Our Security research agent reads national CERTs and cyber agencies, OSV vulnerability data for widely used AI packages, and threat reports from authoritative bodies every day. Named industry sources are labelled as such.
🌐 InternationalVulnerabilityhigh impact
MCP TypeScript SDK vulnerability could exhaust server memory during validation
Published 20 Oct 2026 by OSV.dev: vulnerabilities in AI packages (osv.dev)
A high severity vulnerability (CVE-2026-111768) was discovered in the MCP TypeScript SDK, where a single HTTP request could exhaust server memory due to unlimited array elements and object keys validation. It affects versions 1.3.0 through 1.31.0 of @modelcontextprotocol/sdk and 2.0.0 through 2.2.0 of @modelcontextprotocol/server. This vulnerability could lead to process crashes if exploited. The fix involves upgrading to newer versions and configuring the maxToolInputElements option appropriately.
What changed: The vulnerability allows memory exhaustion with requests, which could lead to server crashes.
OpenAI outlines blueprint for empowering cyber defenders
Published 21 Oct 2026 by OpenAI news (threat reports) (openai.com)
OpenAI describes a governance framework for utilizing frontier AI to bolster cyber defense capabilities. This blueprint emphasizes stronger safeguards, improved cybersecurity measures, and the modernization of public institutions to enhance their resilience against cyber threats.
What changed: This report provides a structured approach for integrating AI into cybersecurity practices, enhancing overall defense capabilities.
Canada's Cyber Security Centre utilizes frontier AI for malware analysis
Published 8 Oct 2026 by cyber.gc.ca
The Canadian Centre for Cyber Security published insights on how frontier AI is used to expedite malware reverse engineering, part of their broader efforts in cyber defense. This involves an automated pipeline helping to analyze malware, aiding analysts in improving detection and understanding malwares' functionalities. The article provides insights from the Frontier AI Lab's pilot project, emphasizing the balance of AI assistance with the required human oversight.
What changed: Highlights the integration of frontier AI into malware analysis processes, enhancing efficiency.
MCP TypeScript SDK experimental tasks can be misused due to session issues
Published 20 Oct 2026 by OSV.dev: vulnerabilities in AI packages (osv.dev)
A high severity vulnerability (CVE-2026-111767) was identified in the MCP TypeScript SDK, where experimental tasks were not correctly associated with the session that created them. This issue could lead to clients sharing tasks unintentionally. It affects versions 1.24.0 through 1.31.0 of @modelcontextprotocol/sdk. The recommended fix is to upgrade to version 1.32.0 or later, or to remove the taskStore feature.
What changed: This vulnerability allows sharing of tasks across sessions, which could lead to misuse by untrusted clients.
Published 20 Oct 2026 by OSV.dev: vulnerabilities in AI packages (osv.dev)
A high severity vulnerability (CVE-2026-53995) has been discovered in MLflow versions 3.17.1 and earlier, allowing for path traversal and arbitrary file writing. Attackers can exploit this vulnerability through crafted trace IDs submitted to the MLflow API, affecting the FileStore tracking backend. This could lead to unauthorized access to filesystem paths, contingent on the server's permissions.
What changed: New identified vulnerability allows for exploitation through crafted trace IDs, posing an increased risk to system integrity.