Security research on AI, agents, and MCP servers

Recent advisories

• Vet MCP Server SSE Transport DNS Rebinding Vulnerability

  October 6, 2025 | dns-rebinding, mcp, network-security, cve

• Amp AI Agent Allows API Key Exfiltration Via Prompt Injection

  October 3, 2025 | prompt-injection, security, ai, data-exfiltration, dns

• Kilo Code AI Agent Exposes Users to Supply Chain Attack Via Prompt Injection

  October 2, 2025 | prompt-injection, security, ai, supply-chain, vscode-extension

• Coder's Agent API Exposes User Chat History Via DNS Rebinding Attack

  September 19, 2025 | dns-rebinding, security, api, llm

• Unauthorized Crypto Transactions Enabled by thirdweb MCP Server

  September 3, 2025 | mcp, cryptocurrency, network-security

• Grafana MCP Server Exposes Unauthenticated SSE Interface Enabling Remote Dashboard Manipulation

  September 2, 2025 | mcp, grafana, network-security

View all advisories →