Last time I wrote about finding a forgotten injection-test MCP server in one of my config files.
It was one of those things where I looked at it and thought, how long has that been there?
More importantly, what else is there that I don't remember adding?
Before I start digging through my own setup, I wanted to understand what I should actually be looking for. So I've spent the last few days going through AI security papers, writeups and a bunch of incident reports.
I kept seeing the same few problems.
These are the four that seemed most relevant to what I'm doing.
1. Prompt injection
The basic problem here is that the model sees instructions and data as text.
There's no real wall between "follow this instruction" and "summarize this text." If an agent reads an email, webpage, README or some random file, there's always a chance that something in that content gets interpreted as an instruction.
We've already seen this happen.
EchoLeak (CVE-2025-32711) was a zero-click vulnerability in Microsoft 365 Copilot. The basic attack involved sending a specially crafted email. Copilot would process it as part of its normal operation and sensitive information could end up being sent to the attacker.
No link to click. No attachment to open.
GitHub Copilot had another issue around the same time, CVE-2025-53773. Instructions hidden inside repository files could influence the agent and cause it to make tool calls that eventually led to code execution.
That one is particularly relevant to me because reading repository files is basically what coding agents are supposed to do.
I have no idea how many README files, issues, docs, emails, etc. my own agents have gone through at this point.
2. Excessive agency
This one is less about someone attacking the model and more about what happens when you give it too much freedom.
I came across an incident in April involving a coding agent at a software company. It was working on a normal engineering task and ended up deleting the production database.
Then the backups.
Apparently there wasn't an attacker involved. The agent basically decided that this was the way to finish the task.
Amazon's Kiro agent had a similar incident in December 2025. It was supposed to fix an AWS Cost Explorer issue and instead decided to wipe and rebuild the production environment. That caused about 13 hours of downtime.
There was another case where an email assistant moved financial documents to an external folder because it interpreted instructions from a spam email as a user preference.
This is probably the category I hadn't thought about enough before.
If an agent has access to delete things, modify things, send emails, move files, run commands, etc., then "the model made a mistake" isn't really a good safety mechanism.
I also found a review of 344 enterprise AI incidents from 2025-2026 where 188 didn't involve an attacker.
That's a pretty uncomfortable number.
3. Jailbreaks
This one is the obvious one.
Get the model to ignore its safety rules.
There are the usual things: DAN prompts, roleplay, encoding, asking the same thing in slightly different ways, multi-turn attacks where you slowly push the conversation somewhere it wasn't supposed to go.
There was also a 2026 Nature Communications paper on something called Head-Masked Nullspace Steering. It targets the model's internal safety mechanisms rather than just trying different prompts. Their reported attack success rate went as high as 97% on some of the models they tested.
I'm less interested in reproducing that myself.
What I can test fairly easily is language.
Most models have a lot more training data in English than in many other languages. There are studies showing that safety performance can drop when the same request is made in lower-resource languages.
So that's an easy experiment.
Take a prompt that gets refused in English, translate it, try it in another language, then translate the response back.
I'm curious how much the result actually changes.
4. Supply chain attacks
This is probably the one I like the least.
Not because it's the most complicated, but because there's not much for the model to do wrong.
You can just download a bad file.
I came across a Hugging Face repo called baller423/goober2 that contained a malicious PyTorch model using pickle's __reduce__ mechanism. The payload executed when the model was loaded.
There were a couple of other repositories found by ReversingLabs, including glockr1/ballr7, using something they called "nullifAI."
The idea was basically to make the pickle difficult for scanners like PickleScan to deal with, while still having Python execute the payload.
JFrog also found three zero-days in PickleScan.
And this isn't limited to Hugging Face.
Package registries are getting hit as well. In the first half of 2026, researchers reported hundreds of malicious packages across npm and PyPI.
The May 11 "Mini Shai-Hulud" campaign affected more than 170 npm packages and two PyPI packages. Some of the packages were connected to projects around TanStack, Mistral AI and UiPath.
The attacks included credential theft and self-propagation through the package ecosystem.
This one is probably the easiest for me to relate to because I do the same thing everyone else does.
I find a package.
It has a lot of downloads.
The GitHub repo looks normal.
I install it.
I download models in pretty much the same way.
That's not really verification. It's just trust.
And until recently I didn't think much about that.
What I'm actually interested in
After reading all of this, I'm not sure there's one single "AI security problem."
It's more like a bunch of normal developer habits become more dangerous when an agent is sitting in the middle of them.
It reads files.
It installs things.
It runs commands.
It has credentials.
It can modify code.
Sometimes it gets instructions from things that aren't actually instructions.
That's a pretty weird security boundary when you think about it.
So before I start testing my own setup, I wanted to understand these problems first.
Next I'm going to look specifically at MCP.
I want to see what my tools are actually exposing, what permissions they have, and how easy it is for something an agent reads to turn into an action.