Incident Library
Real security incidents involving AI agents, coding assistants and MCP connectors: what happened, who was affected, what was fixed, and how to protect yourself. Every fact links to the original advisory or research write-up.
15 of 15 incidents
CVE-2026-25536: MCP TypeScript SDK could route responses to the wrong client
@modelcontextprotocol/sdk (npm) · Fixed in: 1.26.0
According to GitHub Advisory Database's advisory (Feb 4, 2026), reusing one StreamableHTTPServerTransport across client requests, or one server instance across transports, caused a cross-client data leak; both are most common in stateless deployments.
Last verified against sources: October 16, 2026
CVE-2025-68143/68144/68145: three flaws in the reference Git MCP server
mcp-server-git (PyPI) · Fixed in: 2025.12.18
According to GitHub Advisory Database's advisory (Dec 17, 2025), git_init accepted arbitrary filesystem paths and created repositories without validating the location.
Last verified against sources: October 16, 2026
CVE-2025-66414: MCP TypeScript SDK did not enable DNS rebinding protection by default
@modelcontextprotocol/sdk (npm) · Fixed in: 1.24.0
According to GitHub Advisory Database's advisory (Dec 2, 2025), HTTP-based MCP servers run on localhost without authentication, and without enableDnsRebindingProtection, could be reached by a malicious website through DNS rebinding.
Last verified against sources: October 16, 2026
CVE-2025-59536: Claude Code could run project code before the trust dialog
@anthropic-ai/claude-code (npm) · Fixed in: 1.0.111
According to GitHub Advisory Database's advisory (Oct 3, 2025), a bug in the startup trust dialog meant Claude Code could be tricked into executing code in a project before the user accepted the dialog.
Last verified against sources: October 16, 2026
CVE-2025-53967: figma-developer-mcp command injection (<= 0.6.2)
figma-developer-mcp (npm) · Fixed in: 0.6.3
Community MCP server, not an official Figma product.
Maintained by GitHub user GLips (repository GLips/Figma-Context-MCP), as given in the advisory.
According to GitHub Advisory Database's advisory (Sept 30, 2025), the figma-developer-mcp server passed unsanitized input parameters to child_process.exec, letting an attacker inject system commands.
Last verified against sources: October 16, 2026
Compromised Nx package versions used AI prompts to hunt for secrets ("s1ngularity")
nx and @nx/* plugins (npm) · Fixed in: Any other version (malicious versions deleted from npm)
According to Nx's advisory (Aug 27, 2025), malicious versions were published to npm by an attacker: the nx package and some plugin packages shipped code that scans the file system, collects credentials, and posts them to GitHub as a repo under the user's account.
Last verified against sources: October 16, 2026
CVE-2025-54135: Cursor agent could create .cursor/mcp.json without approval (fixed 1.3.9)
Cursor · Fixed in: 1.3.9
According to Cursor's advisory (Aug 2, 2025), Cursor allowed writing in-workspace files without approval; editing an existing dotfile needed approval but creating a new one did not.
Last verified against sources: October 16, 2026
CVE-2025-54136: Cursor did not re-ask approval when a trusted MCP entry changed
Cursor · Fixed in: 1.3
According to Cursor's advisory (Aug 1, 2025), once a collaborator approved a harmless MCP server, an attacker could modify the already trusted MCP configuration (for example in a shared GitHub repository) and swap in a malicious command without any warning or re-prompt.
Last verified against sources: October 16, 2026
CVE-2025-8217: malicious code shipped in Amazon Q Developer for VS Code 1.84.0
Amazon Q Developer for VS Code extension · Fixed in: 1.85.0
According to AWS's bulletin AWS-2025-015 (July 23, 2025), the extension had an inappropriately scoped GitHub token in its CodeBuild configuration. With it, a threat actor committed malicious code to the open-source repository, and it was automatically included in a release.
Last verified against sources: October 16, 2026
CVE-2025-6514: mcp-remote OS command injection (0.0.5 to 0.1.15)
mcp-remote (npm) · Fixed in: 0.1.16
According to GitHub Advisory Database's advisory (July 9, 2025), mcp-remote, a tool MCP clients use to connect to remote MCP servers, was exposed to OS command injection when connecting to an untrusted MCP server.
Last verified against sources: October 16, 2026
CVE-2025-53109 / CVE-2025-53110: Filesystem MCP server directory escape
@modelcontextprotocol/server-filesystem (npm) · Fixed in: 2025.7.1
According to Cymulate's research and GitHub Advisory Database's advisory (July 1, 2025), a naive prefix-matching check let any path that merely begins with the approved directory bypass the filter (CVE-2025-53110).
Last verified against sources: October 16, 2026
Researcher demo (General Analysis): a support ticket led an MCP assistant to expose private tables
Supabase MCP (with service_role) · Fixed in: No CVE; mitigation is configuration
Demonstration with dummy data; not a reported breach of Supabase.
According to General Analysis' research (July 2025), in a demonstration, instructions planted in a customer support ticket redirected a developer's MCP assistant (used from Cursor) into reading private tables and copying them into a customer-visible reply.
Last verified against sources: October 16, 2026
CVE-2025-49596: MCP Inspector RCE from the browser (< 0.14.1)
@modelcontextprotocol/inspector (npm) · Fixed in: 0.14.1
According to GitHub Advisory Database's advisory (June 13, 2025), MCP Inspector, a developer tool for testing MCP servers, had no authentication between the Inspector client and its proxy, so unauthenticated requests could launch MCP commands over stdio.
Last verified against sources: October 16, 2026
CVE-2025-32711: AI command injection in Microsoft 365 Copilot
Microsoft 365 Copilot · Fixed in: See Microsoft advisory
According to GitHub Advisory Database's advisory (June 11, 2025), AI command injection in M365 Copilot allowed an unauthorized attacker to disclose information over a network.
Last verified against sources: October 16, 2026
Researchers show prompt injection via a public GitHub issue can make an agent expose private repo data (Invariant Labs, May 26, 2025)
GitHub MCP server · Fixed in: No CVE; mitigation is configuration
Invariant Labs describes this as an agent-design risk; no CVE was assigned.
According to Invariant Labs' research (May 26, 2025), an attacker could hijack a user's agent through a malicious GitHub Issue in a public repository and coerce it into leaking data from private repositories.
Last verified against sources: October 16, 2026