Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-04 · source-backed
The Express server on port 3444 calls app.listen with no host argument so it binds all interfaces, sends Access-Control-Allow-Origin: *, requires no auth, and passes the prompt and agentName request-body fields into child_process.spawn with shell: true. Any host on your LAN, or any web page you visit while it's running, gets arbitrary command execution. Confirmed at runtime on v1.28.13. The only validation on prompt is a 10-character minimum length. GitHub Advisories
Each link below shares sources, entities, or timing with this story.
CVE-2026-45018 covers Chainlit >=2.4.0rc0 <2.12.0. With features.mcp.enabled = true, POST /mcp accepts a user-controlled fullCommand for stdio transport. validate_mcp_command() checks the executable name against an allowlist and never inspects arguments, so npx -y -c '<command...
— Security researcher Ari Marzouk disclosed 30+ vulnerabilities (24 CVEs) affecting Cursor, GitHub Copilot, Windsurf, Zed, Kiro, Roo Code, Junie, and Cline. The devastating finding: every tested AI IDE is vulnerable because none accounts for autonomous LLM agent behavior in th...
A Rust local HTTP proxy that translates Anthropic API calls into Cursor agent CLI invocations, reading your Cursor auth token from the macOS keychain and spawning Claude Code with proxy env vars set. MIT, 37 stars, 2 commits. It disclaims affiliation with both Anthropic and An...
A novel vulnerability in OpenClaw: the current working directory path was embedded into agent system prompts without sanitization. Control characters in directory names (newlines, Unicode bidi/zero-width markers) break prompt structure and inject attacker instructions. Patched...
GitHub published four advisories against omnigent-ai/omnigent v0.1.0, the meta-harness that runs Claude Code, Codex and Pi under policy and sandboxing. GHSA-jrrm-9hc7-2v3h at CVSS 9.0 lets any user with session edit rights overwrite a shared template agent via PUT /sessions/{i...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.