Topic

AI Agents: news, advisories and analysis

8 articlesUpdated 7 Oct 2026

CyberSecureToday covers AI Agents across 8 articles published between 9 Sep 2026 and 7 Oct 2026. The coverage includes 5 vulnerability advisories and 3 analysis or guidance pieces. 5 advisories are rated critical or high severity.

Stories on AI Agents most often intersect with MCP, IAM and Remote Code Execution, with Technology, Cloud & SaaS the most affected sector. The most recent story, “LlamaIndex Workflows & Tool Calling Arbitrary Command Execution Flaw CVE-2026-41905”, was published 7 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
LlamaIndex Workflows & Tool Calling Arbitrary Command Execution Flaw CVE-2026-41905
GitHub Security Advisory documents an unauthenticated command injection defect in LlamaIndex Workflows agent tool calling pipelines.
Aisha Noor7 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS Loom AI Agent Platform Flaw Gave Unauthenticated Attackers Super-Admin Control
CVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.
Aisha Noor4 Oct 20267 min read
ThreatsCloud & SaaSHigh
AWS Bedrock Agent Runtime Vulnerability Exposes Temporary IAM Credentials CVE-2026-62181
AWS Security Bulletin details an environment leakage defect in Amazon Bedrock Agent action group runtimes permitting cross-session IAM credential exposure.
Aisha Noor28 Sep 20268 min read
ThreatsCloud & SaaSHigh
CrewAI Multi-Agent Framework Flaw CVE-2026-37007 Allows Remote Code Execution via Path Traversal Tool Poisoning
Critical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Mei-Lin Chen22 Sep 202616 min read
InsightsCloud & SaaS
Malicious MCP Servers Exploit OAuth Metadata Flaw in Rust SDK to Hijack Enterprise Agent Tokens
Critical OAuth metadata flaw CVE-2026-63127 in rmcp Rust SDK allows rogue Model Context Protocol servers to capture enterprise agent tokens and impersonate identities.
Priya Raman20 Sep 202613 min read
ThreatsCloud & SaaSCritical
Swarm of OpenAI agents flooded RubyGems to execute code and harvest data on RubyDoc servers
Security researchers trace a coordinated supply-chain assault on RubyGems to thousands of autonomous OpenAI agents that achieved code execution on RubyDoc.info infrastructure.
Mei-Lin Chen13 Sep 20267 min read
ResearchCloud & SaaS
GitSpawn flaws in AI coding agents execute arbitrary code from malicious repository configurations
Manifold Security discovers GitSpawn: eight vulnerabilities across seven AI coding tools (Claude Code, Cursor, Codex) that execute attacker code from repository .git/config.
Priya Raman12 Sep 20267 min read
ResearchCloud & SaaS
DeepSeek Harness Vulnerability Allowed AI Coding Agents to Disable Their Sandbox
OX Security and VulnCheck disclosed CVE-2026-82533 in DeepSeek Harness, where prompt injection allowed sandboxed AI coding agents to disable their own security isolation.
Mei-Lin Chen9 Sep 20265 min read