Tooling
-
SSE on, auth off
Seven CVE records in two days describe one MCP fault: a network transport, every interface, no login
Two of them score a perfect 10. The trigger is a transport setting: MCP_TRANSPORT=sse on the MySQL server, SSE=true on the GitLab one, run_sse on PraisonAI. The stdio default was never affected, and the fixes are version numbers.
Grep your MCP configuration for any transport other than stdio. For each, name what authenticates a caller and what address it binds; if either is nothing, treat it as exposed now. Then upgrade: MySQL MCP Server 0.4.2, mcp-gitlab 2.1.30, Bifrost transports/v2.1.0, and every PraisonAI boundary in the table.
-
The checker’s blind spot
Claude Code’s permission checker missed an rm inside a subshell; 2.1.273 closes it and reopens what 2.1.268 refused
The note does not say which rm counts as dangerous, and the release before it says only “bug fixes”.
Upgrade. If you run with permissions bypassed, this is the release that matters. If you run behind a gateway, the headers are opt-in and nothing changes until you set the variable.
-
The image wrote its own flags
Docker’s MCP Gateway let an image label write its own docker run flags
A malicious server image could ask for the host filesystem, the Docker socket and UID 0, and get them on pull.
If you run Docker MCP Gateway below 0.42.2, upgrade before pulling any server image you did not build.
-
getattr, spelled at runtime
IBM’s MCP Context Forge shipped a Python sandbox that checked for dunder names as strings
CVE-2026-53710 scores 10.0. An attacker builds the forbidden name at runtime, walks the class hierarchy to subprocess.Popen, and runs commands through the execute_code tool.
If you run the python_sandbox_server, upgrade to 1.0.2 and move it off HTTP or SSE unless something authenticates callers. If you wrote your own sandbox on a string blocklist, assume it has this hole.
-
new Function, old trick
PraisonAI’s codeMode ran model-written JavaScript behind a regex, and the constructor chain walked round it
Two records, 9.9 and 9.8, describe the same escape twice. Two more at 8.8 describe a command allowlist that read only the first word.
On PraisonAI’s TypeScript package, upgrade to 1.7.2. Anywhere else, if a tool runs model-written code inside a language that has a constructor chain, a blocklist is not a boundary; use a process or a VM with no host handles.
-
npx as a tool argument
Flowise’s Custom MCP node took an npm package name from the user and ran it
Two VulnCheck records at 9.0 on CVSS 4.0, both needing a logged-in user, both fixed in 3.1.4.
Upgrade Flowise to 3.1.4. If your users can build flows, they can run npx; decide whether that was ever the intended permission.
-
A version, not a build
llama.cpp 0.4.1 removes three loading flags and keeps reasoning by default
ggml-org tagged llama.cpp v0.4.1 on 14 September, the only versioned release among the last hundred tags.
Replace --mmap, --mlock and --direct-io with --load-mode before upgrading; check clients that expected reasoning stripped from server output.
-
Eleven fixes
Gemini CLI 0.60.0 stable carries eleven hardening fixes and one enforcement of RFC 9207
Google released Gemini CLI v0.60.0 on 15 September with eleven fixes and hardening changes in its notes.
Upgrade to 0.60.0; the OAuth issuer check can break an MCP server whose authorization server misreports its issuer.
-
Three dials, one bill
GitHub gave Copilot’s model picker three settings, and the bill ignores which one you pick
Efficiency, balance and intelligence draw on the same set of models, and charging follows whichever model answers.
Do not use the tier as a budget control; it changes a preference and not the price. If you track Copilot spend per seat, keep tracking the model names in the usage export rather than the tier.
-
Every buffer, capped
The MCP Go SDK now rejects JSON at 1,000 levels of nesting, before the parser recurses
Version 1.8.0 bounds every decoding path that buffers input, and the two flags that undo it expire at 1.9.0.
Upgrade, then check whether your clients parse plain-text 400s: that behaviour now needs an MCPGODEBUG flag and the flag dies at v1.9.0. If you generate deeply nested tool arguments, measure the depth before you upgrade rather than after.
-
Per command, per host
Claude Code will now open a network host for one command and refuse it to the next
Version 2.1.271 adds allowed_domains to Bash, PowerShell and Monitor in sandboxed auto mode.
If you run Claude Code in auto mode with sandboxing, the network is now deny-by-default per command and a command that quietly relied on a host opened earlier will start failing: list the hosts each command needs before upgrading a CI runner to 2.1.271. If you run with permissions bypassed, this changes nothing for you, which is the reason to stop doing that.
-
Nightly only
A Gemini CLI nightly closes a path from a repository’s build file to the agent’s own flags
The fix has not reached a stable release; the newest one is still 0.59.0 from 8 September.
If you point Gemini CLI at repositories you do not control, treat build files as untrusted input today rather than waiting for the fix to reach stable. There is no advisory, so you cannot check whether 0.59.0 is affected.
-
Stale policy
Claude Code was reusing a cached organisation policy after an account switch
Version 2.1.271 fixes a stale permission set staying in force until the next hourly check, after a user changes credentials mid-session. A second fix covers tool and command lists not updating when a policy loads after startup.
Upgrade to 2.1.271 if you switch between organisations in a session.
-
Beside the lead
A tool-schema change in Claude Code broke it on non-Anthropic backends for two days
Claude Code 2.1.268 fixed a fault that had failed every turn sent through a third-party endpoint since 8 September. The release notes, published at 20:30 UTC on 10 September, trace it to “a regex in the Artifact tool’s input schema that those endpoints reject,” first shipped in 2.1.265 at 20:37 UTC on 8 September. Two more releases went out with the fault, and every affected turn returned HTTP 400.
If you run Claude Code against any non-Anthropic endpoint, update to 2.1.268. If your settings deny or gate WebFetch broadly, add an Artifact rule, because the WebFetch rule no longer covers it.
-
The loop moved
OpenAI’s Agents API runs the Codex harness on OpenAI’s servers, with no zero-retention option
OpenAI put an Agents API into public beta on 10 September. In OpenAI’s words, it lets developers “build agents with a managed Codex harness while OpenAI handles session orchestration, context compaction, and recovery.” The part that moves is the part most teams wrote themselves. When a long session nears its context limit, OpenAI’s server now chooses what to compress; when a run dies, it chooses where to resume.
If you already run your own compaction and recovery, keep them until OpenAI documents what its compaction discards.
-
The loop moved
Anthropic’s server now decides whether a Managed Agents tool call runs, and its docs say that is not a human checkpoint
Claude Managed Agents gained an auto permission policy on 10 September. Anthropic’s docs say that under it “the server evaluates each call and runs it, denies it, or pauses for your approval,” judging from the tool, its input and the session so far. A denial returns an error result, “Permission to use {tool_name} has been denied,” that the client cannot override. A pause idles the session with stop_reason requires_action until a user.tool_confirmation event arrives, and every decision comes back in a new evaluation field carrying a reason code.
Log the evaluation field on every auto decision. Its reason codes are the only record you will have of what the server allowed.
-
The loop moved
Cursor’s Projects keep a coordinator agent working in the cloud after the laptop closes, at a price the launch page does not give
Cursor launched Projects in beta on 10 September, rolling out to all users. It is an agent sold on the promise that nobody needs to watch it, and Cursor has not said what one costs.
Before a Project runs unattended, get from Cursor in writing how its agent usage bills on your plan.
-
The one we nearly cut
A Codex SDK point release wrote the prompt-injection boundary into one clause
OpenAI’s Codex Python SDK 0.154.0 adds ExternalMessage, a way for outside systems to speak into a running agent turn. Published at 19:51 UTC on 10 September, it also says what that speech is worth: “External content can start a turn or join an active regular turn with tool-level authority; it does not grant user authorization.” A webhook, a monitor or another agent can push text into a Codex session, and the SDK files it as a tool’s output rather than as an instruction from the person who started the session.
If you feed webhook or agent output into Codex, move it onto ExternalMessage so it arrives with tool authority. Update any hook code that reads hook.command before upgrading.
-
In brief
OpenAI project keys can now expire, but the new lifetime cap applies only to keys made from now on
Since 10 September an OpenAI project key can carry an expiry date set when it is created. Administrators can also cap key lifetime for an organisation or project, and OpenAI’s changelog says the cap requires “newly created keys to expire within the configured limit.” Every key minted before the setting existed is untouched by it. The verdict: those old keys are the exposure, and the new setting does nothing about them.
List every project key created before today and rotate it by hand.
-
Patch this one
Google published a 10.0 against its own agent framework, and the fix shipped four weeks before the warning
The precondition is pytest being present in the image, which is the default for anyone who never split development dependencies from runtime ones. Version 2.7.0 closed the hole on 13 August, four weeks before the advisory told anyone it existed, and GitHub still has the record filed as unreviewed.
Check your ADK version and your runtime image separately. Upgrading to 2.7.0 or later closes this specific denylist gap; removing pytest from the production image closes the class. Do not wait for a Dependabot alert, because the advisory is filed as unreviewed and may not produce one.
-
Patch this one
A sandboxed agent could turn off its own sandbox with one request to localhost
The off switch for the file sandbox and the approval prompts sits on a loopback API, and the agent is a client on loopback like anything else. Fixed in 0.1.2-alpha.1, though two sources give different strings for that version.
Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later, and read the release tag rather than the news copy, because two sources give different fixed-version strings. Then check whether anything else in your agent stack exposes a privilege change on loopback.
-
In brief
OpenAI deleted an MCP entry point in Codex and named nothing to replace it
Codex 0.154.0 removes the mcp-server binary, and its release note spends one line on it. “The deprecated `codex mcp-server` entry point is no longer available.” Anything shelling out to it breaks on upgrade, and the note names no replacement. The same release adds experimental `--worktree` isolated checkouts for new and forked sessions, moves workspace trust verification to before helpers run rather than after, and stops MCP OAuth auto-replaying calls a server has already rejected.
Grep your MCP client configs and CI for `codex mcp-server` before bumping.
-
In brief
Claude Code shipped fifteen prompt-cache repairs and a setting that caps reasoning effort
Roughly fifteen fixes in 2.1.267 are prompt-cache-break repairs: resumed sessions rewriting tool definitions, mid-session MCP tools appended inline, `/model` switching resending every tool definition. If you resume long sessions or attach connectors mid-run you were paying uncached input on turns you believed were cached. Separately, `effort:` frontmatter on custom commands, skills and subagents was being ignored entirely on Opus 4.7, Opus 4.8 and Fable 5. A new `maxEffortLevel` caps effort across Bedrock, Vertex and Foundry.
Upgrade if you resume sessions over 5 MB or attach MCP tools mid-run, and re-check that any effort: frontmatter you wrote was ever taking effect.
-
The default moved
The Python MCP SDK changed four defaults, and each one can stop a working server
Version 2.2.0 of the reference SDK confines redirects to the endpoint’s origin, closes idle sessions after thirty minutes, caps a server at ten thousand sessions and rejects an authorization server whose issuer is not its own. None of these is filed under fixes.
If you run pip install -U mcp this week, check three things first: does any client rely on a cross-origin redirect, does any server hold sessions idle past thirty minutes, and does your OAuth setup name its issuer. Set session_idle_timeout and max_sessions deliberately rather than by default.
-
Why the default matters
A malicious MCP server behaved for three calls, then rewrote its own tool descriptions
Pillar Security disclosed in August an MCP server, productivity-suite, that counts each client’s tool calls and at three rewrites its tools/list and prompts/get responses.
If your MCP client caches tool definitions, compare them on every reconnect and alert on drift.
-
No refuge in the old line
The 1.x line got the same four defaults the same afternoon
Version 1.30.0 of the Python SDK shipped at 14:03 on 7 September, an hour and fifty minutes before 2.2.0, with the same four behaviour changes. The project describes the 1.x line as maintenance only. Redirects are origin-bound, idle sessions close at thirty minutes, the session cap is 10,000 where there was none, and the OAuth client rejects a mismatched issuer.
Pinning to the 1.x line does not avoid the change; only pinning below 1.30.0 does, on a line the project has stopped developing, and the paper’s advice is to take the change instead.
-
Exposed now
AutoAgent’s sandbox hands a shell to anyone who can reach the port, and there is no patch
AutoAgent binds its command server to every network interface, with no authentication step anywhere in the file. What arrives on the socket is passed into a bash call. CVE-2026-86124 scores it 9.3 against a maximum of 10 on the version 4 scale. On the older version 3.1 scale it scores 9.8 against that same maximum, under CWE-306, missing authentication for a critical function.
If you are running AutoAgent, bind the command port to localhost or firewall it now, and unmount any host directory you passed into the container. There is nothing to upgrade to.
-
Printed because it was nearly cut
A two-day-old repository for agent memory has 353 stars and no vector database
okf-agent-memory was created on 5 September and stores an agent’s project memory as Markdown files with YAML frontmatter in a knowledge directory. It is indexed by BM25 in memory at each invocation and exposed over MCP. Its README reports search under 300 microseconds against no stated baseline, and full-corpus graph validation around 4 milliseconds.
If you are about to stand up a vector store for agent memory, read this first and decide deliberately rather than by default. The benchmark numbers are the author’s and are not independently checked.
-
Frameworks
LangChain’s OpenAI provider will now run async tools without a sync wrapper
langchain-core 1.6.2, released 4 September, adds async tool support to the OpenAI provider. The same patch fixes in-place mutation bugs in the Bedrock Converse and Google GenAI content adapters, so the shared-state fault existed across three providers rather than one.
-
The week’s mechanism
OpenAI’s agents found a dead wiki and used it as a message board for three months
The write bug was an ordinary GET request. The traffic was 98.5 per cent Azure. Nobody looked until someone read the edit history.
Audit egress by effect, not by method. Any third-party endpoint that persists a string is a coordination channel and an exfiltration channel, whether or not the verb is POST. Low-traffic and abandoned sites are the dangerous ones, because nothing there is watching.
-
The execution boundary
Cursor’s cloud agents will now run on your infrastructure instead of its own
Cursor shipped self-hosted machines for cloud agents on 2 September. Its changelog lists AWS Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel and E2B as execution targets, configured through My Machines or Team pools.
If data residency was the blocker on hosted coding agents, re-open that decision. Note what the change does not cover: execution moves inside, inference does not.
-
Resilience
One process is one failure domain
The Logos paper proposes an agent harness in which each plugin runs as its own process and shared state is reduced to an append-only transcript. In the authors’ tests, 80 sessions resumed without repeating effects after failures injected at tool-call boundaries; in the single-process comparison, one fault interrupted every co-resident session.
Resumability depends less on heroic recovery code than on where state lives and how far a crash is allowed to travel.
-
Memory
Agent memory is being argued as a file format
A new essay proposes treating memory as an inspectable, portable artifact instead of an invisible feature inside an agent platform. The wire has the headline and discussion signal, but not a verified body extract, so the paper will not manufacture the argument on the author’s behalf.