Loading story…
A logic flaw in @dynatrace-oss/dynatrace-mcp-server allowed indirect prompt injection to silently create Dynatrace notebooks without operator consent, exposing a gap in how AI-connected tools handle state-changing actions. Tracked as GHSA-PC2W-4MQ8-32QW and affecting versions before 1.8.7, the issue stemmed from a missing human-approval gate in create_dynatrace_notebook and absent risk metadata, enabling attackers to create persistent notebooks that could contain deceptive content or expensive Dynatrace Query Language queries. Dynatrace fixed the vulnerability in version 1.8.7 by adding approval checks and tool metadata to better distinguish risky and idempotent actions.
The disclosure comes amid broader industry efforts to impose stronger governance on AI agents and workflow automation platforms as enterprises connect models to internal tools and external systems. Security guidance from vendors and practitioners has stressed that natural-language tool descriptions are not effective permission boundaries, that external MCP servers enforce their own authentication and authorization models, and that per-user OAuth can unintentionally propagate excessive privileges. New enterprise platforms are also emphasizing isolated execution, credential protection, access mapping, logging, and deterministic policy enforcement, reflecting growing concern that AI agents with tool access require trusted registries, strict argument validation, approval gates, and auditable controls before they can safely act in production environments.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Tines launched 3B, a new AI-assisted enterprise workflow platform that lets users describe workflows in natural language while executing them as conventional code. The company said the platform includes governance controls such as isolated execution, credential protection, access mapping, logging, and admin monitoring.
Dynatrace addressed a logic vulnerability in @dynatrace-oss/dynatrace-mcp-server by releasing version 1.8.7 and Pull Request #529. The fix added requestHumanApproval() checks and destructiveHint and idempotentHint metadata to prevent silent notebook creation without operator consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcethenewstack.io
Open sourcecvereports.com
Open sourcesalesforce.com
Open sourcethenewstack.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026