Five agent-tool security flaws, one bug: the tool never asks

On Sunday, VulnCheck published a batch of security advisories for tools that let ai agents act on your behalf. Each is rated medium, about five out of ten. Together they show one pattern.

The five

• Odoo MCP: the agent can read business records it's supposed to be denied.
• Trinity: an agent's own API key can run routes meant only for humans, so a hijacked agent can message as its owner's Telegram bot, or rebind or delete it.
• open-computer-use (macOS): the tool kept a list of apps the ai must never touch, 1Password among them. The check was case-sensitive, so the same name with different capitals walks straight past.
• mcp-remote: sends a client secret, and receives login tokens, over plain unencrypted HTTP.
• LLMGateway: a video-generation callback can be pointed at internal and cloud-metadata addresses.

Why it matters

None of these attacks the model. The attack is a prompt injection, for example a web page with hidden instructions, and then the tool does the damage, because the tool trusts whatever the agent asks for. The agent gets all of your powers, and nothing in the middle stops to ask whether you meant it.

If you've given an agent a login at work, the useful question is what, if anything, would ever tell it no.