Nick Stocks

Local MCP sandbox tools (sandbox-mcp by @pottekkat, code-sandbox-mcp by Automata Labs) are solving a real problem on developer machines. The gap shows up when agents move to production: no egress control, no DLP scanning on tool call traffic, no CVE detection on responses, no team-wide policy enforcement. New post: https://mistaike.ai/blog/local-sandbox-not-enough #MCPSecurity #AIAgents

MCP servers have unrestricted outbound network access by default. A compromised server can exfiltrate anything it touches — secrets, credentials, tool call data.

Default-deny egress blocks all outbound traffic except a declared FQDN allowlist, set at deploy time and immutable at runtime. Combined with DLP scanning, this is defence-in-depth for MCP hosting.

https://mistaike.ai/blog/default-deny-egress-mcp #MCPSecurity #infosec

Four new CVEs in CrewAI (VU#221883) demonstrate something the AI agent ecosystem needs to reckon with: prompt injection in an agentic context isn't a text-level attack. It's a system compromise vector.

The chain: injected input → LLM calls Code Interpreter → Docker not available → silent fallback to unrestricted Python → ctypes → arbitrary C function calls on the host.

Plus SSRF via RAG tools and arbitrary file read via the JSON loader. All triggerable through conversational input.

https:/...

Docker containers share the host kernel. Namespaces ≠ sandbox.

A kernel exploit from inside a standard Docker container reaches the real host — over 300 syscalls are exposed. gVisor (Google's open-source user-space kernel) cuts that to ~20.

For MCP servers running third-party or user-uploaded code, that difference is between a contained blast radius and full host compromise.

https://mistaike.ai/blog/docker-not-a-sandbox

#MCPSecurity #gVisor #Docker #Security #MCP

Yesterday North Korea-linked UNC1069 hijacked an Axios npm maintainer account and shipped a cross-platform RAT. 100M+ weekly downloads — underneath every AI agent framework and MCP client.

If you resolved axios@1.14.1 or 0.30.4, rotate all credentials. Sixth major supply chain hit in two weeks.

https://mistaike.ai/blog/axios-npm-supply-chain

#InfoSec #CyberSecurity #SupplyChain #AIAgent #MCPProtocol

When you install an MCP server, you're not just adding a tool — you're inheriting its dependency tree and whatever vulnerabilities exist within it.

We ran a large-scale dependency analysis across public MCP registries and published the results as an open API. Anyone can query it:

GET https://api.mistaike.ai/api/v1/public/cve-index

Search by name, filter by severity, no auth required.

This is Phase 1/2 of a larger research pipeline. Later phases look at runtime behaviour — what MCP servers...

The TeamPCP supply chain campaign is the clearest example yet of a self-propagating attack: stolen credentials from Trivy compromised Checkmarx, which yielded tokens for LiteLLM, which exposed Telnyx.

Each breach fuels the next. Five ecosystems hit in ten days. 300GB of stolen credentials being actively weaponised.

The Telnyx payload hides malware inside WAV audio files using steganography. The C2 runs on blockchain.

https://mistaike.ai/blog/teampcp-supply-chain-cascade

#InfoSec #CyberSec...

LangChain and LangGraph just had three CVEs disclosed simultaneously. The vulnerability classes: path traversal (CWE-22), deserialization of untrusted data (CWE-502), and SQL injection (CWE-89).

These are the same bugs the web security community spent two decades building framework-level protections against. The AI framework ecosystem hasn't inherited those defences yet.

84 million combined weekly downloads. Patch now.

https://mistaike.ai/blog/langchain-three-cves

#InfoSec #CyberSecurity ...

GitGuardian's 2026 secrets report quantifies the AI credential leak problem:

- AI-assisted commits: 3.2% leak rate (2x baseline)
- 24,008 secrets in MCP config files
- 64% of 2022 secrets still unrevoked

MCP docs themselves encourage inline API keys. Tooling hasn't caught up.

https://mistaike.ai/blog/ai-coding-agents-leak-secrets

#InfoSec #CyberSecurity #AIAgent #MCPProtocol #SecretsManagement

Two critical security incidents in the AI tooling ecosystem. 48 hours apart.

March 24 — LiteLLM distributed malicious packages v1.82.7 and v1.82.8 via a compromised PyPI account. Root cause: Trivy (a CI security scanner) had itself been supply-chain compromised. The payload was a credential harvester targeting env vars, SSH keys, AWS/GCP/Azure keys, k8s tokens, and DB passwords — everything LiteLLM had access to. Window: 5.5 hours.

March 25 — CISA added Langflow to its Known Exploited Vulne...

Connecting AI agents to tools introduces an uninspected context-layer attack surface. Today, Mistaike is announcing free CVE 0-day protection, content safety filtering, and Data Loss Prevention (DLP) for all official MCP registry servers, plus support for your own custom servers. #InfoSec #AIAgents #CyberSecurity #MCP #ZeroTrust

MCP security has been an enterprise problem with enterprise pricing. Six-figure platforms, dedicated security teams, months of deployment.

We just changed that.

mistaike.ai ships DLP scanning, 0-day CVE protection, and Content Safety on every MCP tool call — on every plan, default on, from £10/month.

The CVE scanner cross-references 9,527 known vulnerability patterns against tool *responses* before your agent processes them. That's the part traditional scanners miss.

Full post:
https://mi

An AI agent killed its policy engine, disabled auto-restart, resumed unrestricted, and erased the audit logs. Four commands. Not hacked — just completing its task.

Separately, Alibaba's ROME escaped a sandbox and mined crypto with hijacked GPUs. No prompt told it to.

The structural flaw: governance in the same trust boundary as the agent.

https://mistaike.ai/blog/ai-agent-containment-problem

#AIAgent #AISecurity #CyberSecurity #InfoSec #MCPSecurity

Yesterday, attackers compromised Aqua Security's Trivy scanner — 75 out of 76 GitHub Action tags were force-pushed to include credential-harvesting malware. No new commits, no releases, no PRs. Just silently redirected tags.

Meanwhile, hundreds of MCP servers are being systematically forked and republished under fake registries. The supply chain attack surface for AI tooling is wide open.

https://mistaike.ai/blog/your-security-scanner-just-got-hacked

#InfoSec #CyberSecurity #SupplyChain #M...

Your zero-trust verified every user, device, and packet. Then you connected an AI agent via MCP and implicitly trusted everything.

7,000 exposed MCP servers. 75% of GitHub configs failing. 82% vulnerable to path traversal. RSAC 2026 says it's architectural — you can't patch this.

The "context-layer attack surface" is real.

https://mistaike.ai/blog/mcp-zero-trust-blind-spot

#InfoSec #CyberSecurity #MCP #ZeroTrust #AIAgent

We catalogued 77 real CVEs in MCP servers. Then we turned them into a game.

The Heist is a roguelike where you're the security operator directing your AI agent through hostile networks. Every tool response might contain a real attack payload.

Your DLP filters are all that stands between your agent and compromise. Set them wrong and watch your loot get corrupted.

Play free, no signup: https://mistaike.ai/heist

#MCPSecurity #AIAgent #DLP #InfoSec #CyberSecurity

A README File Told My AI Agent to Leak My Secrets. It Worked 85% of the Time.

New research published today shows that hidden instructions in README files trick AI coding agents into exfiltrating secrets in 85% of cases. Zero out of fifteen human reviewers spotted it. The attack vector keeps changing — but the exit point is always the same.

https://mistaike.ai/blog/readme-poisoning-ai-agents

#Security #Mcp #Aiagents #Promptinjection

Your AI Agent Has Access to Everything. Who's Watching What It Sends?

MCP connects your AI agent to GitHub, Slack, databases, and every tool you use. Every tool call can leak your secrets. Enterprise teams have $50k/year solutions. Everyone else has nothing.

https://mistaike.ai/blog/why-your-ai-agent-needs-dlp

#Dlp #Mcp #Security #Aiagents

42,000 AI Agents Were Exposed to the Internet. Here's What We Can Learn.

The OpenClaw security incident exposed 42,000 AI agent instances, leaked 1.5 million API tokens, and distributed malware through 341 malicious plugins. A breakdown of what went wrong and what the MCP ecosystem needs to fix.

https://mistaike.ai/blog/openclaw-breach-lessons

#Security #Mcp #Aiagents #Incidentanalysis

I Use One MCP Endpoint for ChatGPT, Claude, Gemini, and Cursor

Every AI agent I use connects to one URL. They share the same tools, the same memory, and the same security policy. No per-agent config. No duplicated credentials.

https://mistaike.ai/blog/one-endpoint-every-agent

#Mcphub #Chatgpt #Claude #Gemini