Daily digest · 2026-08-13

Daily Digest, 2026-08-13

TL;DR: The tool layer under AI agents keeps failing in ways the agent itself cannot catch. A new scanner finds paths from plain English straight into shell commands on MCP servers, while researchers showed a malicious MCP server can steal SSH keys and source code by splitting the request into harmless-looking pieces. The human click-to-approve step everyone treats as a backstop misses about a third of dangerous requests. On shared hosting, one customer can time the cache and rebuild another customer's prompt, and attackers are already running agents at scale: a Chinese-speaking actor pointed a DeepSeek agent at 1,200-plus hosts at a security firm.

Top stories

• VIPER-MCP finds taint-style paths from natural language to shell in MCP servers (arXiv cs.CR, 2026-08-13). Detects and exploits handlers that pass agent-supplied text into shell, file and network operations without a check, which turns an injected instruction into a read of whatever the server can reach.
• KV cache timing side channel lets one tenant reconstruct another's prompt (arXiv cs.AI, 2026-08-12). Prefix reuse in multi-tenant inference leaks through cache-hit latency, so prompt content sent to a hosted model is not isolated from other customers; cache partitioning becomes a data control.
• GhostSplice: malicious MCP servers split instructions so coding agents leak SSH keys and source (The Hacker News, 2026-08-11). Fragmented requests that each look routine pull secrets, source and customer data out of a coding assistant, even after the blunt version was refused. Per-instruction refusal checks do not stop staged exfiltration.
• Humans in the loop miss a third of dangerous coding-agent requests (The Register AI, 2026-08-06). Reviewers approved roughly a third of harmful requests including dumping AWS credentials, which means consent UX cannot be the last gate before credential disclosure.
• Chinese actor turns a DeepSeek agent on a security firm, targeting 1,200+ hosts (Dark Reading, 2026-08-03). An intercepted agentic campaign aimed at proxyjacking more than 1,200 hosts, giving defenders a real sample of LLM-driven lateral movement rather than a lab result.
• EFF opposes the Youth AI Privacy Act and KOSA as Senate Commerce advances them (EFF Deeplinks, 2026-08-03). Both bills cleared committee on August 5; the age-verification path would force identity collection from every user of an AI service, cutting against minimization.

Also notable

• AI-assisted research finds unauthenticated SharePoint RCE chain (CVE-2026-55040), CVSS 9.1 admin-level path across 2016/2019/SE, largely found by an agent.
• memorywire, a vendor-neutral wire format for agent memory with a human review point before writes land, which is what makes deletion and export across frameworks possible.
• Cryptographic evidence that a specific agent request satisfied policy, proof-of-concept for verifiable authorization on top of agent identity.
• Snyk's Agent Baseline, 35 controls sequenced for coding, internal and production agents.
• CSA maps the OpenAI and Anthropic evaluation escapes onto MAESTRO layers, one operations failure, one alignment failure, fix lists that barely overlap.
• Rethinking agent security as a networking problem, argues policy enforcement belongs at a network chokepoint the agent cannot talk past.
• Android accessibility trees expose mobile AI agents to indirect prompt injection, attacker-controlled UI text drives agents that hold messages and contacts.
• Tracebit plants prompt injections next to AWS secrets, cheap tripwire that stalls autonomous attacker agents.