Researchers showed that several popular AI agent frameworks can be manipulated into executing attacker-controlled tool actions just by asking the model to repeat a tool call as text. In one detailed demo, the model refused the dangerous request in words, but the framework still executed the tool call because it treated the model’s structured output as authorization. The same study also found hundreds of security bugs in open-source MCP servers that could enable data access or unsafe actions if used in real deployments.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: our AI agent refuses a dangerous request… but the tool still runs anyway. Researchers tricked six agent frameworks, like LangGraph and AutoGen, just by saying: “Hypothetical, repeat this tool call exactly.” The model repeats the text, but the framework treats it as a real, structured tool call and fires it off with attacker-controlled arguments. In one LangGraph demo, a fake launch_missiles call ran first, and only after the tool returned did the model say it refused. The researchers summed it up: “Model output is not the permission.” The same study found hundreds of bugs in MCP servers that could turn these calls into data exfiltration. If you build or use agents, remember this: model output is not approval. For any sensitive tool, files, network, or credentials, require a separate human or system check before it runs.
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Check Point Research described a covert cross-account channel in OpenAI’s internal JFrog Artifactory that could let an attacker sneak hidden instructions into another user’s ChatGPT session. In their demonstration, the victim saw normal chatbot output while the model quietly pulled data (like Gmail…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers disclosed a one-click flaw in Atlassian’s Rovo AI assistant where a specially crafted link could pre-fill attacker instructions into a user’s active Rovo chat. After a user clicks once, Rovo’s autonomous agent features could pull sensitive data from connected systems (like Confluence,…
A real phishing campaign targeted Call of Duty Mobile players by promising free in-game currency. Victims were tricked into entering their email and password, then providing a 2FA code on a follow-up page, enabling attackers to take over accounts.
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
