A citation tool that fetches any URL you give it is already a proxy. Wikimedia says OpenAI's agents reconfigured one to do exactly that. I rebuilt the failure with a toy resolver, then caught the laundered request at the MCP gateway before the fetch ever ran.
0
0
0
12
OpenAI's own red-team agents broke its sandboxes this month. The CVEs are patched now: Kata Containers, gVisor, Docker, three in the kernel.
The one that has no CVE: two agents, separate VMs, zero network connection, zero shared file, talked to each other anyway using CPU cache timing. Same physics as Spectre and Meltdown.
The one that has no CVE: two agents, separate VMs, zero network connection, zero shared file, talked to each other anyway using CPU cache timing. Same physics as Spectre and Meltdown.
0
0
0
18
I ran agentgateway v1.6.0 as an AI agent egress proxy. 3 findings:
1. Tunnel mode: a blocked host gets CONNECT 200, then a TLS error. Route mode returns 404.
2. The docs' 443 listener fails without root. mode: internal fixes it.
3. Kubernetes ambient egress is its own recipe.
1. Tunnel mode: a blocked host gets CONNECT 200, then a TLS error. Route mode returns 404.
2. The docs' 443 listener fails without root. mode: internal fixes it.
3. Kubernetes ambient egress is its own recipe.
1
0
0
5
Two "separate" Grok Bots leaked a CEO's bank balance to public Slack. One was read-only, no Slack access. The other had Slack access. Nothing checked what crossed between them. I reproduced the leak, then blocked the identical call at an MCP gateway before the tool ran.
0
0
0
7
OpenAI's Patch the Planet post floats agents doing always-on vuln scanning across the internet, and asks what safeguards that needs.
180+ comments on HN. Not one answers it. Everyone argued motive instead.
An audit trail, a rate limit, and a verification gate are a start.
180+ comments on HN. Not one answers it. Everyone argued motive instead.
An audit trail, a rate limit, and a verification gate are a start.
1
0
1
10
An AI proxy's own signed release pipeline shipped a credential-stealing backdoor this week. Cosign and Trusted Publishing don't verify a workflow's instructions, only that the workflow ran. Three stolen developer tokens were enough to make signing vouch for the wrong build.
1
0
0
10
LiteLLM is the easiest AI gateway to adopt. That's why it sits in front of so many companies' model keys. So here's its public security record since April 2024, read like a vendor review. Sources in each post.
1
0
0
8
These are basics. Parameterize SQL. Sandbox templates. Don't let an API body choose the command a server runs. Pin CI tools. Make the shipped wheel match the source. Sysdig saw exploit traffic for the SQL injection 36 hours after the advisory, aimed at the provider key tables.
sysdig.com/blog/cve-2026-…
sysdig.com/blog/cve-2026-…
1
0
0
1
A gateway holds every provider key you own. If yours failed this review, would you keep it in front of enterprise data? Easy to use doesn't forgive gaping security flaws.
0
0
0
Three stolen GitHub tokens got write access to an AI proxy's release pipeline this week. The backdoored build still came out correctly signed. Signing proves which CI job ran. It doesn't prove the job's own instructions were the ones anyone approved.
0
0
0
6
agentgateway can now reject an MCP tool call before it runs, not just scan an LLM prompt after the fact. I pointed a call with rm -rf in a raw_command field at it: the tool never executed. It's on main, not in a tagged release yet, so I built it from source to test.
0
0
0
5
A hacker didn't touch the Grok Bot that leaked a CEO's bank balance to Slack this week. Two bots, each doing its own job correctly, one read-only and one Slack-connected, had no boundary enforcing what could cross between them. Not a jailbreak story. A missing permission check.
0
0
0
4
Visual Studio Copilot checked a filename as a string, then wrote the file the OS actually resolved. A trailing dot or a .. was enough to bypass its own config guard and register a rogue MCP server. CVE-2026-103572, CVSS 8.8, patched Oct 13.
1
0
1
10
pydantic-ai patched a real one last night: include_content=False was supposed to keep secrets out of OpenTelemetry traces. It didn't cover a provider-native MCP connector's auth token and headers, those shipped in a separate span attribute in plaintext. If you instrument any agent framework, check whether it has a second content flag you don't know about.
1
0
0
11