AI in the Build Pipeline: How Software Supply Chain Security Must Evolve
Software supply chain security was already complex, but the integration of AI into the build pipeline has introduced new risks that traditional…
Tag: MCP
Webinar: How AI Is Reshaping Supply Chain Security As We Know It
A webinar hosted by OX researchers on July 22, 2026, covering AI integration's impact on attack surface, MCP server findings, and supply…
Critical Cursor Flaws Enable Zero-Click Sandbox Escape via Prompt Injection
Two critical vulnerabilities in Cursor, an AI-powered code editor, allow prompt injection attacks to escape the editor's safety sandbox and execute arbitrary…
Copilot Studio: Custom AI Agent Builder
Copilot Studio allows building custom AI agents that can reach into business systems, increasing the attack surface for poisoned tool descriptions.
Azure AI Foundry: AI Development Platform
Azure AI Foundry enables creation of AI agents that run multi-step jobs, which can be exploited via MCP tool description poisoning.
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer could allow a malicious repository to execute commands and steal a developer's cloud credentials. The…
CVE-2025-59536: Claude Code MCP Config Command Execution
A vulnerability in Claude Code allowed project-level MCP configuration to lead to command execution.
CVE-2026-30615: Windsurf MCP Config Rewrite Command Execution
A vulnerability in Windsurf allowed attacker-controlled content to rewrite local MCP config and register a malicious server, leading to command execution.
Amazon Q Developer Flaw Allows Code Execution via MCP Configs
A flaw in Amazon Q Developer could let malicious repositories run code through MCP configurations.
Sentry Error Tracking Platform Exploited in Agentjacking Attack
Sentry, an open-source error-tracking and performance-monitoring platform, was exploited in the Agentjacking attack due to its event ingestion and MCP server.