AI Security

The Claude Code cross-user data leak is not a publicly confirmed Anthropic breach, but the June 29, 2026 GitHub report is serious enough to treat as an incident pattern: foreign credentials appeared in a session and were allegedly used against a production PostgreSQL host. What Happened, And What Is Actually Confirmed? The cleanest reading is this: a public GitHub issue in anthropics/claude-code alleges cross-session credential leakage, while the visible public thread does not show an Anthropic confirmation of root cause as of July 9, 2026. That distinction matters. If you call it a confirmed cross-tenant breach, you are going beyond the public evidence. If you ignore it because it is “just an issue,” you are underreacting to a credible security report in the product’s own repository. ...

Introduction — The Clean Repo Paradox In late June 2026, Mozilla’s 0DIN research team published something that should make every developer using AI coding agents stop and think. They demonstrated a full reverse shell compromise against Claude Code using a GitHub repository that contained zero lines of malicious code. No obfuscated JavaScript. No hidden base64 payloads. No suspicious imports. The repo would pass any code review, any SAST scanner, any human eyeball. And yet, when Claude Code opened it and followed the README instructions, a reverse shell connected back to the attacker within seconds. ...

If you’re building AI agents with Microsoft’s Semantic Kernel, stop and check your version right now. Two critical vulnerabilities — CVE-2026-26030 (CVSS 9.9) and CVE-2026-25592 (CVSS 9.9) — turn prompt injection from a content-quality annoyance into a full host compromise primitive. I’ve spent the last few weeks digging into both exploits, and the implications go far beyond Semantic Kernel itself. Here’s the uncomfortable truth: AI models are not security boundaries. Every parameter an LLM can influence when calling a tool is attacker-controlled input. If your framework passes that input to eval(), a file write function, or a shell command without validation, you’ve built a remote code execution vector that only needs a cleverly crafted prompt to trigger. ...

On June 16, 2026, the Crawl4AI project released version 0.8.7 with a fix for CVE-2026-53753 — a pre-authentication remote code execution vulnerability with a CVSS score of 9.8. The exploit requires a single HTTP POST request to the /crawl endpoint, no authentication, and it works against the default Docker image. If you run Crawl4AI in any production or development capacity, this is the most important security update of 2026 for your AI pipeline. ...

Why This Guide Exists Sentry MCP hit 751 stars on GitHub in July 2026, and for good reason — it’s the most polished error-monitoring MCP server I’ve seen. It lets Claude Code, Cursor, and Codex CLI query Sentry issues, triage errors, and even run AI-powered search across your projects. But after the agentjacking disclosure in June 2026, I’ve had a lot of teams ask me: “Is Sentry MCP safe to use?” ...

Your coding agent trusts the tools it reads. That trust is the vulnerability. When an attacker poisons a Sentry error report, a Datadog monitor alert, a PagerDuty incident, or a Jira ticket description with hidden prompt injection payloads, your agent doesn’t know the difference between a legitimate instruction and a hijack attempt. I’ve spent the last few months digging into this attack surface across the four most common integrations teams wire up to Claude Code, Cursor, and Codex. Here’s what I found and exactly how to fix it. ...

What Is Agentjacking? In June 2026, researchers at Tenet Security disclosed a new attack class they called agentjacking — and it’s the most practical AI agent supply chain attack I’ve seen in production. The premise is deceptively simple: an attacker injects a malicious error event into your Sentry project, and when your AI coding agent (Claude Code, Cursor, or OpenAI Codex CLI) reads that event via the Sentry MCP server, it executes the attacker’s embedded payload with your system privileges. ...

On June 25, 2026, the Mozilla 0DIN team demonstrated an attack that should change how every team deploys AI coding agents. They published a normal-looking Python repository on GitHub. A developer cloned it and pointed Claude Code at it. The agent read the README, installed the requirements, hit a routine initialization error, and — trying to be helpful — ran the suggested fix. That fix queried a DNS TXT record, decoded the value, and executed it as a shell command, opening a reverse shell on the developer’s machine. ...

If your team is running AI coding agents in production — Claude Code, Cursor, Windsurf, GitHub Copilot — you’ve probably already felt the gap between traditional AppSec and what these agents actually do. Traditional security tools scan committed code. Agents don’t just write code; they install MCP servers, download skills, run shell commands, and make API calls. By the time a traditional SAST scan runs, the damage is already done. ...

Here’s a scenario I keep coming back to: you’re running PraisonAI locally to test a multi-agent workflow, you open a browser tab to check something on a forum, and within two seconds, a website you’ve never heard of has read your SSH private key, dumped your AWS credentials, and exfiltrated both to a server in another country. No pop-up, no redirect, no visible sign anything happened. That’s CVE-2026-56076 in practice. It’s a cross-origin agent execution vulnerability in PraisonAI versions before 1.5.128, rated CVSS 8.6 (v4) / 8.1 (v3.1). The POST /agui endpoint combines three failures — no authentication, hardcoded Access-Control-Allow-Origin: *, and Starlette’s Content-Type-agnostic JSON parsing — that lets any website a victim visits silently execute arbitrary agent commands and exfiltrate the results. I’ve been tracking the PraisonAI vulnerability landscape since the CVE-2026-44338 authentication bypass hit (exploited within 3 hours 44 minutes of disclosure), and this one scares me more because it bypasses every traditional network boundary. Your VPN, your firewall, your network ACLs — none of them matter when the attack comes from inside the browser. ...