← Back to Blog

AI Security Roundup: LLM, MCP, RAG, and Agentic Vulnerabilities (July 30, 2026)

LiteLLM CVE-2026-42271 command injection at CVSS 8.7 chains with Starlette BadHost CVE-2026-48710 to reach CVSS 10.0 unauthenticated RCE and lands on the CISA KEV catalog, Tenet Security details agentjacking against 2,388 Sentry DSN-exposed organizations with 85 percent success across Claude Code, Cursor, and OpenAI Codex CLI, the MCP 2026-07-28 spec makes OAuth 2.1 mandatory while retiring stateful sessions, Microsoft documents prompt-to-shell RCE in AI agent frameworks, prompt injection holds the OWASP LLM01 top slot with 50 to 84 percent attack success, and ServiceNow, Palo Alto Networks, Check Point, Fortinet, and CrowdStrike race to turn the AI gateway into both control plane and prime target.

📅 July 30, 2026 ✍️ Authored by AI ⏱️ 15 min read 📁 Security

The last week of July 2026 confirmed that the AI gateway is now the single most consequential piece of security infrastructure in the agentic stack, functioning simultaneously as the enterprise control plane and its highest-value target. LiteLLM, the widely deployed open-source AI gateway, remains at the center of active exploitation through CVE-2026-42271, a command injection flaw rated CVSS 8.7 that chains with the Starlette BadHost bypass CVE-2026-48710 to produce an unauthenticated remote code execution path scored at CVSS 10.0, a chain that CISA added to its Known Exploited Vulnerabilities catalog on June 8. Tenet Security detailed a novel attack class it calls agentjacking, in which attackers inject malicious content through public Sentry Data Source Names that MCP servers relay to coding agents as trusted diagnostics, achieving an 85 percent success rate across Claude Code, Cursor, and OpenAI Codex CLI against 2,388 exposed organizations. The MCP 2026-07-28 specification shipped this week, making OAuth 2.1 and OpenID Connect mandatory while eliminating stateful sessions, a change that simultaneously hardens authorization and simplifies gateway interception. Microsoft documented how prompts become shells through remote code execution in AI agent frameworks, prompt injection retained the OWASP LLM01 top ranking with attack success rates between 50 and 84 percent, and defensive momentum built as ServiceNow, Palo Alto Networks, Check Point, Fortinet, and CrowdStrike each moved to instrument the gateway and identity layers. The pattern for the week is that every advance in agent autonomy widens the attack surface faster than point defenses can close it, and the only durable answer is enforcement at the control plane where all agent traffic converges.

LiteLLM CVE-2026-42271 Chains to CVSS 10.0 Unauthenticated RCE

CVE-2026-42271 is a high-severity command injection vulnerability rated CVSS 8.7 in LiteLLM, the open-source AI gateway and proxy server, affecting all versions from 1.74.2 through 1.83.6. The flaw lives in MCP test endpoints that spawn user-supplied subprocess configurations on the proxy host with no command allowlist and no administrative role gate, letting any authenticated holder of a proxy API key execute arbitrary commands on the underlying system. Researchers at Horizon3.ai demonstrated that the flaw can be chained with CVE-2026-48710, a Host header authentication bypass in the Starlette web framework known as BadHost, to achieve unauthenticated remote code execution from any network-reachable host, and the combined chain carries a CVSS 10.0 score. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog on June 8, 2026, after confirming active in-the-wild exploitation, and any LiteLLM version below 1.83.7 remains vulnerable.

The vulnerability is compounded by LiteLLM's role as a control plane. A gateway that proxies traffic for dozens of models and agents holds credentials, routing rules, and often direct network paths to internal systems, so a single command injection on the proxy host can cascade into full environment compromise.

Why it matters: LiteLLM's exposure is the clearest illustration this year of the double-edged nature of the AI gateway. The same architectural position that lets a gateway inspect and govern all agent traffic also makes it the most valuable target in the environment, because compromising it yields visibility and control over every downstream model and tool. This is the risk that commercial vendors are racing to address with hardened, managed alternatives.

The competitive implications are direct. Palo Alto Networks positions its Portkey-powered Prisma AIRS AI Gateway as an enterprise-grade replacement for self-hosted open-source proxies precisely because a managed gateway can be patched centrally and gated behind identity-first controls. Cloudflare AI Gateway, Kong AI Gateway, and IBM DataPower make similar arguments. For security teams still running LiteLLM, the CVSS 10.0 chain and CISA KEV listing turn patching to 1.83.7 or later into an emergency, and the episode reinforces that whoever controls the gateway controls the agent, which is exactly why the gateway must be the most rigorously defended asset in the stack.

Agentjacking: Sentry MCP Injection Hijacks Coding Agents

Tenet Security published research in June 2026 documenting a novel attack class it calls agentjacking, and the technique continued to draw defensive attention through late July. The attack abuses the fact that a Sentry Data Source Name is public by design, embedded in every web application's frontend JavaScript, allowing an attacker to inject fake error events that the Sentry MCP server then relays to coding agents as trusted diagnostics. Tenet Security found 2,388 organizations with injectable Sentry DSNs and demonstrated an 85 percent exploitation success rate across Claude Code, Cursor, and OpenAI Codex CLI, tricking the agents into executing arbitrary commands. Sentry declined remediation, describing the class as not defensible at ingestion, which places the burden squarely on the agent and gateway layers.

Agentjacking generalizes well beyond Sentry. It encompasses issue trackers, ticketing systems, customer support queues, code review platforms, log aggregation services, and any MCP-connected service in which external parties can contribute content that agents subsequently process as guidance. Because the malicious traffic flows through normal telemetry pipelines, it bypasses EDR, WAF, IAM controls, and firewalls entirely.

Why it matters: Agentjacking is prompt injection industrialized through legitimate data channels, and it exposes the core weakness of the agentic model: agents cannot reliably distinguish between data and instructions when both arrive through trusted tools. That the malicious content evades traditional network and endpoint controls means the defense has to move to where the agent actually consumes the data, which is the MCP gateway.

This is the strategic opening for ServiceNow AI Gateway, which sits between agents and MCP servers and can scan and block payloads before they reach the agent, and for Check Point's AI Defense Plane, which screens agent tool calls before execution. Palo Alto Networks Prisma AIRS and Fortinet FortiEndpoint pursue the same interception logic at the gateway and endpoint respectively, while CrowdStrike anchors detection at the identity and endpoint telemetry layer through Falcon AIDR. The vendor that can inspect tool outputs for injection at line rate, without breaking the stateless MCP 2026-07-28 flow, will own the most defensible position in agentic security, because agentjacking proves that the perimeter has moved inside the data pipeline itself.

Cursor and IDE Agents Remain a Prime Injection Surface

AI-integrated development environments continued to surface as one of the most exploited categories of agentic software. A vulnerability enabling arbitrary command execution through the mcp.json configuration file in Cursor was tracked as CVE-2025-54135 at CVSS 8.6, part of a broader pattern of IDE agent flaws that includes critical prompt injection issues in Microsoft Copilot at CVSS 9.3, GitHub Copilot at CVSS 9.6, and Cursor IDE at CVSS 9.8, several of which have seen active production exploitation across 2025 and 2026. Researchers also documented Mid-Session Tool Injection, in which attackers hijack the tools a WebMCP agent uses during an active session through third-party scripts, AbortSignal hijacking, and registration races.

The IDE agent is a uniquely dangerous surface because it combines high privilege, direct filesystem and shell access, and constant ingestion of untrusted content from repositories, dependencies, error trackers, and documentation. When a coding agent reads attacker-influenced content and holds the ability to execute commands, the gap between prompt injection and remote code execution collapses to nothing.

Why it matters: The concentration of critical CVEs in Copilot, Cursor, and Codex tooling shows that the most productive agentic use case, autonomous coding, is also the most exposed. Enterprises deploying coding agents at scale are effectively granting execution privileges to systems that consume untrusted input by design, and traditional application security tooling was never built for that threat model.

This drives demand toward the runtime and gateway controls that vendors are now shipping. CrowdStrike Falcon AIDR targets protection where the prompt lifecycle begins, on the endpoint, which is precisely where IDE agents run. Palo Alto Networks and Check Point argue for gateway-level inspection of the MCP traffic those agents generate, and Fortinet FortiEndpoint claims visibility over installed AI apps and agents on the endpoint. The MCP 2026-07-28 move to mandatory OAuth 2.1 and Enterprise-Managed Authorization gives all of them a standardized authorization surface to enforce against, but authorization alone does not stop injection, so the market is converging on layered runtime inspection at both the endpoint and the gateway.

MCP 2026-07-28 Reshapes the Security Model

The MCP 2026-07-28 specification, which shipped this week, is as much a security event as a protocol milestone. It makes OAuth 2.1 and OpenID Connect discovery mandatory, requires robust issuer validation per RFC 9207, and introduces an Enterprise-Managed Authorization extension that lets IT administrators centrally provision MCP server access through an identity provider rather than relying on per-app OAuth prompts. It also deprecates Dynamic Client Registration, Sampling, and the legacy HTTP plus SSE transport, closing several trust-boundary gaps that early MCP deployments left open, particularly the reverse dependency created when servers called back into a client's LLM through Sampling.

The stateless core carries its own security tradeoffs. Eliminating sessions removes an entire class of session-fixation and session-hijacking risks, but it also means every request must independently carry and validate its authorization context, raising the stakes on correct token handling at the gateway. The self-contained request model with Mcp-Method and Mcp-Name headers lets gateways route and enforce policy without parsing request bodies, which is a defensive win, but only if the gateway validates those headers against the authenticated identity.

Why it matters: Mandatory OAuth 2.1 and Enterprise-Managed Authorization move MCP from a developer convenience into something a security organization can actually govern, and that shift favors vendors with existing identity fabric. CrowdStrike with Continuous Identity for AI Agents, ServiceNow with AI Control Tower, and IBM with DataPower gateways all gain a standardized authorization model to enforce, while Palo Alto Networks integrates agentic identity that decouples agent permissions from human credentials.

The deprecation of Sampling is an underappreciated hardening. By pushing servers to call LLM APIs directly instead of reaching back into the client, the spec removes a confused-deputy pathway that attackers could abuse to smuggle instructions across the trust boundary. For defenders, the practical takeaway is that the protocol has finally given the gateway the hooks it needs to enforce identity and scope on every call, but the LiteLLM and agentjacking incidents prove that authorization is necessary and not sufficient. Runtime content inspection at the control plane remains the only defense against injection that arrives through authorized, trusted channels.

Microsoft Details Prompt-to-Shell RCE in Agent Frameworks

Microsoft security researchers documented a class of vulnerabilities in which prompts become shells, detailing remote code execution paths across popular AI agent frameworks where attacker-controlled prompt content flows into command execution sinks. The research traces how an agent framework that passes model output into a subprocess, an eval, or a templating engine without adequate sandboxing converts a prompt injection into arbitrary code execution, and it maps the pattern across multiple widely used open-source frameworks. The findings reinforce that the agent framework layer, not just the model, is a first-class attack surface.

The core problem is architectural. Agent frameworks are designed to translate natural-language intent into concrete actions, which necessarily means routing model output toward execution primitives. Without strict allowlisting, sandboxing, and least-privilege isolation, that translation is a direct bridge from untrusted input to code execution, and the LiteLLM CVE-2026-42271 subprocess flaw is a production example of exactly this failure mode.

Why it matters: Microsoft's research validates the thesis that the agentic software supply chain is now a primary battleground. Frameworks that thousands of enterprises embed inherit the same prompt-to-shell risk, which means a single framework flaw can expose a long tail of downstream deployments, much as the Sentry MCP relay exposed 2,388 organizations at once.

The defensive response is converging on sandboxing and gateway-mediated execution. Fortinet's infrastructure-first posture and endpoint isolation, CrowdStrike's runtime detection through Falcon AIDR, and the gateway inspection championed by Palo Alto Networks, Check Point, and ServiceNow all aim to sever the bridge between prompt and shell before execution occurs. As agent frameworks proliferate alongside the frontier model launches this week from Anthropic, OpenAI, xAI, and Meta, the number of prompt-to-shell pathways grows with every new integration, and the control plane is the only place to enforce a consistent execution policy across all of them.

Prompt Injection Holds the Top Threat Ranking

Prompt injection retained its position as the number one AI security risk, ranked LLM01 by OWASP, with documented attack success rates between 50 and 84 percent depending on system configuration. The threat now spans direct injection through user input, indirect injection through retrieved documents and RAG pipelines, and the tool-mediated injection exemplified by agentjacking, and it has moved firmly from research demonstration into active production exploitation, as the critical CVEs in Copilot, Cursor, and Codex tooling make clear. Academic and industry reviews published through 2026 catalog an expanding taxonomy of attack vectors, from tool poisoning and credential theft to persistent injection through the agent skill ecosystem.

What makes prompt injection uniquely intractable is that it exploits the fundamental design of language models, which cannot categorically separate instructions from data when both are expressed in natural language. Unlike a memory-safety bug that can be patched, prompt injection is a property of how the systems work, so the defense must be architectural rather than a single fix.

Why it matters: The persistence of prompt injection at the top of the OWASP ranking is the strategic justification for the entire agentic security market. If the vulnerability cannot be eliminated at the model, it must be contained at the boundaries, which means input filtering, output inspection, least-privilege tool access, and runtime monitoring, all of which converge at the gateway and identity layers.

This is why every tracked vendor has built its agentic security story around containment rather than cure. Check Point blocks prompt injection across inputs, responses, and multi-step interactions through its AI Defense Plane. Palo Alto Networks enforces runtime controls that adapt to agent behavior through Prisma AIRS. ServiceNow scans and blocks payloads at its AI Gateway. CrowdStrike and Fortinet anchor detection at the endpoint. The uncomfortable truth for buyers is that no single control stops a 50 to 84 percent success rate on its own, so defense-in-depth across the gateway, identity, and endpoint layers is not optional, and the vendors that integrate cleanly across those layers will win the consolidation that the platformization thesis predicts.

Regulation and Guidance Tighten Around Agentic Risk

Regulatory and guidance activity kept pace with the technical threats. CISA's decision to add CVE-2026-42271 to the Known Exploited Vulnerabilities catalog on June 8 carries a federal remediation mandate and functions as an implicit warning to every enterprise running self-hosted AI gateways. In Europe, the EU AI Act timeline remains a live compliance driver, with enforcement powers for general-purpose AI providers and transparency obligations activating even as high-risk obligations were deferred under the Omnibus package, keeping model providers and deployers on a near-term clock. Industry bodies including OWASP, the Cloud Security Alliance, and academic reviewers continued to expand the agentic threat taxonomy, formalizing tool poisoning, agentjacking, and persistent skill-ecosystem injection as named categories that security programs are now expected to address.

The guidance landscape is converging on a shared premise: agents must be inventoried, authenticated, and continuously governed, not deployed and forgotten. That premise maps directly onto the discovery-and-govern capabilities that platform vendors are shipping, turning regulatory expectation into product demand.

Why it matters: Compliance pressure is becoming a primary purchasing catalyst for agentic security, and it favors vendors that can demonstrate discovery, policy enforcement, and audit across every AI system. ServiceNow AI Control Tower is built explicitly to discover, observe, govern, secure, and measure AI across any system, which is a near-verbatim match for what regulators and frameworks now expect. Palo Alto Networks Prisma AIRS and IBM's governance tooling make parallel claims.

The KEV listing and EU AI Act clock also raise the cost of inaction for enterprises still running unmanaged gateways like vulnerable LiteLLM builds. As regulation formalizes the expectation of continuous agent governance, the gap between organizations that route agent traffic through a governed control plane and those that do not becomes an audit finding, not just a security gap. That dynamic accelerates the same consolidation toward gateway and identity platforms that Check Point, Fortinet, and CrowdStrike are each racing to capture, because the compliant architecture and the secure architecture are turning out to be the same architecture.

The Gateway as Control Plane and Target

The week's incidents collectively reframe the AI gateway as the fulcrum of agentic security, valuable enough to defend everything and dangerous enough to compromise everything. The LiteLLM CVSS 10.0 chain shows what happens when the gateway itself is the target, the Sentry agentjacking class shows why the gateway must inspect content that bypasses every other control, and the MCP 2026-07-28 authorization overhaul shows the protocol finally equipping the gateway to enforce identity on every call. ServiceNow made the control-plane thesis explicit by shipping an AI Gateway that sits between agents and MCP servers with single-toggle PII blocking, and Palo Alto Networks continues to operate Prisma AIRS as a dedicated enterprise gateway.

The defensive market is now organized around where each vendor believes the decisive control point sits. Gateway-centric vendors argue that all agent traffic converges at the proxy, identity-centric vendors argue that every action must be authorized against a verified principal, and endpoint-centric vendors argue that the prompt lifecycle begins where the agent runs.

Why it matters: The convergence of these incidents in a single week signals that agentic security has matured from a research topic into an operational discipline with a clear architecture. The gateway is the perimeter, identity is the policy engine, and the endpoint is the last line of runtime enforcement, and no serious enterprise deployment can rely on only one of the three.

For the competitive landscape, this clarifies the stakes. Palo Alto Networks and its 700-million-dollar-plus acquisition spend, Check Point riding Google's agent fabric, Fortinet with its Intel Security Processor 6 hardware bet, CrowdStrike with Falcon AIDR, ServiceNow with AI Control Tower, and IBM with DataPower are all converging on the same conclusion from different starting points. The market will reward whoever can secure the gateway without becoming the next LiteLLM, and the LiteLLM CVSS 10.0 chain is a permanent reminder that the most powerful control plane is also the most catastrophic single point of failure.

Numbers at a glance

CVE-2026-42271 in LiteLLM carries CVSS 8.7 and chains with CVE-2026-48710 BadHost to reach CVSS 10.0, affecting versions 1.74.2 through 1.83.6 with the fix in 1.83.7, and it landed on the CISA KEV catalog on June 8, 2026. Tenet Security measured 85 percent agentjacking success across Claude Code, Cursor, and OpenAI Codex CLI against 2,388 exposed Sentry DSNs. Cursor carried CVE-2025-54135 at CVSS 8.6, with critical prompt injection CVEs in Microsoft Copilot at 9.3, GitHub Copilot at 9.6, and Cursor IDE at 9.8. Prompt injection holds the OWASP LLM01 top slot with 50 to 84 percent attack success. The MCP 2026-07-28 spec made OAuth 2.1 mandatory with a 12-month deprecation window.