Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-28 · source-backed
CVE-2026-27896 (MCP Go SDK): High-severity interpretation conflict in the official MCP Go SDK (maintained by Anthropic + Google). Go's encoding/json performs case-insensitive matching — attackers bypass WAFs by sending JSON-RPC messages with non-standard casing the SDK accepts but security tools reject. Fixed in v1.3.1. (CVE Reports)
CVE-2026-0755 (Gemini MCP Tool, CVSS 9.8): Critical command injection — execAsync passes user input directly to system call. No official patch. Maximum severity. (CyberSecurityNews)
Microsoft 365 Copilot DLP Bypass: Code defect caused Copilot to summarize emails with "Confidential" sensitivity labels, bypassing DLP policies. UK NHS reported as INC46740412. Demonstrates that enterprise AI assistants with broad data access create systematic data classification bypass risks. (BleepingComputer)
Each link below shares sources, entities, or timing with this story.
Microsoft released Copilot / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Microsoft released Copilot); both cover BleepingComputer, Copilot, Copilot DLP Bypass, DLP; cite the same source (BleepingComputer).
Microsoft released Copilot / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Microsoft released Copilot); both cover BleepingComputer, Copilot, Critical, CVE; reported by the same outlet (bleepingcomputer.com).
Microsoft released Azure / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft released Azure); both cover Anthropic, CVE, CVSS, MCP Security; overlapping topics (security, tool).
Microsoft competes with Google / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft competes with Google); both cover Anthropic, Copilot, CVE, CVSS; overlapping topics (anthropic, copilot).
Linked by a graph relationship (Microsoft competes with Google); both cover Anthropic, Copilot, Google, SDK; overlapping topics (access, anthropic, assistant, tool).
Microsoft supports MCP / Shared entities / What happened next
Linked by a graph relationship (Microsoft supports MCP); both cover Anthropic, CVE, CVSS, JSON; picks up the Anthropic thread on 2026-08-07.
Anthropic partners with Microsoft / Shared entities / Same source domain / Shared topic / What happened next
Linked by a graph relationship (Anthropic partners with Microsoft); both cover Anthropic, BleepingComputer, CVE; reported by the same outlet (bleepingcomputer.com).
Shared entities / Same source
Both cover BleepingComputer, CVE, CVE Reports, CyberSecurityNews; cite the same source (CVE Reports, CyberSecurityNews, BleepingComputer).