Loading story…
Researchers disclosed two high-severity flaws affecting AI tooling: CVE-2026-30950 in AutoGPT and CVE-2026-59950 in the Model Context Protocol (MCP) Python SDK. In AutoGPT, an authenticated insecure direct object reference in the /api/chat/sessions/{session_id}/assign-user endpoint allowed any logged-in user to reassign another user’s chat session with a single PATCH request if the session ID was known. The bug affected autogpt-platform-backend versions 0.6.36 through 0.6.50 and was fixed in 0.6.51; successful exploitation could expose full chat histories, pasted files, execution context, and credential-related metadata while also locking the victim out of the session.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
A report described CVE-2026-59950 as a high-severity cross-site WebSocket hijacking flaw affecting Model Context Protocol Python SDK server WebSocket handling. The write-up explained that a hijacked browser connection could send arbitrary JSON-RPC commands and also documented a mitigation using TransportSecurityMiddleware to validate hosts and origins.
Bugflation summarized a backfill of eight publicly corroborated vulnerabilities and included the AutoGPT session hijacking issue among them. The report said the vulnerabilities were corroborated by public CVE records, vendor advisories, and fixes, while noting ZeroPath's discovery attribution was self-reported.
ZeroPath Research publicly disclosed CVE-2026-30950, an authenticated IDOR vulnerability in AutoGPT that lets any logged-in user hijack another user's chat session if they know the session ID. The disclosure said affected versions were 0.6.36 through 0.6.50 and that exploitation could expose chat history, pasted files, and execution context while locking out the victim.
The AutoGPT project committed a fix for CVE-2026-30950 on 2026-03-08, addressing an authorization bypass in the chat session assignment endpoint. The patched release was identified as autogpt-platform-backend version 0.6.51.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcezeropath.com
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026