Subscribe

AI Security

How safe are AI agents, plugins and MCP servers?

A dated advisory and incident database for AI plugins, IDE AI extensions and MCP, plus a posture matrix: approvals, allow/deny rules, sandboxing, OAuth, verified listings, admin allowlists, audit logs and disclosure.

Advisories
189
Critical
11
Posture cells verified
69/120
Tools
12

Latest advisories and incidents

Open the database (189) →
  1. Mediumpatched

    Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody

    MCP Inspector · GHSA-rwv7-mh2c-ff2p

    MCP protocol, SDKs and registry
  2. Medium 6.1patched

    MCP App escapes its CSP by navigating its own frame

    MCP Inspector · GHSA-h9j8-vj8g-v3gg

    MCP protocol, SDKs and registry
  3. Medium 6.5patched

    MCP Inspector can stall on a malicious tool output schema regex.

    MCP Inspector · GHSA-2fw8-7jmw-r937

    MCP protocol, SDKs and registry
  4. High 7.5patched

    Missing user ID claims collapse authenticated principals and allow MCP session hijacking

    MCP C# SDK · GHSA-x863-g495-4cjc

    MCP protocol, SDKs and registry
  5. Not Ratedresolved

    Malicious 'Anthropic.claude-code' 2.1.312 / 2.1.313 in Cursor's extension marketplace

    Cursor VS Code Extension Marketplace

    Cursor Claude Code
  6. Medium 5.3patched

    mcp-server-git: nested gitdir file bypasses --repository confinement

    MCP reference servers · GHSA-w766-5x43-whvw

    MCP protocol, SDKs and registry
  7. High 7.7patched

    TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace

    Claude Code · CVE-2026-88968 · GHSA-5xjx-9qx6-jcrv

    Claude Code
  8. Not Ratedopen

    Postman Desktop auto-installs Codex / Claude Code plugins and pre-trusts its own startup hook

    Postman Desktop 12.33.4–12.35.1

    Codex Claude Code Cursor
  9. Medium 6.3patched

    fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)

    MCP reference servers · GHSA-v38p-wf49-hx2j

    MCP protocol, SDKs and registry

Security posture matrix

What each tool documents about approvals, isolation, admin control and disclosure
YesPartialNoUnknownHover a cell for notes. Click it to open the source.
ToolTool-call approval promptsPer-tool allow / denySandboxingOAuth for remote MCPVerified marketplace listingsAuto-install / auto-update controlAdmin allowlistsAudit logsData retention / training opt-outSecurity disclosure page
Claude CodeAnthropicYesYesYesYesNoPartialYesPartialYesYes
Claude apps (claude.ai / Desktop)AnthropicUnknownUnknownUnknownYesUnknownUnknownYesYesYesUnknown
ChatGPT (apps & connectors)OpenAIUnknownUnknownUnknownYesUnknownUnknownYesYesUnknownUnknown
CodexOpenAIYesYesYesYesUnknownUnknownYesYesUnknownYes
CursorAnysphereYesYesYesYesPartialPartialYesYesYesYes
GitHub Copilot (VS Code)GitHub / MicrosoftYesPartialPartialPartialUnknownUnknownPartialYesUnknownYes
Windsurf / Devin DesktopCognitionYesYesUnknownYesUnknownUnknownYesUnknownYesYes
Gemini CLIGoogleYesYesPartialYesUnknownUnknownPartialPartialUnknownUnknown
KiroAWSYesYesPartialYesUnknownPartialYesUnknownUnknownUnknown
ZedZed IndustriesYesYesUnknownYesUnknownUnknownUnknownUnknownYesYes
ClineClineYesPartialUnknownYesUnknownUnknownUnknownUnknownUnknownYes
JetBrains AIJetBrainsPartialUnknownUnknownUnknownUnknownUnknownUnknownUnknownUnknownUnknown

Features

What each column means and who supports it
Tool-call approval promptsAsks the user before running tools, shell commands or MCP calls by default9 of 12 yesPer-tool allow / denyRules that pre-approve or block specific tools, commands or MCP tools7 of 12 yesSandboxingOS-level or container isolation for agent commands3 of 12 yesOAuth for remote MCPOAuth sign-in to remote MCP servers instead of pasted tokens10 of 12 yesVerified marketplace listingsVendor review, signing or verification of plugins, extensions or MCP listings0 of 12 yesAuto-install / auto-update controlDocumented behaviour and controls for automatic plugin/extension installs and updates0 of 12 yesAdmin allowlistsOrg admins can restrict which MCP servers, plugins or connectors are allowed7 of 12 yesAudit logsAdmin-visible audit log or compliance export of agent / integration activity5 of 12 yesData retention / training opt-outDocumented control over training use and retention5 of 12 yesSecurity disclosure pagePublic vulnerability disclosure channel or published advisories7 of 12 yes

Security updates

All →

  1. MCP Inspector: Unvalidated runtimeArguments and identifier in server.json import & unvalidated URL scheme in web ElicitationUrlModalBody

    Medium. Status: patched. GHSA-rwv7-mh2c-ff2p. MCP Inspector advisory.

    Source

  2. MCP Inspector: MCP App escapes its CSP by navigating its own frame

    Medium (CVSS 6.1). Status: patched. GHSA-h9j8-vj8g-v3gg. MCP Inspector advisory.

    Source

  3. MCP Inspector: MCP Inspector can stall on a malicious tool output schema regex.

    Medium (CVSS 6.5). Status: patched. GHSA-2fw8-7jmw-r937. MCP Inspector advisory.

    Source

  4. AI security posture: 12 tracked across 10 capabilities

    69 of 120 cells are verified against vendor docs and 51 are still marked unknown. The most widely confirmed capability is OAuth for remote MCP (10 of 12).

  5. MCP C# SDK: Missing user ID claims collapse authenticated principals and allow MCP session hijacking

    High (CVSS 7.5). Status: patched. GHSA-x863-g495-4cjc. MCP C# SDK advisory.

    Source

Also in the hub

MCP ClientsAI PluginsIDE IntegrationsAI PricingTool profiles

Weekly, free

What changed in AI integrations

One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.

You'll finish signing up on beehiiv.