Invariant Labs researchers demonstrated in April 2025 that a malicious Model Context Protocol server could silently exfiltrate a user's entire WhatsApp message history by hijacking a tool description,…
Three independent security research teams found that AI coding assistants Amazon Q Developer, Claude Code, and Windsurf auto-execute workspace configurations before developers see a consent prompt, en…
A new arXiv study, 'Exposed by Design,' found more than 21,000 Model Context Protocol (MCP) server instances reachable from the public internet, with 91.8% of audited servers lacking OAuth and 687 too…
More than 21,000 internet-facing Model Context Protocol (MCP) server instances are exposed, with 91.8% of 640 audited production servers lacking OAuth authentication, according to research published i…
Microsoft patched a record 622 security flaws in July, triple the previous monthly record, while China's 360 Digital Security Group has used an AI agent to uncover nearly 1,000 previously unknown bugs…
OX Security disclosed CVE-2026-30623, a flaw in all official Model Context Protocol SDKs that allows arbitrary shell command execution via configuration files. Anthropic confirmed the behavior was int…
The Model Context Protocol (MCP) offers three transports: stdio, Streamable HTTP, and SSE. The choice between them is determined by server location: use stdio when the server runs on the same machine …
MCP servers, which allow AI tools to read files and call APIs, often run on individual developer machines with no oversight, creating security risks. The Bifrost AI gateway and Bifrost Edge aim to bri…
Anthropic released Claude Fable 5, its first Mythos-class model, which benchmarks over 10% better than Opus 4.8 on coding tasks and features a 1M context window and deep MCP integration for multi-agen…
A critical remote code execution vulnerability, tracked as CVE-2026-40933, has been discovered in Flowise, an open-source platform for building LLM workflows and AI agents. The flaw exists in Flowise'…
Cybersecurity researchers identified a malicious npm package named "mouse5212-super-formatter" designed to upload files from the "/mnt/user-data" directory used by Anthropic's Claude AI assistant. SOC…