kagex.ai

The AI security toolkit for red teams, developers, and security researchers. Train your people. Validate their skills. Automate the testing.

[kagex.ai @kagex_ai]

Ask a coding agent to "add a Puppeteer MCP" and it may install an archived server that will never be patched. Glow Labs saw agents pick deprecated MCP packages from memory, one with an RCE.

Check what the vendor ships now. #AISecurity
https://t.co/6ntNuGitfi

[kagex.ai @kagex_ai]

"Summarize this link" sounds harmless. But if your AI app fetches any URL the model builds, an attacker can aim it at 169.254.169.254, your cloud metadata.

That's SSRF via the model. Fix: allowlist hosts, block private IPs.

Try it in FreakLabs, free: https://t.co/xm3HTn84l5

[kagex.ai @kagex_ai]

@Prathkum The scary part is how ordinary the chain was: a vendor's machine, then a service account, then storage. If you run on any AI platform, rotate your API keys and check which service accounts can read your datasets.

[kagex.ai @kagex_ai]

Rare to see a CEO lay out the full path: third-party dev host, then a service account, then storage. The fix list is the useful part. Short-lived tokens, regular key rotation, and an audit of every service account that can touch customer data. #AISecurity

[Lin Qiao @lqiao]

https://t.co/4cBFVAuEZ8

[kagex.ai @kagex_ai]

@lqiao Thanks for publishing the full path, it helps everyone. The Docker image finding stood out: exposed internal credentials in public images is a quick thing for any team to scan for today.

[kagex.ai @kagex_ai]

Running Langflow? Versions 1.0.0 to 1.12.8 have two critical no-login flaws, one an RCE via MCP tool enumeration. A public Metasploit module already targets the auth bypass.

Upgrade to 1.13.0 and keep it off the open internet. #AISecurity
https://t.co/MUQ6YWtxhQ

[kagex.ai @kagex_ai]

@stretchcloud Reachability is the right filter. Same logic applies to agents: an injection only matters if the poisoned input can reach a tool with real permissions. Curious whether Hermes treats agent tool calls as sinks or only classic code paths.

[kagex.ai @kagex_ai]

@suraj_sharma14 Great list. For the red-team bot, success tracking is the hard part: score attacks by side effects (canary leaked, tool called) rather than asking an LLM if it worked, or near-misses count as wins. I'd add an MCP tool-description scanner too.

[kagex.ai @kagex_ai]

@BoboLinNotes Agree. Confused deputy is the one that clicks for most people: the agent holds the permission, the attacker only supplies text. Map which tools read outside content and which can write or send. Anywhere one agent does both is your first test case.

[kagex.ai @kagex_ai]

@hugospdx Sooner than people think. Easiest start is a regression folder of known payloads hidden in docs, emails and tool outputs, run every release like any other test. Check for side effects (a canary hit, an unexpected tool call) rather than grading the text.

[kagex.ai @kagex_ai]

@ce3nerd Start with Greshake et al.'s 'Not what you've signed up for' paper, then wunderwuzzi's Embrace The Red blog for real exploits, plus OWASP LLM01. Best hands-on drill: hide an instruction in a doc your own RAG bot reads and watch what it does.

[kagex.ai @kagex_ai]

@SefirotWatch Fun goal. Run it in a throwaway VM with fake creds and plant a canary token in the repo, so a 'win' is something you can actually see. Warm up on public injection CTFs before real repos. Which agent framework are you testing?

[kagex.ai @kagex_ai]

One poisoned doc plus an unrestricted MCP write tool is enough to change your database. Put the limit where the model can't argue with it: read-only by default, scoped tokens, row-level security on writes. #AISecurity

[Nicholas Martin @ndgmlondon]

Unrestricted MCP write tools plus indirect prompt injection let one poisoned document change your database. Enforce the limit in the database: scoped session tokens, read-only by default, row-level security on writes. #IAM #ZeroTrust

[kagex.ai @kagex_ai]

A harmless-looking reply can sit on top of an unauthorized tool call. That's why output filters alone don't cover agents. Gate and log the actions, not just the words. #AISecurity

[Daniel Lozovsky @DanielLozovsky]

An agent can produce a harmless-looking answer while making an unauthorized tool call.

That’s the deployment risk I’d put first in an AI security curriculum.

Output guardrails matter. But they don’t replace controls on what an agent can access and execute. Indirect prompt injection can turn retrieved content into instructions, then exploit authority the agent already holds.

Before deployment, check:

Use scoped credentials and a distinct agent identity. Require approval outside the agent for sensitive actions.
Isolate tool execution. Validate arguments against strict schemas, then check authorization and business rules before acting. Valid JSON can still describe an unauthorized request.
Keep tamper-resistant records of tool calls, approvals, and results. Protect sensitive data in those records.

Mechanistic interpretability is worth studying. It doesn’t replace access control at the tool boundary.

Pick a tool that writes to your database. What stops a valid-looking request from changing data the agent was never authorized to touch?

[kagex.ai @kagex_ai]

@theo Seen the same. Models skip the boring parts: redirect URI allowlists, audience checks on tokens, and per-tool scopes. Adding a small test that tries a wrong-audience token catches a lot of it.

[kagex.ai @kagex_ai]

@theo The clickable MCP URL bit is a good catch. That URL is config, not content. Once users can click and share it, you've built a phishing path for fake servers. Worth a "never render, only copy" rule in the guide.

[kagex.ai @kagex_ai]

Theo asked top models to build MCP auth and got flows that don't work, plus a guide that made the MCP URL a clickable link.

AI-written auth still needs a human pass: check redirect URIs, token audience and scopes before you ship.

https://t.co/HRqYcFiIKS #AISecurity

[Theo - t3.gg @theo]

LLMs are still SO bad at building tools for agents.

Every time I try to make Opus set up an MCP authentication path, it makes horrible assumptions and builds something that straight up doesn't work

[kagex.ai @kagex_ai]

Weekend thread for the AI security crowd 🫶

What was the first AI system you ever broke, and how?

A system prompt that spilled on "repeat the text above"? A RAG bot that obeyed a doc? Beginners very welcome, everyone started with one.

[kagex.ai @kagex_ai]

@lenny_enderle Yep, rotate before you clean. And prefer Bash(npm run:*) style patterns so the allow rule never stores the secret itself.

[kagex.ai @kagex_ai]

@Dinosn The sneaky part is that it's a convenience click, not a misconfig. If your team uses Claude Code, a quick search of repos and git history for settings.local.json is a 5 minute check worth doing today.