CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance...

sentinel-mcp

SentinelMCP — AI-Powered Cyber Defense System Google Cloud Hackathon submission — Autonomous threat detection and remediation orchestrated by Google Cloud Agent Builder Vertex AI Agent , powered by Gemini 2.0 Flash, Model Context Protocol MCP, and Dynatrace observability. The Problem Security tea...

miasma-toolkit

Miasma / Shai-Hulud toolkit Incident analysis + detection/remediation tooling for the Miasma worm a Mini Shai-Hulud variant that injects auto-run payloads into AI-agent / IDE configs and npm/GitHub repos. ⚠️ Disclaimer — no warranty. This is a community defensive toolkit provided "as is" , without...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

nono

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

sdk

@cosignet/sdk Thin, zero-dependency TypeScript client for Cosignet — human-in-the-loop approval for high-risk AI-agent actions, with payload-bound passkey signatures. Put a human in the loop before a dangerous action runs: pause it, get an explicit passkey approval from a person Face ID / Touch I...

third-thoughts

Third Thoughts A Lightless Labs research project studying AI agent behavior at scale through multi-disciplinary corpus analysis basically, throwing stuff at the wall and seeing what sticks. Named after Tiffany Aching's concept from Discworld: first thoughts agents thinking, second thoughts agents...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...

AgentGuard

AgentGuard Zero-trust sandbox for autonomous AI agents. AgentGuard wraps any AI agent LangChain, CrewAI, AutoGen, custom scripts with safety rails. One command change: root@kitploit: Before dangerous — agent has full system access python myagent.py After sandboxed agentguard run -- python...

onecli

The agent harness built for teams. A pro assistant for companies. Give every employee a secured, sandboxed personal agent. Website · Docs · Discord Quick Start Cloud-hosted: onecli.sh Self-hosted root@kitploit: git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setu...

openclaw

OpenClaw 🦞 — Your assistant, on your devices, in your chats OpenClaw is an AI assistant that runs on your devices and meets you in the channels you already use. It connects models, tools, messaging channels, and optional companion apps through one Gateway, for a single operator or for a team whos...

red-clippy

Red Clippy Your agent tests. Red Clippy keeps the record. Open-source pentest management built to be operated by an AI agent. Connect it to Claude Code over MCP and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidenc...

idamcp

IDA Pro MCP Server Dieses Projekt stellt einen Model Context Protocol MCP Server für die Integration von IDA Pro mit KI-Agenten wie Gemini, Claude und Jetski bereit. Es bietet eine Gateway-basierte Proxy-Architektur, eine eingebettete relationale SQLite-Abfrage-Engine und...

React19-fix-vibecoders

Prompt di correzione della sicurezza per React 19 e Next.js per agenti AI 🚨 VULNERABILITÀ DI SICUREZZA CRITICA - CVE-2025-55182 e CVE-2025-66478 Questa repository contiene prompt riutilizzabili per aiutare gli assistenti di codifica AI a correggere automaticamente vulnerabilità di sicurezza...

aegisagent

AegisAgent — AI Agent Runtime Security Gateway Gateway di sicurezza runtime per AI Agent: legame crittografico di ogni chiamata di strumento alla reale completazione del modello, esecuzione di policy zero-trust, isolamento in sandbox e approvazione umana in un'unica soluzione. Contesto: perché...

CVE-2026-34724

🚨 CVE-2026-34724 - Zammad 7.0.1 - Iniezione di Template Lato Server SSTI per Esecuzione di Codice Remoto RCE tramite Agente AI 📌 Panoramica Zammad è un popolare sistema di helpdesk e supporto clienti open-source basato sul web. CVE-2026-34724 è una vulnerabilità di Iniezione di Template Lato Serv...

prismsec

PrismSec 🔷 Sicherer, modularer MCP-Server für Pentesting-Tools. Kapselt 7 branchenübliche Sicherheitstools nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap in 13 registrierte MCP-Tools — einsatzbereit mit Claude, Cursor, Copilot und jedem MCP-kompatiblen KI-Agenten. Features...

CVE-2026-82233 SiYuan before v3.8.1 Path Traversal via asset.upload

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into t...

screenpipe

DOWNLOAD SCREENPIPE screenpipe | YC S26 Screenpipe remembers how you actually work Record your screen continuously locally and provide context to your agents Claude, Codex, Openclaw, Hermes, Runner... https://github.com/user-attachments/assets/70fe94eb-6d2a-47ca-b7c3-c8ead13a5b7f news 06/10 - we...