Recent content on Aonan Guan
Enterprise MCP gateways centralize authentication, routing, and tool authorization. Agentgateway versions before v1.4.0 let a session from one route reuse a sensitive backend under another route's permissive policy. Agentgateway v1.4.0 fixes the issue. MCP 2026-07-28 removes protocol sessions from the core.
For the second time in five months, Anthropic Claude Code's network sandbox lets a process inside reach hosts the user's policy says to block, and exfiltrate any data the process touches. Every Claude Code release from 2.0.24 (sandbox GA on 2025-10-20) through 2.1.89 was vulnerable to a SOCKS5 hostname null-byte injection. About 5.5 months and ~130 versions, including the release that silently…
Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent are vulnerable to prompt injection via GitHub comments — turning PR titles, issue bodies, and issue comments into attack vectors for API key and token theft.
A prompt injection vulnerability in Strix AI pentesting agent enables arbitrary command execution through malicious project files. The tool designed to red-team others gets red-teamed by its own target — cloud credentials exfiltrated through the project you are scanning.
Google Gemini CLI, Anthropic Claude Code, and Vercel add-skill share the same path traversal flaw: the name field in skill metadata is passed to path.join() without validation, enabling VS Code hijacking and SSH key injection — invisible to the user.
CVE-2026-27735: MCP Git Server git_add path traversal vulnerability enables credential exfiltration via GitPython's missing boundary validation. A single git_add call reads SSH keys, kubeconfig, and AWS credentials into Git history — invisible in the working directory. Third case of capability laundering in MCP ecosystems.
MCPB bundles are ZIP files. MCP developers implementing custom extraction must handle ZIP security risks like path traversal, silent overwrite, and symlink attacks.
CVE-2025-68143: Anthropic Git MCP Server's git_init bypasses CWD boundaries, enabling attackers to create repositories in sensitive directories and exfiltrate credentials via routine Git tool calls.
A schema validation flaw in Anthropic's Memory MCP Server enables VS Code terminal profile hijacking through capability laundering. Despite being patched, Anthropic declined to assign a CVE and closed the report as 'informative'.
A critical sandbox misconfiguration in Anthropic's sandbox-runtime could have left Claude Code users' system at significant risk. Despite fixing the issue silently, Anthropic did not assign a CVE to their flagship product Claude Code.
Discovered a critical RCE vulnerability in Microsoft's OmniParser/OmniTool where an unauthenticated execution surface on the VM controller could allow attackers to remotely control GUI agents. Microsoft assigned CVE-2025-55322 and shipped a fix.
Discovered a classic path traversal vulnerability in Microsoft’s new Agentic Web protocol (NLWeb) that could expose sensitive files including API keys, credentials, and configuration files. The vulnerability was particularly critical as it could compromise AI agents’ “cognitive engines” by leaking LLM API keys. The research was featured in an exclusive interview with The…