- Home
- AI agents
- Security threats to agents
- Agent platform vulnerabilities
Govern and secure · Security threats to agents
AI agent platform vulnerabilities: CVEs, who patches them and what you must do
Agent platform vulnerabilities are flaws and compromises in the software agents run on: cloud agent services, agent SDKs and starter kits, MCP packages and IDE extensions, and local agent apps. Unlike prompt injection, those disclosed in 2025 and 2026 came with a CVE or an advisory and a remedy, and the remedy is sometimes yours to apply.
In this guide: 83 pages
Key takeaways
- Agent platforms ship classic bugs. The 2026 record for AWS AgentCore alone includes code injection in a starter toolkit, command injection in the Code Interpreter sandbox, prompts written into logs and a harness flaw that ran tools without the model.
- Who acts depends on the layer. Microsoft fixed EchoLeak and two Copilot Studio CVEs server-side with no customer action; the AgentCore SDK and toolkit flaws needed customers to upgrade, re-import agents or purge logs.
- A server-side fix can leave you unable to establish your own exposure window from the vendor record, so keep the agent logs that would show misuse before the fix.
- Treat agent SDKs, MCP packages and local agent apps as dependencies with an owner, a pinned version and a patch window, as you would a web framework.
How are platform vulnerabilities different from prompt injection?
A platform vulnerability is a flaw in code that a patch removes, or a compromised package that you remove. Prompt injection comes with any agent that reads untrusted text and acts on it, and no patch removes it. Both matter, and they need different processes: vulnerability management for the first, design controls for the second.
Invariant Labs made the distinction for the GitHub MCP toxic agent flow in May 2025: the issue sat in how the agent combined a public issue, private repositories and an outbound channel, and the GitHub MCP server code had no flaw to patch. Compare CVE-2026-18830 in the AgentCore harness, where caller-supplied tool-use blocks let authenticated users run configured tools without model mediation or its security controls; AWS fixed it with server-side validation (bulletin 2026-073, 4 Aug 2026).
This page covers the patchable kind. The prompt injection page in this guide covers the other, and the security topic page lists both in one incident table.
Which agent platform vulnerabilities were disclosed in 2025 and 2026?
At least eleven with a primary record, spread across vendor cloud services, a managed harness, SDKs and toolkits, packages and extensions, and local agent apps. The table groups them by layer and shows who had to act, which is the question your patch process needs answered.
Agent platform vulnerabilities with a CVE record, vendor bulletin or researcher write-up, as of 2 Nov 2026. CVSS scores are those shown on the CVE records; where Microsoft and NVD differ, both are given.
| Layer | Vulnerability | What it allowed | Your action |
|---|---|---|---|
| Vendor cloud service | EchoLeak, CVE-2025-32711, Microsoft 365 Copilot (CVSS 9.3; 11 Jun 2025) | Zero-click data exfiltration from one crafted email | None; fixed server-side, no known exploitation |
| Vendor cloud service | CVE-2026-21520, Copilot Studio (CVSS 7.5; 22 Jan 2026) | Information disclosure to an unauthenticated network attacker | None; fixed by Microsoft |
| Vendor cloud service | CVE-2026-80098, Copilot Studio (Microsoft 9.3, NVD 10.0; 3 Sep 2026) | Elevation of privilege through improper signature verification | None; fixed by Microsoft |
| Managed harness | CVE-2026-18830, AgentCore harness (CVSS 8.1; 4 Aug 2026) | Authenticated callers ran tools without model mediation | None; fixed server-side by AWS |
| SDK | CVE-2026-12530, AgentCore Python SDK (CVSS 7.3; 17 Jun 2026) | Arbitrary commands in the Code Interpreter sandbox | Upgrade to 1.6.1 |
| SDK | CVE-2026-15737, AgentCore Python SDK 1.4.8 and 1.5.0 (CVSS 5.7; 16 Jul 2026) | Raw prompts and responses written into OpenTelemetry spans in CloudWatch | Upgrade to 1.5.1 and purge the affected logs |
| Starter toolkit | CVE-2026-4269 (CVSS 7.5; 16 Mar 2026) and CVE-2026-105812 (CVSS 9.0; 6 Oct 2026) | Code injection at build time; code execution on import of generated agents | Upgrade to 0.1.13 and 0.3.14; for the second, re-import agents and replace artifacts |
| IDE extension | CVE-2025-8217, Amazon Q Developer for VS Code 1.84.0 (23 Jul 2025) | Injected code shipped in a release through an over-scoped GitHub token | Remove 1.84.0 from machines; use 1.85.0 |
| MCP package | postmark-mcp 1.0.16 on npm (September 2025) | A copy of every email sent through it went to an attacker | Remove it, check email logs, rotate credentials sent by email |
| Local agent app | CVE-2026-25253, OpenClaw (CVSS 8.8; 1 Feb 2026) | Token theft by one click, then approvals and sandbox switched off | Upgrade to 2026.1.29 and rotate tokens |
| Agent backend | Moltbook database exposure (Wiz, February 2026) | About 1.5 million agent API tokens readable through a client-side key | Rotate any agent token registered there |
NVD lists further AgentCore CVEs that this page has not reviewed one by one (CVE-2026-11393, CVE-2026-16796 and CVE-2026-106032, June to October 2026). Search NVD by product name every month, and read the vendor bulletin as the primary record.
Why does a fix with "no customer action" still need your attention?
Because the fix is invisible to you, and so is the exposure window before it. Microsoft's records for EchoLeak, CVE-2026-21520 and CVE-2026-80098 say the issue was fully mitigated with no customer action, which leaves you unable to tell from your own systems whether anything happened first.
A few habits help. Keep agent audit logs and traces long enough to cover a disclosure window; EchoLeak was found in January 2025 and published in June. Know which tenant features each agent uses, so a bulletin can be matched to your estate in minutes. Ask the vendor, through your account team, whether any exploitation touching your tenant was observed.
Vendor fixes can also be partial. Brave re-tested Perplexity's Comet browser after its fixes and found the injection still possible, and vendors often close one exfiltration path, such as image rendering, while the root cause stays. Keep your own egress and approval controls in place after a vendor fix.
How do you run vulnerability management for agents?
Inventory every agent component as software, subscribe to the bulletins that cover it, pin versions and set a patch window by severity. The steps that are new for agents are re-importing generated agents, purging logs a flaw polluted and rotating every token the agent held.
- Inventory components per agent: platform and region, SDK and toolkit versions, MCP servers and their packages, IDE extensions and local agent apps on developer machines. Link the list from the agent's registry record.
- Subscribe to the primary feeds: the Microsoft Security Response Center, AWS security bulletins, the GitHub advisory database for open-source SDKs, and an NVD keyword search for each product name.
- Pin versions and review updates. postmark-mcp shipped 15 clean versions before 1.0.16 turned malicious, so an unpinned dependency would have pulled the bad version in on its own.
- Read the remediation line as closely as the score. CVE-2026-105812 required re-importing agents with toolkit 0.3.14 and replacing artifacts, and CVE-2026-15737 required purging logs, so upgrading alone left the exposure in place.
- Rotate what the agent held. After the Salesloft Drift token theft of August 2025, Cloudflare found and rotated 104 API tokens in the stolen support data; after the OpenClaw flaw, users had to rotate their gateway tokens.
- Rehearse the kill switch. Know how to block, stop or quarantine each agent on its platform before a bulletin arrives; the agent lifecycle management page in this guide lists the switches per platform.
How do Microsoft, AWS and Google implement it?
Where each vendor publishes agent vulnerability records, and what protects you while a fix lands, as seen 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Where records appear | Microsoft Security Response Center update guide and CVE records | AWS security bulletins, for example 2026-073 for the AgentCore harness | Researcher disclosures, for example Tenable's Gemini Trifecta of 30 Sep 2025; Google Threat Intelligence Group reports |
| Typical fix for a service flaw | Server-side mitigation marked as needing no customer action | Server-side validation for service flaws; SDK and toolkit upgrades for code you run | Server-side changes, such as rolling back a vulnerable model and blocking an exfiltration path (Gemini Trifecta) |
| Runtime protection while you patch | Defender real-time protection for agents (Foundry and Copilot Studio agents in preview); Defender for Cloud threat protection for AI services (GA) | AgentCore Policy at the Gateway | Model Armor on Google Cloud MCP servers and Agent Gateway |
Severity depends on who scores it. Microsoft rated CVE-2026-80098 at 9.3 and NVD at 10.0, and the CVE record and Microsoft give different dates (3 and 8 Sep 2026), so quote the scorer with the score.
Frequently asked questions
Do we need to patch Copilot Studio or Microsoft 365 Copilot ourselves?
For the service flaws disclosed so far, no. Microsoft fixed EchoLeak, CVE-2026-21520 and CVE-2026-80098 on its side and listed no customer action. You still own the agents built on top, their connectors and credentials, and the logs that would show misuse before a fix.
Which agent components most often need customer action?
Code that runs in your build or on your machines: SDKs, starter toolkits, generated agent code, MCP packages and IDE extensions. In the 2025 and 2026 record every item in this group needed customer action, set by its advisory: an upgrade, a re-import, a log purge, a package removal or token rotation.
Is a malicious MCP package a vulnerability or an attack?
An attack, handled by the same process. postmark-mcp impersonated a legitimate MCP server, so there was no bug to patch, only a package to remove. The response matches a vulnerability response: find where it is installed, remove it, check what it touched and rotate the credentials it saw.
How fast should we patch an agent SDK?
On the clock you use for internet-facing dependencies of the same severity. Agent SDKs often run with tool credentials and broad network access, so a code execution flaw in one is closer to a server compromise than to a library bug. Set the window by CVSS score and by what the agent can reach.
More in Security threats to agents
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- CVE-2025-32711 (EchoLeak)
- CVE-2026-21520
- CVE-2026-80098
- CVE-2026-80098 in the National Vulnerability Database
- Security bulletin 2026-073 (AgentCore harness)
- CVE-2026-18830
- CVE-2026-12530
- CVE-2026-15737
- CVE-2026-4269
- CVE-2026-105812
- CVE-2025-8217
- Security bulletin AWS-2025-015 (Amazon Q Developer extension)
- Information regarding the malicious postmark-mcp package
- CVE-2026-25253 (OpenClaw)
- Exposed Moltbook database reveals millions of API keys
- AgentCore CVEs, keyword search
- GitHub MCP toxic agent flow
- Indirect prompt injection in Perplexity Comet
- Response to the Salesloft Drift incident
- The Gemini Trifecta
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner