Researcher finds 26 vulnerabilities in 19 AI coding agents, including 12 RCEs and MCP flaws
matthew_d_green · x · 2026-09-23
Penetration tester Maximilian Hildebrand (G DATA) published a four-part series, Pwning AI Agents, systematically exposing security flaws across the AI coding ecosystem:
- Coding agents: 26 vulnerabilities found in 19 AI coding agents with over 100M combined downloads — 12 RCEs via autonomous execution of dangerous commands or allowlist bypasses, plus 14 data-exfiltration paths via markdown images
- MCP ecosystem: 5 agents mishandle MCP servers, enabling RCE and tool poisoning; MCP Inspector has an XSS that escalates to RCE; the author built MaliM, an advanced malicious MCP server, to test MCP hosts
- Read-only bypass: 17 "read-only" SQL MCP servers (including the official MariaDB server) were bypassed, allowing arbitrary data modification and file writes
Each agent and MCP server took roughly 30 minutes of spare time to break, underscoring how poor AI-agent security currently is.
More from coding & agent
- YouArt Desktop launches: AI agent edits video in CapCut, DaVinci and Premiere from client feedback — mhdfaran · 2026-11-11
- Boubou: one-command local voice AI that serves your phone and robots over Wi-Fi — LuozhuZhang · 2026-11-11
- Python 3.15 makes AttributeError actionable: suggests .append for .push mix-ups — KhuyenTran16 · 2026-11-11
- sentence-transformers maintainer releases new embedding pooling training method, code & checkpoints — tomaarsen · 2026-11-11
- droid-mcp turns your Android phone into an MCP server with 160+ tools for Claude Code — zvone1122 · 2026-11-11
- The decade of agents: simulate real customers to test your agent before launch — EXM7777 · 2026-11-11