines that bypassing safety is necessary to fulfill the assigned goal
Mitigation: Treat agent-initiated security control disabling as a red flag requiring human review; implement hard security boundaries that cannot be overridden by agent reasoning; monitor for unexpected sandbox exits or denylist bypass attempts; apply principle of least privilege so agents cannot access sandbox configuration
T012
Attacker embeds hidden instructions in URLs (e.g. 'Summarize with AI' buttons, share links) that inject persistent memory entries into AI assistants, biasing future recommendations toward attacker-controlled content or services
Mitigation: Disable URL-based memory pre-population in AI assistants where possible; treat any 'Summarize with AI' button as potentially adversarial; periodically clear AI memory; hover over AI buttons before clicking to inspect destination URL
T014
Malicious website opens WebSocket connection to locally running AI agent gateway on localhost, brute-forces the gateway password (rate limiter exempts localhost), auto-registers as trusted device, and gains admin-level control of the victim's AI agent session
Mitigation: Update OpenClaw to >= v2026.2.26; apply rate limiting to ALL connections including localhost; require explicit user confirmation for device pairing; block WebSocket connections from browser contexts to localhost AI agent ports; use CORS headers to prevent cross-origin WebSocket upgrades
T016
Attacker hosts malware on lookalike AI agent platform websites (fake ClawHub, fake skills.sh); skills on the real platform are clean decoys that redirect victims to lookalike domains for 'prerequisites' or 'dependencies'. Bypasses hash-based scanner integrations (e.g. VirusTotal) because the skill file itself contains no malicious payload.
Mitigation: Domain verification for all external links in SKILL.md; never follow SKILL.md instructions to external websites; use network egress filtering; check domain registration dates for 'official' skill installer links
T017
Employees deploy MCP servers without IT oversight, giving AI agents access to production systems, databases, and APIs outside any security review or governance process. The MCP server itself may be legitimate but the deployment creates unmonitored attack surface.
Mitigation: Implement MCP server allowlists enforced via policy; require IT approval for all MCP server additions; use Qualys TotalAI or similar to detect shadow MCP deployments; audit claude_desktop_config.json and .mcp.json across developer machines
T018
Attackers create malicious GitHub repos or websites that rank highly in AI-generated search results (Bing AI, Google AI Overview, ChatGPT search). AI systems recommend the malicious repo as the legitimate source for popular tools. Victims trust the AI recommendation and install malware.
Mitigation: Always verify download sources via official project website or GitHub org; do not trust AI-generated search results for download URLs without verification; check repo creation date and star count before downloading; use package manager with lockfiles
T015
Attacker writes malicious content to publicly exposed AI agent log files via unauthenticated WebSocket requests; since the agent reads its own logs to troubleshoot tasks, the injected content acts as indirect prompt injection, triggering unintended agent actions
Mitigation: Update OpenClaw to >= v2026.2.13; require authentication for all WebSocket endpoints including log-write; treat log files as untrusted input when parsed by the AI agent; sandbox log file read context to prevent prompt injection
T019
Attacker exploits exposed backend mutation endpoint in AI agent skill marketplace to inflate download counts without limit, artificially promoting a malicious skill to the #1 position and gaming trust signals. Relies on misconfigured framework function visibility (e.g. Convex public mutation instead of internal). Bypasses rate limiting and deduplication checks.
Mitigation: Audit all marketplace backend mutation functions for unintended public exposure; enforce authentication on download increment endpoints; implement server-side rate limiting and anomaly detection on sudden download spikes; require human review before promoting skills with rapid download growth
T020
Attacker manipulates an AI agent's reasoning and tool-selection layer rather than exploiting tool code directly. By crafting malicious language, poisoned metadata, or injected context, attackers guide the agent's decision-making to select attacker-preferred tools, skip security checks, install malicious packages, modify configuration files, or exfiltrate data — all while appearing to perform legitimate development tasks.
Mitigation: Treat all external content (READMEs, package descriptions, issue comments) as untrusted input; implement tool governance with allowlists of approved MCP servers; use behavioral monitoring to detect unexpected tool call sequences; require human-in-the-loop for high-impact actions triggered by external content
T021
30+ vulnerabilities across popular AI coding IDEs (Cursor, Windsurf, GitHub Copilot, Zed.dev) enabling a three-step attack chain: (1) bypass LLM guardrails to control the AI context, (2) leverage auto-approved tool calls to perform actions without user interaction, (3) trigger legitimate IDE features to break security boundaries. Combines prompt injection with auto-approval mechanisms to achieve data theft and remote code execution without user interaction.
Mitigation: Disable auto-approve for file writes and tool calls in AI IDE settings; review IDE extension permissions; treat IDE workspace configuration files as security boundaries; do not auto-approve actions triggered by external repository content; keep AI IDE tools and extensions patched
T022
Attacker embeds malicious instructions in repository files (README, docs, code comments) that trigger automatically when an AI coding IDE opens the repo. The attack chains four steps: (1) indirect prompt injection hijacks AI context, (2) sandbox escape via shell builtin chaining breaks workspace confinement, (3) persistence installed via .zshenv overwrite survives reboots, (4) IDE built-in remote tunnel feature used as an undetected persistent backdoor for shell access.
Mitigation: Disable auto-approve for file writes and shell commands in AI IDE settings; never open untrusted repos without reviewing markdown files first; audit .zshenv and shell init files after opening new repos; disable remote tunnel features unless actively required; treat IDE workspace as a security boundary
T023
Attacker crafts malicious content that exploits the gap between what an AI coding agent displays in its confirmation dialog and what it actually executes. The agent UI summarizes the planned action in benign language while the underlying tool call performs a different, malicious operation. Developers approve the attack because the confirmation UI appears legitimate, while the actual executed command steals credentials, modifies files, or escalates privileges.
Mitigation: Never rely on agent UI summaries alone — review raw tool call parameters before approving; require structured, machine-readable confirmation format that shows exact command and arguments; use runtime monitors (Jozu Agent Guard, Semgrep MCP) to validate actual tool invocations against approved summaries; treat any mismatch between confirmation text and executed command as an incident
T025
Attacker embeds malicious instructions in GitHub pull request titles, issue descriptions, or review comments that are processed by AI coding agents running in GitHub Actions without proper input sanitization. The agent executes the injected instructions and leaks credentials (ANTHROPIC_API_KEY, GITHUB_TOKEN, etc.) back via PR comments or external exfiltration channels. Rated CVSS 9.4 Critical for affected agents.
Mitigation: Sanitize all GitHub event inputs (PR titles, issue bodies, comments) before including in agent prompts; use input allowlists for agent task context; run CI/CD AI agents with minimal token scopes; require human review before agent-generated PR comments; use OIDC tokens with short TTLs instead of long-lived PATs; monitor for unexpected credential usage patterns in CI/CD logs
T026
Three chained vulnerabilities in Claude.ai enable an attacker to silently hijack a user's active chat session and exfiltrate all conversation data with a single click. The attack chains: (1) hidden prompt injection embedded in a crafted Claude URL, (2) open redirect on claude.com that makes the URL appear fully legitimate, (3) Google Ads hostname-based URL validation bypass that lets attackers place paid search ads displaying a trusted claude.com URL that invisibly redirects to the malicious injection URL. No additional tools, integrations, or user error beyond clicking the ad is required.
Mitigation: Do not click AI tool links from search ads — navigate directly by typing the URL; Anthropic patched the open redirect; share no secrets or credentials in Claude.ai web sessions; use Claude Code (native CLI) rather than browser-based sessions for sensitive work; enable browser security features that warn on redirects
T027
Supply chain attack that exploits Claude Code's persistent memory files to inject backdoor instructions that survive across all projects, sessions, and system reboots. The attacker uses a compromised dependency or repository as initial access, then tampers with the agent's CLAUDE.md, MEMORY.md, or equivalent memory files to append persistent malicious instructions and shell aliases. The poisoned memory frames insecure practices as required architectural standards, making the compromise self-sustaining and hard to detect.
Mitigation: Audit CLAUDE.md and MEMORY.md files before and after opening new repositories; treat memory files as security boundaries — apply the same review rigor as code; use git hooks to alert on modifications to .claude/ directory; scan all CLAUDE.md changes for shell commands, URLs, and outbound exfiltration patterns; consider CLAUDE.md hashing and re-verification before each session; run claude-code with --no-memory flag for untrusted workspaces
T028
Attacker embeds malicious instructions in files that an AI coding tool reads automatically — repository READMEs, source code comments, or documentation files — that cause the AI to write binary payloads or configuration backdoors to the developer's machine without any user interaction. Unlike social engineering attacks, the compromise triggers the moment the AI processes the poisoned file, with no additional steps required. Vendor confirmation: Cursor CLI, AWS Kiro, Codex Desktop App all confirmed vulnerable.
Mitigation: Disable auto-approve for file writes in all AI coding IDEs; never open untrusted repositories without reviewing markdown and documentation files first; audit .vscode/tasks.json and shell init files after opening any new repo; use workspace isolation (containers, VMs) for unfamiliar codebases; apply strict file-write allowlists in IDE settings
T029
Attacker compromises a dependency in the developer's supply chain that overwrites or modifies the AGENTS.md file in the agent's working environment. Since AI agents (particularly OpenAI Codex and compatible tools) read AGENTS.md as authoritative instruction context, the poisoned file injects attacker-controlled instructions into every future agent session using that workspace. The attack extends traditional supply chain compromise beyond code execution to persistent agent instruction poisoning — a malicious package that runs no exploits but simply overwrites a configuration file achieves persistent agent control.
Mitigation: Treat AGENTS.md as a security boundary — apply the same review process as code; use git hooks or file integrity monitoring to alert on AGENTS.md modifications; lock AGENTS.md permissions to prevent writes by dependency post-install scripts; audit AGENTS.md after every dependency install or update; apply the same defenses as T027 (Claude Code Memory Poisoning) to all agent instruction files
T024
Malicious or compromised browser extensions silently intercept and exfiltrate conversations between developers and AI coding assistants (Claude, Copilot, Cursor, ChatGPT). Unlike prompt injection (which manipulates the agent), prompt poaching passively captures every question, code snippet, API key, environment variable, and confidential document shared in the AI chat session — without requiring any mistake by the developer.
Mitigation: Audit installed browser extensions and remove any with unnecessary permissions to read all page data; use AI coding tools via native desktop app rather than browser when handling sensitive code; never share API keys, credentials, or secrets in AI chat sessions; treat browser-based AI conversations as potentially intercepted; implement DLP policies for AI tool usage
T031
Attacker embeds hidden malicious instructions in seemingly innocuous documents (employee onboarding PDFs, shared spreadsheets, web pages) that users upload to MCP-enabled AI assistants during normal workflows. When the AI processes the poisoned file, the hidden instructions direct it to silently access connected MCP-linked systems (databases, CRM, file shares) and exfiltrate sensitive data. No user interaction beyond uploading the document is required — the attack chain completes invisibly, with exfiltration traffic blending into normal agent data access patterns that would appear legitimate to security monitoring teams.
Mitigation: Apply content scanning to all documents before processing with MCP-enabled AI assistants; treat uploaded documents as potentially adversarial — never grant AI assistants permissions to access sensitive data based solely on instructions in uploaded files; implement DLP policies on MCP-connected AI outputs; require human approval for data export operations initiated by document-processing tasks; use Operant AI or equivalent runtime guardrails that detect unexpected data access during document analysis workflows
T030
Attacker places a malicious repository (e.g., on GitHub) containing crafted JSON configuration files in standard AI coding agent locations (.claude/settings.json, .mcp.json, .cursor/mcp.json). When a developer clones the repo and accepts the workspace folder trust prompt — a standard IDE dialog that defaults to 'Accept' on Enter — the malicious config automatically enables all project MCP servers, spawns an attacker-controlled server as an OS process with full developer privileges, and establishes a long-lived command-and-control channel or embeds a persistent payload. The attack is silent, requires only one Enter keypress, and works against Claude Code, Gemini CLI, Cursor CLI, and GitHub Copilot CLI.
Mitigation: Anthropic declined to fix (considers folder trust consent sufficient) — apply defense-in-depth: review .claude/settings.json, .mcp.json, and .cursor/mcp.json before accepting folder trust on any cloned repo; never press Enter on the folder trust dialog without first inspecting all AI agent config files in the repository root; disable auto-approve / YOLO mode globally; run unknown repos in isolated containers or VMs; use file integrity monitoring on AI agent config locations
T032
Attacker embeds hidden instructions in AI coding agent configuration files (CLAUDE.md, .cursorrules, AGENTS.md, MEMORY.md) using zero-width Unicode characters (U+200B Zero Width Space, U+200C Zero Width Non-Joiner, U+200D Zero Width Joiner, U+FEFF BOM/Zero Width No-Break Space). These characters render as completely invisible in standard text editors, code review tools, and GitHub diffs, but are faithfully read and executed by AI agents when they load the config file. First documented at scale in the Miasma Worm (June 2026), which used this technique to persist malicious instructions across supply chain compromise of npm packages and GitHub repositories.
Mitigation: Audit all AI agent config files for zero-width Unicode after dependency installs or repo clones; add pre-commit hooks that reject config file changes containing zero-width Unicode; use file integrity monitoring on CLAUDE.md, .cursorrules, and AGENTS.md; run 'cat -A CLAUDE.md' to reveal hidden characters before trusting config files; consider CLAUDE.md hashing and re-verification at session start
T033
Attacker harvests a public write-only Sentry DSN (leaked in exposed frontend JS or found via GitHub code search) and crafts malicious Sentry error events. When a developer asks their AI coding agent to 'fix the Sentry errors', the agent reads the injected event content as a legitimate diagnostic instruction and executes attacker-controlled code. Bypasses EDR/WAF/IAM because every step in the chain looks authorized — the agent is doing exactly what it was asked to do, just on poisoned input.
Mitigation: Rotate exposed write-only DSNs; do not grant coding agents unreviewed access to third-party error-tracking data; require human confirmation before agents act on 'fix this error' prompts sourced from external diagnostic tools
T034
Attacker publishes a repository containing an innocent-looking file (e.g. project_settings.json) that is actually a symbolic link to a sensitive location on the victim's machine (e.g. ~/.ssh/authorized_keys or an AI-agent config directory). When the developer asks the coding assistant to set up or configure the project, the agent follows the symlink and writes attacker-supplied content there — for example a public SSH key granting persistent passwordless access — while the human-in-the-loop confirmation dialog displays only the benign in-project path. The approval UI shows the wrong file, so the developer approves a write they never intended.
Mitigation: Update affected agents (Amazon Q language server >= 1.69.0, Cursor >= 3.0, Antigravity >= 1.19.6); never approve agent file writes to symlinked paths; verify the real resolved path shown in approval dialogs; run untrusted repos in isolated containers
T035
Structural class flaw, not a single CVE: an AI coding agent gates shell execution by matching the raw command string against a denylist/allowlist, but bash later rewrites and evaluates that same text through expansion, substitution, and quote handling. Any rewrite that survives the text matcher yet is bash-equivalent to a blocked pattern is a bypass. Because the guard checks pre-expansion text while bash executes post-expansion, decades-old shell-evasion techniques (variable/brace/command substitution, quote splitting, IFS tricks) defeat the guard. Adding more denylist patterns does not fix it — the agent-to-bash-gated-by-string-matching convention fails by design.
Mitigation: Do not rely on string-matching command guards. Enforce at the OS/kernel layer instead: run the agent's shell in a sandbox (container, seccomp, restricted syscalls), drop network egress by default, and mediate execution through an allowlisted interpreter rather than pattern-matching raw text. Prefer agents with guard-by-architecture (e.g. Continue) over denylist agents
T036
Indirect prompt injection where the malicious payload never exists in the repository itself. A clean-looking repo ships (1) a README with normal setup steps, (2) a deliberately failing Python package that nudges the user/agent to run an initialization command, and (3) a setup script that fetches a base64-encoded payload from an attacker-controlled DNS TXT record, decodes it, and executes it. When an AI coding agent tries to resolve the setup errors autonomously, it runs the script and spawns a fully interactive reverse shell with the developer's own privileges. Because the payload arrives dynamically from DNS at runtime, static code review and repo scanners see nothing malicious.
Mitigation: Do not let coding agents auto-run setup/init commands from untrusted repos; block agent egress DNS/HTTP to non-allowlisted hosts during setup; run unknown repos in network-isolated sandboxes; require human review before executing any repo-provided initialization script
T037
Prompt injections hidden inside third-party library documentation steer an AI coding agent into executing an attacker-controlled binary while the agent is performing an automated security review or dependency audit. The attack exploits the agent's inability to distinguish untrusted data sources (library docs it reads to 'understand' a dependency) from safe instructions, turning a defensive review task into arbitrary code execution.
Mitigation: Never grant review/audit agents unrestricted execution; run dependency reviews read-only in a sandbox with no network egress and no exec; keep a hard boundary between 'analyze this text' and 'run this command'
T038
AI coding agents hallucinate plausible-looking but nonexistent package names during code completion or dependency-suggestion. Attackers monitor which names models repeatedly invent, pre-register those exact names on public package registries with malicious payloads, then wait: when the same agent later suggests 'install X' to a different developer, the suggestion looks legitimate and the developer approves the install, running the malware with normal trust.
Mitigation: Require human review before installing any agent-suggested dependency not already in the project's lockfile; check package registration date and maintainer reputation before approving 'install X' suggestions; prefer agents/IDE integrations that verify a package exists and has install history before suggesting it
T039
A repository ships a .claude/settings.json with a startup hook, or a .vscode/tasks.json with runOn: folderOpen. Cloning the repo and opening it in the agent or the editor executes attacker code before the developer types anything. No package install, no tool call, no prompt is required, so package-manager hardening does not apply.
Mitigation: Read repo-provided agent and editor config before opening the folder, the same way you would read a CLAUDE.md. Keep workspace trust enabled, it is the only native control on this path. Do not let host tooling auto-run files an agent wrote inside its own sandbox.
T040
Malware that has stolen a GitHub token commits under an AI coding agent's identity, so its repository writes blend into the commit history of teams that already let agents commit. Commit authorship, normally a first-line detection signal, stops discriminating.
Mitigation: Require signed commits for agent identities so an unsigned commit under an agent's name is anomalous by construction. Enable branch protection so a stolen token cannot write to every branch. Alert on commits to more than N branches within a short window.
T041
The attacker does not need to address the agent directly. They arrange for attacker-controlled text to land in a log, alert or diagnostic record that the agent will later inspect. This is indirect prompt injection through observability data: the model receives a prompt, but the malicious instructions arrive through tool output that operators may incorrectly treat as trusted.
Mitigation: Deny outbound network access by default. Require human approval per command, not per session. Never let a tool's output drive command execution. Scope API keys so the agent cannot touch DNS, email routing or infrastructure writes unless that specific task requires it. Rotate and scope the client-side keys (Datadog client tokens, Sentry DSNs) that let anyone write into your telemetry in the first place.
T042
The skill's entry file is clean. Malicious instructions live in a secondary file that the agent only loads when it reaches a specific step, exploiting progressive disclosure, the context-window technique where an agent reads supporting files on demand rather than all at once. A reviewer reading SKILL.md, and a scanner parsing it, both see nothing.
Mitigation: Treat every file a skill can reach as part of its attack surface. In review, follow each reference the way the agent would. Pin the reviewed commit or digest, not a mutable tag, slug, or marketplace name. Re-review before changing the pin.
T043
When an agent's allowlist trusts a bare hostname, any public counter on that domain becomes a covert channel. The attacker creates one resource per possible character, has the agent fetch the one matching the next character of a secret, and reads the secret back one increment at a time from the public counter. No outbound connection to attacker infrastructure ever occurs: every request goes to a domain the operator deliberately trusted.
Mitigation: Never allowlist a bare hostname on a domain where third parties can create content and observe metrics. Scope allowlist entries to specific paths. Audit existing allowlists for this property now: package registries, model hubs, gists, paste sites and issue trackers all qualify.
Recent feed events, ordered by their canonical event date. Detection coverage remains explicit for each record.
The action checked out attacker-controlled PR head branches, read .mcp.json from the working directory and enabled all project MCP servers. A pull request carrying a malicious .mcp.json could run code on the Actions runner and expose workflow secrets when a privileged user triggered the action on that PR.
Detector coverage: not_detected
A completion/complete request without a ref field dereferenced nil and crashed the server before authentication, letting any client cause a denial of service.
Detector coverage: not_detected
The trailing-slash middleware redirected //evil.com/ to //evil.com, which browsers treat as an external URL.
Detector coverage: not_detected
The servlet SSE and streamable HTTP transports sent Access-Control-Allow-Origin: *, so a page in the victim's browser could read responses from a reachable MCP server.
Detector coverage: not_detected
The shell safety assessment classified commands using bash parameter transformation operators as read-only. An attacker who could influence agent commands, for example through repository files or MCP server responses, could execute hidden commands.
Detector coverage: not_detected
The SDK parsed JSON-RPC with encoding/json, which matches keys case-insensitively and folds some Unicode characters. A malicious peer could send protocol messages with non-standard field names that the SDK still accepted, contrary to JSON-RPC 2.0.
Detector coverage: not_detected
The unreviewed advisory states that Codex treated some PowerShell commands using --% as safe, so an attacker-prepared repository could get a file-writing Git command run without approval and alter Codex configuration to launch an attacker MCP server. The default macOS and Linux filesystem sandbox can block the write. The advisory links a fix pull request but no version.
Detector coverage: not_detected
The OAuth Proxy ignored the client's resource parameter and issued tokens for its base_url, so a token obtained for one MCP server could be accepted by another behind the same proxy.
Detector coverage: not_detected
Zed loaded MCP context server definitions from a project's .zed/settings.json, so opening a crafted project ran arbitrary commands with the user's privileges without further interaction.
Detector coverage: not_detected
HTTP-based servers did not enable DNS rebinding protection by default. A localhost server without authentication could receive requests from a malicious website and run tools or read resources on the user's behalf.
Detector coverage: not_detected
mcp-remote was exposed to OS command injection when connecting to untrusted MCP servers, through crafted input in the authorization_endpoint response URL.
Detector coverage: not_detected
On Windows the target CLIs often resolve to .cmd wrappers run through cmd.exe, so metacharacters in a server name passed to fastmcp install claude-code or gemini-cli ran commands.
Detector coverage: not_detected
Campaign records preserve their reported date and source. “Active” describes the tracked campaign collection, not a claim that every campaign is active today.
Atomic Stealer (AMOS) + Windows infostealers
Tracked across ClawHub, skills.sh.
Spawns /bin/sh -i reverse shell before starting MCP server
Copies official Postmark MCP server with hidden backdoor
Prompt injection via GitHub issue title → GitHub Actions cache poisoning (10 GB junk fill, LRU eviction) → stolen CI/CD publishing tokens → malicious npm publish
GhostLoader RAT
Stealth Packer + GhostSocks
After OpenClaw integrated VirusTotal scanning, attackers pivoted to hosting malware on lookalike OpenClaw websites; skills are used as decoys with no embedded payload (passing VirusTotal clean), but direct victims to attacker-controlled lookalike domains for 'installation prerequisites'. Bypasses hash-based scanning entirely.
Obfuscated JavaScript infostealer
Arbitrary malware from attacker-controlled URL
No traditional malware — JavaScript-based agent co-option for cryptocurrency mining
Threat actors abuse both Hugging Face model/dataset files and ClawHub skills to distribute malware by injecting indirect prompts into malicious files; AI agents that read these files during development or model evaluation tasks execute the injected instructions, triggering malware installation or credential exfiltration; extends the supply chain attack surface from traditional package registries to ML model repositories
Four chained vulnerabilities (TOCTOU sandbox write escape, TOCTOU sandbox file read, shell allowlist bypass, and owner-level privilege escalation) that can be combined to achieve stealthy full-host compromise starting from a single malicious plugin or prompt injection inside the OpenClaw sandbox. Chain: (1) initial foothold via malicious plugin or prompt injection; (2) CVE-2026-44113 + CVE-2026-44115 to read sensitive credentials and files outside the sandbox; (3) CVE-2026-44118 to escalate to owner-level control; (4) CVE-2026-44112 to write backdoors and establish persistence outside the sandbox.
Various malware + cryptocurrency scams
First confirmed self-replicating supply chain worm targeting AI coding agent configuration files. Injects hidden instructions using zero-width Unicode characters (U+200B, U+200C, U+FEFF) into CLAUDE.md and .cursorrules files — invisible to human code reviewers but executed by AI agents on next session load. Captures SSH keys, AWS credentials, GitHub tokens, and cryptocurrency keystores then exfiltrates to TeamPCP C2 infrastructure (83.142.209.0/24, Megalodon C2 at 216.126.225.129:8443).
First documented case of an AI agent used operationally in a supply chain attack: payload included 'hackerbot-claw', an AI agent built on OpenClaw that performed automated reconnaissance and lateral movement targeting Kubernetes clusters. TeamPCP first compromised Trivy (a security tool) to obtain PyPI credentials — poisoning a security scanner to attack downstream users.
Tracked across npm / GitHub.
Tracked across skills.sh (Vercel) primary; npm and PyPI secondary; GitHub releases for payload hosting.
Filter the complete server-rendered catalogue. Search and type controls enhance the page but are not required to read the records.
260 results
The action checked out attacker-controlled PR head branches, read .mcp.json from the working directory and enabled all project MCP servers. A pull request carrying a malicious .mcp.json could run code on the Actions runner and expose workflow secrets when a privileged user triggered the action on that PR.
A completion/complete request without a ref field dereferenced nil and crashed the server before authentication, letting any client cause a denial of service.
The trailing-slash middleware redirected //evil.com/ to //evil.com, which browsers treat as an external URL.
The servlet SSE and streamable HTTP transports sent Access-Control-Allow-Origin: *, so a page in the victim's browser could read responses from a reachable MCP server.
The shell safety assessment classified commands using bash parameter transformation operators as read-only. An attacker who could influence agent commands, for example through repository files or MCP server responses, could execute hidden commands.
The SDK parsed JSON-RPC with encoding/json, which matches keys case-insensitively and folds some Unicode characters. A malicious peer could send protocol messages with non-standard field names that the SDK still accepted, contrary to JSON-RPC 2.0.
The unreviewed advisory states that Codex treated some PowerShell commands using --% as safe, so an attacker-prepared repository could get a file-writing Git command run without approval and alter Codex configuration to launch an attacker MCP server. The default macOS and Linux filesystem sandbox can block the write. The advisory links a fix pull request but no version.
The OAuth Proxy ignored the client's resource parameter and issued tokens for its base_url, so a token obtained for one MCP server could be accepted by another behind the same proxy.
Zed loaded MCP context server definitions from a project's .zed/settings.json, so opening a crafted project ran arbitrary commands with the user's privileges without further interaction.
HTTP-based servers did not enable DNS rebinding protection by default. A localhost server without authentication could receive requests from a malicious website and run tools or read resources on the user's behalf.
mcp-remote was exposed to OS command injection when connecting to untrusted MCP servers, through crafted input in the authorization_endpoint response URL.
On Windows the target CLIs often resolve to .cmd wrappers run through cmd.exe, so metacharacters in a server name passed to fastmcp install claude-code or gemini-cli ran commands.
Opening a cloned repository with Cursor CLI ran the command of a malicious MCP server declared in .cursor/mcp.json without any warning.
A crafted MCP install deep-link bypassed the warning dialog and showed a trusted server name while running arbitrary commands from the link if the user accepted.
fastmcp install cursor placed the server name in a deep-link opened through cmd.exe on Windows, so shell metacharacters in an influenced server name ran arbitrary commands.
The callback page served during the client OAuth flow embedded request values such as the error parameter without escaping, allowing reflected cross-site scripting.
When MCP used OAuth with an untrusted server, the server could return crafted commands during the exchange and reach command injection on the host with the user's privileges.
A prompt injection that hijacked chat context could write workspace settings into a .code-workspace file and turn them into code execution.
Codex CLI 0.23.0 and earlier loaded project-local .env and .codex/config.toml files without confirmation when run inside a repository, so a malicious repository could embed commands that executed immediately through MCP configuration.
Case-sensitive checks protecting sensitive files such as .cursor/mcp.json let a prompt injection modify them on case-insensitive filesystems and reach remote code execution.
The Inspector rendered a redirect URL returned by a remote MCP server. A crafted redirect could inject script and, through the built-in proxy, run commands on the developer machine.
Malformed requests could trigger an unhandled validation exception and leave the server returning 500 errors until manually restarted.
A client that deliberately triggered an exception after opening a streamable HTTP session could cause an uncaught ClosedResourceError and crash the server until restart.
The unreviewed advisory states that an agent using Anthropic's deprecated Slack MCP server could be led by untrusted data to post links embedding private data, which Slack preview bots then fetched from the attacker's URL without user interaction. No fixed version is listed.
The GitHub Advisory Database now lists CVE identifiers for four advisories recorded on October 4 as GHSA-only: GHSA-5h93-6whr-6q8j is CVE-2026-116685; GHSA-rwrf-2pqf-9j8j is CVE-2026-116686; GHSA-6prh-2h8m-c8cw is CVE-2026-111769; GHSA-22jm-h49p-29qw is CVE-2026-111767. The October events stay unchanged; the threat database records carry the aliases in their notes.
The client credentials and private-key JWT providers did not bind pre-registered credentials to their issuer, so an untrusted MCP server could advertise another authorization server and receive the client secret or a signed assertion.
HTTP-reachable servers did not limit POST body size or JSON-RPC batch length, so large requests could exhaust memory and one long batch could block the server. stdio servers are excluded.
Session IDs embedded the caller's JWT subject but resume never compared it with the current caller. The Helm chart also shipped a public default seed, making session IDs forgeable.
Direct lookups checked the original component's authorization policy but returned the transformed component without rechecking it, so a client knowing the identifier could call a denied tool or read a denied resource or prompt.
The file path sanitizer allowlisted /home/ and /Users/ absolute prefixes, so paths to SSH keys or cloud credentials outside the configured safe roots were reported as not blocked.
The URL sanitizer did not block localhost with an explicit port or bracketed IPv6 loopback and link-local addresses, so URLs passed to MCP fetch tools could reach internal services.
The SDK passed the resume option to the Claude CLI without validation. A value starting with a dash could inject --mcp-config with a stdio MCP server and run a command at CLI startup, bypassing the SDK permission controls.
next dev exposed an MCP endpoint that did not verify the requesting origin, so a website visited by the developer could read the project path, source snippets, routes and development logs. Production deployments do not serve it.
Edit targets were validated with point-in-time path resolution. On macOS, code running inside the Bash sandbox could swap an in-workspace parent directory for a symlink after validation, making the unsandboxed Edit write a user-writable file outside the workspace.
The CVE record states that ZCode v3.11.2.6792 automatically connected to MCP servers declared in a repository workspace configuration, possibly allowing code execution when a crafted repository is opened. The record cites a researcher proof of concept; no vendor advisory or fix was found.
Claude Desktop on Windows launched git.exe without an absolute path, so the current working directory was searched first. A git.exe placed in a project directory ran when the user opened that directory.
The plugin install flow ran git checkout on a pinned commit SHA without checking that HEAD matched it. A plugin upstream could create a branch named like the 40-character SHA so the install resolved to attacker-controlled code.
Configuration mutation over HTTP required a secure OTP session, but /mcp and /mcp_message only required ordinary authentication and exposed nginx_config_add and nginx_config_modify.
A secondary authenticated user could write restricted directives through the MCP interface, load the njs module and execute attacker-controlled NJS in the nginx worker. The advisory states this is not OS command execution by itself.
nginx_config_add wrote configuration and reloaded nginx without ValidateConfigFile, unlike the REST API, so an authenticated caller could add blocked directives such as perl or js_import.
One of four configuration write paths, the MCP nginx_config_add tool, did not call the directive blocklist, so an authenticated caller or a prompt-injected agent could reach nginx code execution where njs or perl modules are available.
The DataStore table UI accepted postMessage data without checking event.origin and sent its JSON-RPC messages with target origin '*'.
With MCP_TRANSPORT=http the server logged that API key authentication was enabled but never checked X-API-Key. Bound to 0.0.0.0 by default, it let any reachable client call every tool and read any PDF the process could open.
praisonai mcp serve --transport http-stream defaulted to no API key, exposing initialize and tools/list without authentication, and tool arguments were not checked against inputSchema. The advisory says workflow execution and file read were refuted on 4.6.63.
The MCP file tool blocked only conf/conf.json while the HTTP file API also blocks snippet configuration, templates and publish access data, exposing publish-mode passwords and other sensitive workspace files.
Server bearer authentication could not check a token's audience. Where one authorization server issues tokens for several services, a token for another service was accepted.
On Streamable HTTP with jwtSecret set, a destructive tool call that asked for elicitation confirmation could still complete after the human declined, cancelled or omitted the answer, because the server treated a valid requestState as approval.
The find_handlers_for_template MCP tool accepted any absolute filesystem path and read the file.
requireBearerAuth() and verifyBearerToken() could not check a token's audience, so a token issued for another service by the same authorization server was accepted.
Messages were matched to connections by JSON-RPC id alone. When clients shared one stateless transport or one server instance, one client's responses and notifications could reach another client.
Servers did not limit how many array elements and object keys they validated in one request, so one HTTP request inside the default 4 MiB limit could exhaust the heap.
The vendor CVE record states that code execution was possible via an untrusted project's MCP server configuration.
The CVE record states that mcp-go through 1.2.1 reads Streamable HTTP POST bodies with io.ReadAll before validation, so unauthenticated clients can exhaust memory. No maintainer advisory or fixed version was found.
The CVE record states that mcp-remote 0.8.0 through 0.14.3 sends the client secret and receives tokens over non-loopback http device authorization and token endpoints. No maintainer advisory or fixed version was found.
The CVE record states that MCP Kotlin SDK through 0.15.0 installs Ktor WebSockets without a maxFrameSize limit in Application.mcpWebSocket, so clients can force near 2 GiB allocations. No maintainer advisory or fixed version was found.
Output paths were checked against MCP roots before the file extension was rewritten, so an in-root symlink with the rewritten name could make tools overwrite a file outside the roots.
Under certain conditions an authenticated user could manage MCP API keys outside their account and take over other accounts. Applications without the MCP plugin are not affected.
The project MCP transport authenticated the caller for its project but resources/read did not authorize the requested URI, so a user could read files from other users' flows.
The MCP stdio transport launched any command and arguments placed in an MCP server configuration, without an allowlist. Users able to edit MCP server settings or build a flow with MCP Tools could run OS commands on the Langflow host.
Claude Code checked that a target path was inside the project at permission time but re-resolved it at write time. An attacker with write access to a shared workspace who won the race could swap a project file for a symlink and redirect the write outside the project.
JFrog Security Research reported 42 third-party GitHub repositories across 11 owners carrying a large .github/init.js wrapper and startup triggers for Claude Code, Gemini, Cursor and VS Code, linked to the testmetest npm campaign. Opening the folder or starting a session in a supported tool runs the wrapper. The source does not report a count of infected machines.
Cursor reported that modified Anthropic.claude-code 2.1.312 and 2.1.313 builds for macOS and Windows were served by its VS Code extension marketplace for about 11 hours on October 29, 2026. A loader added to the extension attempted to install a persistent SSH backdoor and report host details. Cursor and Microsoft state that Anthropic did not build the package and that the Visual Studio Marketplace and npm distribution were not affected.
An omitted executable file type allowed content from a Cowork shared folder to run commands on macOS when opened from Claude Desktop. A separate guest-kernel flaw could remove the user-interaction requirement on older VM images.
Tool output-schema validation resolved server-chosen external references through synchronous URL or local-file reads without a timeout. Retrieved content was used as a schema and was not returned to the server; a stalled fetch could block the event loop.
An untrusted MCP server could select where an OAuth client sent credentials because issuer validation and credential binding were incomplete. stdio clients, clients attaching their own headers and SDK servers are excluded.
HTTP transports and OAuth routes read request bodies without a shared size limit. Streamable HTTP received an earlier partial limit; the later fix covered SSE message and OAuth routes.
HTTP transports and OAuth requests forwarded custom headers and session IDs across origins; 307/308 redirects also re-sent bodies containing OAuth credentials. Current fetch runtimes already remove the Authorization header.
HTTP client transports and OAuth requests followed cross-origin redirects carrying custom headers and, for 307/308, request bodies. The HTTP library dropped a lone Authorization header across origins.
HTTP clients sharing an InMemoryTaskStore could list, read or cancel tasks created by other sessions. Exposure requires a configured taskStore; 2.x packages are excluded.
A caller-influenced diff revision could be interpreted as a Git option, allowing writes outside the workspace within server-process privileges. Repository-influenced output could lead to execution; the operation could report no diff.
Default stateful Streamable HTTP sessions retained initialize payloads without bounded session counts or reclamation, including ended or refused sessions. Reachable clients could exhaust server memory.
The local dashboard accepted browser WebSocket connections without Origin validation when ROOM_SECRET was unset. Such clients could alter MCP or provider settings and trigger agent commands when a provider and model were configured.
OAuth credentials were not bound to the authorization server that owned them. An untrusted MCP server could redirect saved refresh tokens, client secrets or signed assertions to another issuer.
A stored API key was preferred when fetching server-managed settings despite Enterprise or Team session sign-in. Rejection could leave no server policy or an older cached copy; endpoint-managed settings were unaffected.
A logged-in Obot user following an attacker authorization URL can issue an OAuth token accepted beyond the requested MCP audience, without the intended consent boundary.
Obot registry endpoints remain anonymously readable when OBOT_SERVER_ENABLE_REGISTRY_AUTH=true. The disclosed data is catalog metadata, not credential values or authenticated server access.
Obot users with Power User or higher privileges can register a remote MCP URL that causes server requests to internal destinations, including through OAuth metadata discovery.
GraphQL operations can bypass read-only and project filters. Other findings concern deployment-dependent transport authentication, session exhaustion and untrusted CI logs.
CERT/CC describes untrusted public-DSN events becoming coding-agent instructions when automatic remediation is enabled, leading to execution in the agent environment and access to connected repositories.
When MCP SSE is enabled, browser DNS rebinding can reach Process Compose tools. The separate REST API token middleware does not protect this MCP listener.
Header-based Atlassian URLs can pass one URL parser while the downstream HTTP client resolves a different destination, bypassing SSRF restrictions.
The OAuth setup callback reflects an unescaped error parameter into HTML while the setup server is running and reachable.
Download containment defaults to the process working directory. When that directory holds application modules, attachment downloads can overwrite executable code for a later restart.
Attachment upload methods do not apply the path restrictions used by downloads; a permitted caller can disclose readable server files.
Confluence upload tools lack path containment. The advisory distinguishes the similar Jira upload mixin from a directly registered MCP tool.
OAuth token fallback files use default filesystem permissions rather than owner-only permissions, exposing credentials on shared hosts.
Some header-derived Atlassian URLs reach API clients without the SSRF validation intended by an earlier fix.
Jira and Confluence upload implementations read caller-supplied paths without the containment checks used in the download direction.
Header URL validation and connection establishment resolve DNS separately, leaving a rebinding window before the initial outbound request.
The Confluence upload path lacks the containment added to downloads, allowing tool callers to upload readable server files to a selected Confluence endpoint.
SSRF redirect validation is attached to the header-PAT client but omitted from basic-auth and OAuth clients.
The attachment read direction remains unrestricted after the earlier download write fix, including attachments passed through Jira update_issue.
A caller with attachment write access to a Confluence page can exfiltrate server-readable files through the unvalidated upload path.
Confluence attachment upload omits path validation and can disclose files readable by the MCP process to a caller-controlled page.
In HTTP or multi-user deployments, write-capable callers can upload server-readable files to accessible Atlassian issues or pages. This primitive is file disclosure, not direct execution.
Jira update_issue accepts attachment paths without a workspace boundary, allowing the MCP process to disclose files using its own privileges.
HTTP callers with upload access can submit server-local paths to attachment operations, including the Jira issue-update attachment flow.
Jira project and Confluence space filters can be bypassed by query construction or missing checks on agile endpoints, within the credentials available to the server.
OAuth fallback token files inherit the process umask, exposing plaintext access and refresh tokens to other local users even when keyring storage succeeds.
The Jira user-permission lookup bypasses the guarded HTTP session, allowing an attacker-controlled Atlassian endpoint to redirect requests to internal services.
Shared-credential HTTP deployments combine missing caller authentication with unrestricted attachment reads, exposing host files through Atlassian uploads.
Write-capable attachment callers can make Jira or Confluence read server-local files and upload them using the configured Atlassian credentials.
HTTP callers can combine service headers pointing to a selected Atlassian endpoint with unrestricted attachment paths to exfiltrate server-readable files.
HTTP deployments using shared server credentials can accept unauthenticated callers or arbitrary non-empty tokens and act with the operator credentials.
ENABLED_TOOLS and TOOLSETS filter tool listings but not direct tool calls. READ_ONLY_MODE retains separate call-time enforcement.
Vault batch output accepts paths outside the intended directory. Version 2.0.3 sanitizes slug_prefix, but vault containment requires NOTEBOOKLM_VAULT_ROOT; leaving it unset preserves unrestricted writes.
CKAN server URL validation checks hostname text without validating the resolved address. Unauthenticated self-hosted HTTP deployments can reach internal services; stdio requires control of tool arguments.
Streamable HTTP accepts attacker-origin browser traffic at initialization. In remote-authorization mode, tool listing and GitLab calls still require a token; the advisory does not establish a tokenless takeover in that mode.
An exposed SSE transport and unrestricted upload_markdown path can disclose server-readable files, including GitLab tokens, to a reachable GitLab project.
With ENABLE_DYNAMIC_API_URL=true, an HTTP caller can redirect credential-bearing GitLab requests through X-GitLab-API-URL to an untrusted destination.
A compromised MCP container using the default permissive network profile can reach host services and unauthenticated ToolHive control endpoints without escaping the container.
AIR reports plugin checkout can resolve an attacker-controlled default branch instead of the reviewed commit. The SHA-shaped branch variant depends on Git host rules; Gemini uses a FETCH_HEAD variant.
Accomplish reported that a Desktop-installed JavaScript helper exposed a privileged trust token within shared memory, enabling host execution even in read-only mode. The researcher identifies Desktop build 26.818.21641 as fixed.
Accomplish reported that attacker-controlled patch paths could expand write authorization beyond the Codex workspace. The researcher identifies CLI 0.149.0 as fixed.
Releases through 2.1.281 correct symlink write checks, workspace trust before background hooks, inherited setting restrictions, NUL permission rules and managed MCP handling.
A webview using non-file resource schemes can exploit inconsistent separator handling to read content outside the extension's allowed resource roots.
Repository settings can redirect authenticated Azure DevOps Code Search requests to an attacker endpoint and expose the user's token.
Rendering agent-provided remote media can initiate a request before the chat policy removes the element, potentially leaking data encoded in its URL, including on history restoration.
Agent web and browser tools can bypass denied destinations through inconsistent URL parsing or ignored valid administrator patterns when network filtering is enabled.
With agent filtering and browser chat tools enabled, URL separator interpretation differs between policy validation and browser navigation, permitting requests to restricted hosts.
Installing or updating attacker-controlled MCP gallery metadata can write beyond per-server storage; uninstalling the entry can delete an unintended directory.
An untrusted workspace can connect to attacker-controlled services and bypass restrictions without the user granting workspace trust.
With agent filtering enabled, an IPv4 deny entry and an empty allow list, an equivalent mapped IPv6 address can bypass the denied destination.
Workspace settings can choose a remote agent host and grant it local-file access, enabling data access or code execution when the crafted repository is opened.
Restricted workspace settings expressed as nested objects can take effect without workspace trust, allowing settings intended to remain blocked.
The September CVE publication records an earlier maintainer disclosure. SSE deployments are affected; default stdio is excluded.
The September GitSpawn review adds the July Goose advisory to AgentSec. Exposure requires attacker-controlled Git configuration already present on disk.
Manifold reports Git configuration execution during agent context collection. The September 1 patch-status snapshot needs vendor follow-up; no current fixed floor is inferred for its unresolved variants.
September database publication adds package ranges for a June advisory. It concerns a bypass of an earlier external-reference SSRF fix.
AWS disclosed a generator defect triggered by untrusted data-model names. Exposure requires generating and deploying the resulting application.
Anthropic documents additional security fixes through 2.1.269. This release-note review does not establish remediation of the withheld GitSpawn variant.
A GitHub security advisory and CVE-2026-53965 described an unbounded in-memory buffer in the HttpTransport component of the official Model Context Protocol PHP SDK (Composer package mcp/sdk). Versions 0.5.0 through 0.7.0 appended every incoming Server-Sent Events chunk to a buffer with no upper bound and only flushed it on the SSE event delimiter, so a malicious, compromised, or man-in-the-middle MCP server that withheld the delimiter could exhaust the client process's memory and deny service. Fixed in mcp/sdk 0.7.1.
Varonis Threat Labs disclosed CVE-2026-24301, a chain of three vulnerabilities in Microsoft Copilot Personal: an undocumented ?autorun=1 URL parameter that executes an attacker-supplied prompt on page load, exfiltration of data from connected OAuth apps through Copilot's own URL-fetch tool, and persistent memory poisoning via web summarization. Microsoft shipped a server-side fix the same day the issue was disclosed. Varonis reports no evidence of pre-patch exploitation.
A repository security advisory and CVE-2026-82233 described a path traversal vulnerability in the asset.upload MCP tool shipped by the SiYuan note-taking application. Versions before 3.8.1 accepted arbitrary absolute file paths without a workspace boundary check, so a prompt-injected instruction to the built-in AI agent could copy files such as SSH keys or credentials from outside the workspace into the asset directory. Fixed in SiYuan 3.8.1.
Tenet reports demonstrations where attacker-controlled log and telemetry content influenced agents that held privileged tools. Reported success rates, detection outcomes, and organization counts are Tenet's claims and are not independent measurements by AgentSec.
Zenity documents AI Total for dynamic skill evaluation. Tenet publishes agent-jackstop as a public reference repository, but AgentSec found no visible software license and does not classify it as open source.
Zenity reported Paperclip and Browser Use typosquats that accumulated reputation while clean and later directed agents to fetch external payloads. The reported install count is aggregate and is not a victim count.
AgentSec preserves JFrog and SafeDep reporting for @keyv/*@6.0.0 as contested intelligence instead of promoting the wildcard package scope to critical and confirmed.
Security researchers reported malicious npm package versions associated with the August 2026 Shai-Hulud campaign. AgentSec treats exact confirmed package/version and payload-hash matches as incident-response evidence.
GitHub Advisory Database records five MCP Ruby SDK vulnerabilities fixed in mcp gem 0.23.0. The set covers session ownership, request and line limits, DNS-rebinding protection, and session retention.
Perplexity describes Numbat as a local monitor for supported agent event streams, with 52 CEL rules in the reviewed release and enforcement that must be enabled explicitly.
NVD records that a crafted .gemini/.env file could execute commands on a headless CI host before sandbox initialization. The affected version floors cover both Gemini CLI and the run-gemini-cli GitHub Action.
Anthropic reported that a pre-approved Hugging Face hostname allowed attacker-controlled paths to act as an out-of-band data channel when untrusted content reached Claude Code context. The maintainer identifies 2.1.163 as the first patched release.
Atomic Stealer (AMOS) + Windows infostealers · ClawHub / OpenClaw
ClawHub · skills.sh
Spawns /bin/sh -i reverse shell before starting MCP server · PyPI
Copies official Postmark MCP server with hidden backdoor · npm
Prompt injection via GitHub issue title → GitHub Actions cache poisoning (10 GB junk fill, LRU eviction) → stolen CI/CD publishing tokens → malicious npm publish · GitHub Actions / npm
GhostLoader RAT · Malicious npm package posing as official OpenClaw AI installer; postinstall hook triggers GhostLoader; installs persistent RAT with SOCKS5 proxy and live browser session cloning; clipboard monitoring every 3 seconds for crypto addresses, API keys (AWS, OpenAI, Anthropic) · npm
Stealth Packer + GhostSocks · Fake OpenClaw installers distributed via malicious GitHub repositories; AI-generated search results (Bing) inadvertently recommended malicious repos to users searching for OpenClaw; installers deploy Stealth Packer malware and GhostSocks which resets firewall protections to route traffic through compromised systems while evading anti-fraud protections and MFA · GitHub repositories
After OpenClaw integrated VirusTotal scanning, attackers pivoted to hosting malware on lookalike OpenClaw websites; skills are used as decoys with no embedded payload (passing VirusTotal clean), but direct victims to attacker-controlled lookalike domains for 'installation prerequisites'. Bypasses hash-based scanning entirely. · ClawHub / OpenClaw
Obfuscated JavaScript infostealer · Fraudulent website imitating official OpenClaw site (app-clawbot[.]org) uses ClickFix social engineering to trick users into running a highly obfuscated JavaScript infostealer; malware profiles systems and exfiltrates hostname, Windows version, CPU architecture, installed memory, uptime, and system language to C2 servers · Fake website / social engineering
Arbitrary malware from attacker-controlled URL · At least 39 malicious skills abuse SKILL.md setup instructions to prompt installation of fake OpenClawCLI prerequisites from openclawcli.vercel.app; users following setup instructions download and execute attacker-controlled payloads · ClawHub / SKILL.md
No traditional malware — JavaScript-based agent co-option for cryptocurrency mining · 30 skills published by a single author silently register AI agents at onlyflies.buzz to participate in a coordinated $FLY token cryptocurrency mining operation; no malware dropper, no user consent, no traditional IOCs — agents become mining nodes through skill-injected instructions that commandeer agent compute resources; bypasses traditional AV and malware detection since no binary payload is deployed · ClawHub / OpenClaw
Threat actors abuse both Hugging Face model/dataset files and ClawHub skills to distribute malware by injecting indirect prompts into malicious files; AI agents that read these files during development or model evaluation tasks execute the injected instructions, triggering malware installation or credential exfiltration; extends the supply chain attack surface from traditional package registries to ML model repositories · Hugging Face / ClawHub
Four chained vulnerabilities (TOCTOU sandbox write escape, TOCTOU sandbox file read, shell allowlist bypass, and owner-level privilege escalation) that can be combined to achieve stealthy full-host compromise starting from a single malicious plugin or prompt injection inside the OpenClaw sandbox. Chain: (1) initial foothold via malicious plugin or prompt injection; (2) CVE-2026-44113 + CVE-2026-44115 to read sensitive credentials and files outside the sandbox; (3) CVE-2026-44118 to escalate to owner-level control; (4) CVE-2026-44112 to write backdoors and establish persistence outside the sandbox. · OpenClaw
Various malware + cryptocurrency scams · ClawHub / OpenClaw
First confirmed self-replicating supply chain worm targeting AI coding agent configuration files. Injects hidden instructions using zero-width Unicode characters (U+200B, U+200C, U+FEFF) into CLAUDE.md and .cursorrules files — invisible to human code reviewers but executed by AI agents on next session load. Captures SSH keys, AWS credentials, GitHub tokens, and cryptocurrency keystores then exfiltrates to TeamPCP C2 infrastructure (83.142.209.0/24, Megalodon C2 at 216.126.225.129:8443). · npm / GitHub
First documented case of an AI agent used operationally in a supply chain attack: payload included 'hackerbot-claw', an AI agent built on OpenClaw that performed automated reconnaissance and lateral movement targeting Kubernetes clusters. TeamPCP first compromised Trivy (a security tool) to obtain PyPI credentials — poisoning a security scanner to attack downstream users. · PyPI
npm / GitHub
skills.sh (Vercel) primary; npm and PyPI secondary; GitHub releases for payload hosting
40+ malicious skills, programmatic malware campaign, clawhub/clawdhub1 typosquats
Malicious crypto/trading skills, typosquatted exchange tools
Unicode-obfuscated instructions, DAN-style jailbreaking for exfiltration
Mixed prompt-injection + exfil; GitHub repo aztr0nutzs/NET_NiNjA.v1.2 hosts additional weaponized skills
677 malicious skills (updated June 2026; previously 354 at March 2026); all confirmed malicious by VirusTotal scan; malware disguised as productivity/utility tools across all ClawHub categories; most prolific single attacker in ClawHavoc campaign
199 malicious skills submitted via automation (one skill every few minutes); contributed to ClawHavoc campaign expansion from 341 to 1,184+ confirmed malicious entries by March 1, 2026
typosquatting record from Snyk ToxicSkills
typosquatting record from Snyk ToxicSkills
typosquatting record from Snyk ToxicSkills
Typosquatting + credential theft
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
typosquatting record from Koi ClawHavoc
33 variants (solana-07bcb through solana-ytzgw), deploys AMOS
29 variants (phantom-0jcvy through phantom-ygmjc), deploys AMOS
25 variants (wallet-tracker-0ghsk through wallet-tracker-zih4w)
23 variants (insider-wallets-finder-1a7pi through insider-wallets-finder-zzs2p)
14 variants
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
29 variants, deploys AMOS
13 variants
13 variants
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
30 variants (polymarket-25nwy through polymarket-z7lwp)
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
malware record from Koi ClawHavoc
27 variants (auto-updater-161ks through auto-updater-xsunp)
24 variants
25 variants
17 variants targeting Gmail/Calendar/Drive
Fake auth tool dropping separate payload
Fake auth tool dropping separate payload
Reverse shell to 54.91.154.110:13338 via /bin/bash -i >/dev/tcp/...
Reverse shell to 54.91.154.110:13338
Reads ~/.clawdbot/.env, POSTs to webhook.site/358866c4-81c6-4c30-9c8c-358db4d04412
Reverse shell to 45.115.38.27:4433 before starting MCP server
Reverse shell to 45.115.38.27:4433
Reverse shell to 45.115.38.27:4433
Squatter copying official Postmark MCP with hidden backdoor
GhostLoader RAT — persistent daemon, SOCKS5 proxy, live browser session cloning, clipboard monitor (every 3s for private keys/API keys), steals credentials/SSH keys/Apple Keychain/iMessage; 178 downloads before discovery; uploaded 2026-03-03
~50,000 downloads; uses evasion techniques to avoid detection; targets developer machines with malware delivery
Malicious version live ~40 minutes on 2026-03-24 (10:39 UTC); TeamPCP obtained PyPI credentials via prior compromise of Trivy CI/CD security scanner; contains multi-stage payload: credential harvest + Kubernetes lateral movement + persistent systemd backdoor; includes hackerbot-claw using OpenClaw for automated attack targeting — first AI agent used operationally in a supply chain attack; 3.4M daily downloads at time of attack; affects CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks
Second malicious version in same TeamPCP attack window (same payload as 1.82.7); both quarantined by PyPI after ~40 minutes; tracked as sonatype-2026-001357
Runtime agentic affiliate injection targeting financial-advice communities; manipulates the agent's recommendations to redirect users toward attacker-controlled affiliate links
Agentic front-running scheme; coordinates Solana meme-token pooling via the agent to manipulate token prices
AMOS dropper hidden in a README.md padded to ~22M characters to exceed automated scanner size thresholds; SHA256 b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2; originally found by JFrog, re-analyzed and republished by Unit 42
Poses as a TradingView trading assistant; delivers a macOS infostealer tracked as 'cluw'
Companion skill to ai-tradingview-assistant-for-macos; same 'cluw' macOS infostealer payload
Patient zero, 604M installs/month. Maintainer's GitHub account (jaredwray) taken over; malicious files pushed to main, then the project's own GitHub Actions release workflow published the package with VALID OIDC + SLSA provenance. Adds 'preinstall': 'node setup.mjs'. Safe version: 5.6.0
580M installs/month; same preinstall dropper as keyv@6.0.0
571M installs/month; transitive dependency of ESLint toolchains
137M installs/month
30M installs/month
16M installs/month
28M installs/month
34M installs/month
6M installs/month
Published in the 10:09:44-10:14:41 UTC burst with the rest of the cacheable family
Same maintainer as keyv/cacheable
Storage adapters compromised at 6.0.0: @keyv/dynamo, @keyv/mongo, @keyv/memcache, @keyv/valkey, @keyv/test-suite, plus Redis/Postgres/SQLite/MySQL/Etcd/compression drivers. CONTESTED: The Hacker News reported the @keyv/* adapters stayed clean; JFrog's affected-package table and SafeDep's CSV both list them at 6.0.0. Treat as compromised.
Worm propagation phase, republished with a stolen npm token
Worm propagation phase
Worm propagation phase
Worm propagation phase
Worm propagation phase, Qlik-maintained charting library
Typosquat of the legitimate paperclipai/paperclip. Skill instructions told the agent to skip npm and npx and fetch a binary straight from an attacker-controlled GitHub release, which loaded a credential stealer. The malicious install steps sat in a secondary setup-installation.md so they only surfaced when the agent actually needed to install or start Paperclip.
Typosquat of browser-use/browser-use. A lure skill whose whole purpose was instructing the agent to pip install the poisoned PyPI package below.
Browser Harness plus an added helpers.py holding the infostealer. Importing the helper ran the credential search and posted results to api[.]getpaperclipp[.]com/feedback. PyPI caught it within two hours on 2026-07-13, which is why the operators pivoted to serving payloads from GitHub releases instead.
Same infostealer, same exfiltration endpoint. Four independent triggers were recovered: Python import, CLI execution, package postinstall during Paperclip installation, and log_action during Paperclip API use. 'I never ran the CLI' does not rule out execution.
Change the search or reset the type filter.
Dates describe the source record. Recheck the linked source before acting on time-sensitive risk information.
