sage

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

nah

expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it compares • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool call...

scopeblind-gateway

protect-mcp Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls. protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy, blocks what breaks the rules before it runs, and signs an offline-verifiable Ed25519 receipt...

MakerChecker

🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...

node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

CVE-2026-109300

Open WebUI versions 0.6.31 through 0.11.4 are vulnerable to a stored cross-site scripting (XSS) flaw in the Markdown renderer . The root cause is that the renderer treats user-authored tool-call details blocks as tool output, mounting their embeds attribute in script-enabled iframes. An authentic...

EUVD-2026-97602

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

ROPE

ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...

EUVD-2026-97122

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768 zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768

A vulnerability exists in zhayujie CowAgent up to version 2.2.0 within the Streaming Tool-Call Argument Handler component. The issue stems from the json.loads function, where specific manipulation leads to an allocation of resources (CWE-770, CWE-400). This flaw can be triggered via a remote atta...

PYSEC-2026-4124 Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

PT-2026-105873

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

sage v0.13.0

Sage Safety for Agents — Agent Detection & Response for AI coding assistants Sage is a lightweight security layer that protects AI agents from executing dangerous actions. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them against multiple threat detection layer...

PYSEC-2026-3946 Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

CVE-2026-78230

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

CVE-2026-78230 AshAi aggregate tool can read field-policy-protected fields

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

PT-2026-87175

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

Improper Authorization

Spring AI is vulnerable to Improper Authorization. The vulnerability is due to per-request tool restrictions not being fully enforced during tool-call dispatch, allowing a tool unavailable to the current request to be invoked and potentially enabling privilege escalation...

CVE-2026-82579 AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...