SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Scanner-clean AI agent still carried four design flaws that no CVE will describe
In a post on aminrj.com, an OWASP working-group member says CVEs fit only two of six places where AI agent and MCP flaws live. Over-broad permissions, shared service accounts and confused-deputy designs sit in the other four, where a scanner has nothing to flag.
The Watch · Security desk
Share chart: the CVE-tracked fix covered 2 of the 6 affected git server tools, one third.
- Tools covered by the CVE fix, claim 20 2 of 6 tools 33% computed
Tools covered by the CVE fix The rest of the 6
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Tools covered by the CVE fix | 2 tools | 6 tools | 33% (computed) | 20 |
What happened
- The author gave an AI agent read access to a whole Kubernetes fleet and the scanner reported nothing: every package was current and no open CVE touched the deployment.
- The review found four flaws: read scope that reached Secrets, a shared service account that blocked attribution, a target cluster the model filled in as a tool parameter, and no cap on response size.
- Rows 3 to 6 of the author's six-row map are where agent incidents come from and where a CVE-driven program is blind.
- One bug, CVE-2025-68144, scores 7.1 at NVD under CVSS 3.1, 6.3 at GitHub under CVSS 4.0, and 8.1 in some press coverage.
- In the EU, an early warning for an actively exploited vulnerability has been due within 24 hours since 11 September 2026.
Why it matters
- exposure An agent with Secrets in read scope and a shared service account leaves responders unable to say what it read, and none of the four findings will appear as a CVE.
- constraint Reviewers have to hunt variants by hand: the record for CVE-2025-53110 says CWE-22 and does not say which other servers carry the same three lines.
- decision Triage of an agent CVE has to start from the agent's tool grants, identity and egress, because any published score describes the component alone.
- cost In four of the six places a CVE fits poorly, so review of agent permissions, identity and tool parameters falls to the team that deploys the agent.
The author says the worst MCP bugs are not AI bugs, and that an AppSec program already knows how to find them [7]. When Equixly tested popular MCP servers in March 2025, 43% had command injection flaws [6]. Even where a CVE fits, it describes one instance. CVE-2025-53110 in the filesystem server came from a prefix check, startsWith(allowedDir), that never added a path separator, and the code made that check in three places [8]. If /tmp/ws/data was the allowed directory, a request for /tmp/ws/data-evil/flag.txt cleared all of them [8].
The git server shows the gap at scale. The fix that carried the CVE protected two tools [10]. Four more got the same protection three months later, without a CVE of their own [11]. A scanner marked a deployment clean the day it upgraded past the December fix [12]. By that count the CVE-tracked patch covered two of six tools, one third [20].
Two deployments of the same server show how far severity moves. One runs against the owner's own repos with no outside content and no egress, and carries little real risk. The other handles triage of pull requests from outside contributors, holding a push-capable token and a tool that fetches from the web [15].
Waiting for the record is getting slower. The author describes the pipeline behind the CVE as saturated and expects slower records, thinner enrichment and exploitation before the patch [22]. On whether a CVE-built program covers agents, the author wrote: "Partially, and less than you think." [17]
We think the controls follow the four findings one for one: a narrower read scope, a service account per agent, a target cluster fixed on the server side, and a cap on response size. A scanner cannot check any of them from a package version. The six-way split is the author's own working map, and the post as excerpted does not tie it to incident counts [19].
What to watch
- Whether the first 24-hour EU early warnings name an agent or MCP product, which would show if design flaws get reported as vulnerabilities at all.
- Whether MCP maintainers file CVEs for class-level fixes like the four git server tools, or keep shipping them as plain commits.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The author gave an AI agent read access to a whole Kubernetes fleet; the vulnerability scanner had nothing to say about it, every package was current and no open CVE touched the deployment.
- [2]
The review found four ways the agent could still cause harm: its read scope reached Secrets; it shared a service account so nobody could attribute what it read; the model filled in the target cluster as a tool parameter, making it a confused deputy; and nothing capped how much it could pull into one response.
- [3]
None of the four findings has a CVE, and none ever will, because no component is broken; the risk is in how the pieces were put together.
- [4]
Agent and MCP flaws live in six places, and a CVE fits only two of them well.
- [5]
Rows 3 to 6 of the author's six-place map are where agent incidents come from and where a CVE-driven program is blind.
- [6]
When Equixly tested popular MCP servers in March 2025, 43% had command injection flaws.
- [7]
The author says the worst MCP bugs are not AI bugs, and that an AppSec program already knows how to find command injection flaws in MCP servers.
- [8]
In CVE-2025-53110, the filesystem server's containment bug, the flaw was startsWith(allowedDir) with no path separator, in three places; with /tmp/ws/data allowed, a request for /tmp/ws/data-evil/flag.txt passed every check.
- [9]
The record for CVE-2025-53110 says CWE-22, path traversal, and says nothing about which of a reader's own servers contain the same three lines.
- [10]
In the MCP git server the author studies, the CVE fix guarded two tools.
ReportedSupportedSource: Author of the aminrj.com post, citing public commits in modelcontextprotocol/serversView cited source - [11]
Four more tools in the same git server, which took a value from the model, were guarded three months later, and the fix for them carries no CVE.
ReportedSupportedSource: Author of the aminrj.com post, citing public commits in modelcontextprotocol/serversView cited source - [12]
A scanner marked a deployment clean the day it upgraded past the December fix, while four more tools in the same server lacked the guard for another three months.
- [13]
CVE-2025-68144 is scored 7.1 by NVD under CVSS 3.1, 6.3 by GitHub under CVSS 4.0, and 8.1 in some press coverage.
- [14]
Severity belongs to the deployment: the same CVE is a footnote or a breach depending on the agent's tool grants, identity and egress, and any of the published scores describes the component alone.
- [15]
An agent that runs the server against the owner's own repos with no outside content and no egress carries little real risk; the post contrasts it with an agent that triages pull requests from external contributors, with a token that can push and a web fetch tool.
- [16]
In the EU, disclosure is now a legal clock: 24 hours for an early warning on an actively exploited vulnerability, since 11 September 2026.
- [17]
"Partially, and less than you think."
ReportedSupportedSource: Author of the aminrj.com post, answering whether a CVE-based vulnerability program covers agentsView cited source - [18]
The author works in the OWASP Agentic Top 10 and MCP Top 10 working groups.
- [19]
The six-place sorting is the map the author uses to decide where a CVE helps, where it misleads, and what has to do the rest of the job.
- [20]
The CVE-tracked fix covered 2 of the 6 affected git server tools, one third.
- [21]
Rows 3 to 6 are four of the six places where a CVE fits poorly.
- [22]
The pipeline behind the CVE is saturated; the author expects slower records, thinner enrichment and exploitation before the patch.
Sources
1 independent publisher whose own reporting we read for this story.
- Why Your CVE Program Misses Most AI Agent Vulnerabilities (19 minute read)
aminrj.com
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.