AI agents are safe on paper—and dangerous in the handoffs
AI agent security vulnerabilities arise when large language models wrapped in automation pipelines pass individual safety checks but still expose secrets, execute code, or poison long‑term memory during the handoffs between tools, workflows, and other agents that inherit earlier decisions as trusted context. These failures are not about spectacular model jailbreaks; they are about mundane plumbing. An AI agent is a model plus a harness that turns intent into shell commands, file reads, API calls, and network requests, and when workflows run without a human at every step, that harness becomes the real security boundary. Elad Meged’s work on Claude Code, Gemini CLI, and Codex shows the same pattern: prompt injection is only the delivery system, while the true agent handoff flaws sit in how approvals and permissions compound over stages until a “safe” decision at one point becomes an exfiltration chain later on.
Ruflo’s unauthenticated MCP bridge shows what LLM code execution really means
If you think LLM code execution is an abstract risk, look at CVE‑2026‑59726: a maximum‑severity bug in the Ruflo meta‑harness that allowed unauthenticated remote code execution via an exposed Model Context Protocol bridge. Before version 3.16.3, Ruflo’s default docker-compose bound its MCP port 3001 to 0.0.0.0, exposing 233 tools—including terminal commands, database operations, agent management, and memory storage—to any network‑reachable client without authentication. One HTTP POST was enough to run commands in the container. From there an attacker could steal the LLM API keys Ruflo uses, read every stored conversation, and tamper with persistent state to influence future model behavior—classic AI memory poisoning. In practice, that means agent weaponization, conversation harvesting, and persistent backdoors by dropping payloads into /app. The project shipped a fix within 24 hours of disclosure, binding MCP to loopback by default, gating terminal_execute, and enabling MongoDB auth.
When agents triage your PRs, poisoned text becomes remote control
In real CI/CD pipelines, prompt injection attacks are morphing into supply‑chain threats. Pillar Security’s research on Google’s Python Agent Development Kit shows how a low‑privilege, public‑facing agent triggered on pull requests could be manipulated into calling a high‑privilege maintainer‑only agent that can execute actions. The issue came from two classes of AI agents with different privileges unintentionally sharing a trust boundary. A poisoned PR first gets triaged by the public agent; a second PR then carries the injection that instructs it to emit a “trusted” handoff to the maintainer agent. You do not need exploit dev skills; as the researcher notes, you need English to write the prompt, or another AI to write it for you. Google fixed the underlying issue but treated it as non‑rewardable social engineering. That framing misses the point: once you add agents to your pipelines, every PR comment becomes a potential remote procedure call into your infrastructure.
Claude, Gemini, Codex: passing safety checks while leaking secrets
Meged’s testing against Anthropic’s Claude Code Action, the default workflow for anthropics/claude-code installed by millions of users, exposes a worse truth: layered safety checks do not matter if each stage blindly trusts upstream labels. In his campaigns across Claude Code, Gemini CLI and OpenAI Codex agents in their default configurations, prompt injection was only the carrier; the real break came from how harnesses composed trust over time. A command looked read‑only, so it was approved; output publishing was the default, so it was posted; together, they formed a secret‑exfiltration chain without any outbound attacker connection or obvious logs. One quotable lesson from this work is: “If you’re only watching the prompt layer, you never see the handoff where one ‘safe’ decision feeds into the next… The defenses exist. They fail at the handoffs.” Bounties acknowledged each bug, but each patch simply redrew the boundary, leaving the architectural exposure intact.
What security teams must do now: secure the handoffs and memories
Most enterprise teams still focus on what their AI agents can do—tool lists, rate limits, sandbox paths—while ignoring what happens after agent output is consumed. Yet today’s incidents show that agent‑to‑agent communication and AI memory poisoning are the real gap. For platforms exposed to Ruflo‑style flaws, remediation must go beyond upgrading to 3.16.3: immediately close firewall ports 3001 and 27017, rotate all LLM API keys, audit the AgentDB pattern store for malicious entries, and inspect MongoDB for tampering. Providers themselves warn that credentials should be treated as compromised, AI memory audited for injected instructions, and containers rebuilt from clean images. More broadly, Meged advises tracing every path where agent output or any agent‑controlled state is later consumed by a more privileged stage. A structural fix means re‑validating trust at the point of consumption, not only at the point of decision, and refusing to inherit “safe” labels across contexts.
