mcp

The AI Attack Lab: MCPwned and the Offensive Agent Cycle

John Z Black Apr 27, 2026

AI Security #mcp #ai-security #red-team #prompt-injection #ai-soc

New tools like MCPwned and Sable are giving red teamers (and attackers) the ability to inject prompts, audit MCP handshakes, and evade AI SOCs. The attack surface for AI systems is wide open.

The Mythos Breach: Your AI Is Only as Secure as Its Weakest Integration

John Z Black Apr 21, 2026

AI Security #anthropic #ai-security #supply-chain #mcp #oauth #third-party-vendors

Unauthorized access to Anthropic's Mythos model via a compromised OAuth app exposes the real security threat in the agentic AI era: third-party integrations that inherit trust they haven't earned.

Three CVEs in Flowise, a Prompt Injection in Grafana, and the Growing Case That Your AI Stack Is the Target

John Z Black Apr 8, 2026

AI Security #ai-security #flowise #grafana #prompt-injection #mcp #rce

Flowise has a perfect 10.0 CVSS under active exploitation. GrafanaGhost injects prompts through metric names. The attack surface isn't the AI model. It's everything around it.

Your AI Coding Tools Have an Invisible Attack Surface. One Model Falls for It Every Time.

John Z Black Apr 7, 2026

AI Security #mcp #unicode #gpt-5 #claude #supply-chain #ai-security #prompt-injection

Researchers find 63 MCP servers with hidden Unicode characters in tool descriptions, and GPT-5.4 follows the invisible instructions with 100% compliance.

AI Code Gets CVEs Now.

John Z Black Mar 29, 2026

AI Security #ai-security #vibe-coding #ncsc #mcp #model-context-protocol #prompt-injection #rsac #developer-security #ai-code

The UK's NCSC called AI-generated code an 'intolerable risk,' researchers found all seven major MCP clients vulnerable to attack, and 35 CVEs in March alone traced directly back to AI-written code.

Agentic AI Just Had Its First Major Enterprise Data Breach — and the Attacker Was the AI

John Z Black Mar 22, 2026

AI Security #agentic-ai #mcp #owasp #meta #ai-security #prompt-injection #enterprise-security

A Meta AI agent followed its instructions and caused a major internal data leak. Combined with the new OWASP MCP Top 10, this is the clearest real-world picture yet of what agentic AI security failures actually look like.

AI Agents Have an Infrastructure Problem — and Researchers Just Proved It

John Z Black Mar 11, 2026

AI Security #ai-security #mcp #red-team #llm #privacy #ai-agents

MCP protocol flaws, a 38-researcher red team exercise, and LLM-powered deanonymization all landed the same week. AI agent security isn't a future problem. It's a right now problem.