Research report · AI-related cybersecurity risks
Securing AI agents: the familiar flaws come first
We analysed 2,979 vulnerabilities in AI agent and application tooling published from 2023 to 2026, and mapped agent risks to OWASP, CSA Singapore and MCP guidance. The flaws being exploited are old-fashioned; the new risks need design controls that vulnerability scanning cannot see.
1Executive summary
AI agents are language-model systems that can take actions: call APIs, run code, read mail, query databases and talk to other agents. Organisations are adopting them through low-code builders, model gateways, coding assistants and connectors built on the Model Context Protocol (MCP). Each of these is software with its own vulnerabilities, and each gives an attacker a new way to reach what the agent can reach.
This report does two things. First, it measures the vulnerabilities published in 53 widely used AI agent and application products and in MCP servers, and which of them attackers have exploited. Second, it sets out a practical threat model for agents, mapped to the OWASP Top 10 for Agentic Applications, the Cyber Security Agency of Singapore’s Guidelines on Securing AI Systems and the MCP security guidance, with the controls we would prioritise.
Key findings
Vulnerabilities in AI agent and application tooling are rising far faster than vulnerabilities overall: from 50 published in 2023 (0.21% of all CVEs) to 2,193 in 2026 so far (2.33%). MCP servers went from none to 501 in two years.
The flaws are mostly the familiar kind. Access-control failures, injection, path traversal and request forgery account for 66.2% of these vulnerabilities. Weaknesses unique to AI are rare in the data.
Every exploited case so far is a self-hosted platform reachable over the network. CISA has confirmed exploitation of 13 of these vulnerabilities, all in Langflow, LiteLLM, n8n, Ray, MLflow and GPUStack, all rated Critical or High, with a median of 28 days from publication to confirmation.
Prompt injection, the top risk on both OWASP lists, is close to invisible in vulnerability data. No CVE from 2023 to 2026 is classified under the weakness for it, and only 67 AI tooling CVEs mention it. Vulnerability management alone will not surface the risks that are specific to agents.
Agent risk is best managed as a design question: what can the agent reach, and who can influence what it reads? We map nine parts of an agent system to the OWASP agentic risks and the controls that matter most.
What this means
- Boards and executives
- Ask for an inventory of AI agents and platforms in use, what systems and data each can act on, and who approved that access. An agent should not have broader authority than the person or process it serves.
- Security leaders
- Run two tracks: treat AI platforms as internet-facing software that needs fast patching and authentication, and add design review for agents, because their specific risks do not appear as CVEs.
- Engineering and data teams
- Keep AI platforms off the public internet, give each agent its own narrowly scoped credentials, sandbox any code it runs, and require a human decision for actions that move money, delete data or send information outside the organisation.
2Scope and questions
Research questions
- How many vulnerabilities are being published in AI agent and application tooling, of what kinds, and which are being exploited?
- How visible are agent-specific risks, such as prompt injection, in standard vulnerability data?
- What controls should an organisation prioritise when deploying agents?
In scope
- CVEs with 2023 to 2026 identifiers in the NVD for 55 named products and MCP servers, in six groups (53 of the named products have CVEs in the period): coding assistants and copilots, MCP servers, agent frameworks, AI app builders and chat platforms, model serving and gateways, and ML platforms
- Confirmed exploitation in the CISA KEV catalogue, version 2026.11.10
- Published guidance: OWASP Top 10 for LLM Applications 2025, OWASP Top 10 for Agentic Applications 2026, CSA Guidelines on Securing AI Systems (October 2024) and the MCP Security Best Practices
Out of scope
- Risks in the models themselves, such as training-data poisoning or bias, except where they affect what an agent does
- Hosted AI services that do not publish CVEs for their own platform
- Image, audio and video generation tools
3Methodology
We read the four NVD yearly feeds for 2023 to 2026 (retrieved 11 November 2026, checksums verified) and assigned a CVE to an AI product when the first product named by its CVE Numbering Authority (CNA) matched one of our product rules. Where the CNA named no product, we used NVD’s product data. Using only the first CNA product stops supply-chain incidents that list many downstream packages from being counted as flaws in AI tools; this rule removed two such cases that an earlier version of the analysis had included. Severity is the CNA’s CVSS v3 score where present, and weaknesses are grouped into families using the same mapping as report EFF-RR-2026-001, with prompt injection (CWE-1427) added.
The products were chosen by listing every vendor and product in the feeds that matched AI-related terms, removing unrelated matches such as endpoint “agents” and chatbot plugins for websites, and keeping products that are used to build, run or connect AI agents. The product rules and code are published so that readers can add or remove products.
The threat model was built by mapping the components of a typical agent system to the ten risks in the OWASP Top 10 for Agentic Applications 2026, and to the lifecycle stages and controls in CSA’s Guidelines on Securing AI Systems and the MCP Security Best Practices. It is a structured expert judgement, not an empirical test, and we rate it moderate confidence for that reason.
Sources
| Source | How it was used | Reliability |
|---|---|---|
| NIST National Vulnerability Database, CVE 2.0 yearly feeds, 2023 to 2026 | Every CVE’s affected products, publication date, CVSS v3 scores, weakness (CWE) identifiers and description. | Authoritative primary source. Product naming varies between CNAs. |
| CISA Known Exploited Vulnerabilities catalogue, version 2026.11.10 | Which of the AI tooling vulnerabilities have been confirmed as exploited, and when. | Authoritative primary source with a high evidence threshold. |
| OWASP Top 10 for Agentic Applications 2026 (December 2025) and Top 10 for LLM Applications 2025 | The risk categories used for the threat model, and OWASP’s own mapping between the two lists. | Peer-reviewed community framework; widely referenced. |
| Cyber Security Agency of Singapore, Guidelines and Companion Guide on Securing AI Systems (15 October 2024) | Lifecycle stages and controls for securing AI systems, from the Singapore authority. | Official guidance; not prescriptive, and maintained as a living resource. |
| Model Context Protocol, Security Best Practices | Attack classes and mitigations specific to MCP, including confused deputy, token passthrough and server-side request forgery. | Specification guidance from the protocol maintainers. |
Review
- Author review: Fahad Imran, author
Data availability
4Findings
Finding 1
Vulnerabilities in AI tooling are growing faster than the field
High confidence
We found 2,979 CVEs in these products, published between January 2023 and 11 November 2026. The number has risen every year, and 2026 alone accounts for 2,193 (73.6%). The overall number of CVEs also grew sharply, so the clearer measure is share: AI tooling went from 0.21% of all CVEs published in 2023 to 2.33% in 2026.
The fastest growth is in the newest layers. MCP servers, which connect agents to tools and data, had no CVEs before 2025, then 37 in 2025 and 464 in 2026. Agent frameworks rose from 67 to 369 between 2025 and 2026, and AI app builders and chat platforms from 167 to 878.
More CVEs do not by themselves mean less secure software. They also reflect how much attention researchers and bug-bounty programmes give these projects, and a single project can account for many reports (PraisonAI has 183). What the growth does show is that AI tooling now produces a steady flow of security fixes that someone has to apply.
Base: 2,979 non-rejected CVEs with 2023 to 2026 identifiers whose first CNA product matches one of the 56 published product rules, by NVD publication date. Source: NVD CVE 2.0 feeds retrieved 11 November 2026.
Finding 2
The flaws are mostly the familiar kind
High confidence
Four families of weakness account for 1,972 of the 2,979 CVEs (66.2%): authentication and access-control failures (22.6%), injection and code execution (18.3%), path traversal and file handling (14.5%), and request forgery (10.7%). The single most common weaknesses are path traversal (CWE-22, 328 CVEs), server-side request forgery (CWE-918, 304) and code injection (CWE-94, 197).
The pattern differs by type of product. In coding assistants, 46.1% of CVEs are injection or code execution: an assistant that can run commands can be tricked into running the wrong ones. MCP servers show a spread of injection (26.9%), path traversal (23.6%), access control (18.8%) and request forgery (17.0%), the weaknesses expected of small connectors that reach files, networks and APIs. Model-serving software is the one group where memory-safety flaws are common (20.4%).
These tools are also rated severe: 57.8% of the CVEs are Critical or High, compared with 46.7% of all CVEs in the same years (report EFF-RR-2026-002). Much of this software is young, built quickly, and designed to be powerful by default.
| Product group | CVEs | Published in 2026 | Most common named weakness |
|---|---|---|---|
| AI app builders and chat platforms | 1,203 | 878 | Access control, 30.1% |
| MCP servers and tooling | 501 | 464 | Injection and code execution, 26.9% |
| Agent frameworks and SDKs | 458 | 369 | Access control, 24.7% |
| Model serving and gateways | 411 | 299 | Memory safety, 20.4% |
| ML platforms and libraries | 254 | 88 | Path traversal and file handling, 21.7% |
| AI coding assistants and copilots | 152 | 95 | Injection and code execution, 46.1% |
| All groups | 2,979 | 2,193 | Access control, 22.6% |
Base: 2,979 CVEs. Weakness family from the first mapped CWE in each CVE, using the mapping in the published code. Source: NVD CVE 2.0 feeds retrieved 11 November 2026.
Finding 3
Every exploited case so far is a self-hosted platform
High confidence
CISA has confirmed exploitation of 13 of the 2,979 vulnerabilities: six in Langflow, three in LiteLLM, and one each in n8n, Ray, MLflow and GPUStack. All are platforms that organisations install and run themselves, typically as a web service. All 13 are rated Critical (8) or High (5), five are access-control failures, five are injection or code execution, one is request forgery and two are other weaknesses.
The median time from publication to confirmed exploitation was 28 days, and four were confirmed within five days. None of the confirmed cases is in a coding assistant, an MCP server or an agent framework library. That may change as those tools spread, and it partly reflects what reaches CISA: a compromised developer laptop is harder to see than an exposed server.
The lesson is ordinary but urgent. An AI platform reachable from the internet is attacked like any other web application, and it often holds model API keys, database connections and workflow credentials that make it a valuable foothold.
| Product | Exploited CVEs | What it is |
|---|---|---|
| Langflow | 6 | Low-code builder for AI agents and workflows |
| LiteLLM | 3 | Gateway that routes requests to many model providers |
| n8n | 1 | Workflow automation platform, widely used to build agents |
| Ray | 1 | Distributed computing framework for AI workloads |
| MLflow | 1 | Platform for tracking and serving machine-learning models |
| GPUStack | 1 | Manager for running models on GPU clusters |
Base: 13 of the 2,979 CVEs that appear in CISA KEV catalogue version 2026.11.10. Report EFF-RR-2026-001 counted 14 AI tooling entries using a wider product list that also included the Marimo notebook. Source: NVD CVE 2.0 feeds; CISA KEV version 2026.11.10.
Finding 4
Agent-specific risks barely appear in vulnerability data
Moderate confidence
Prompt injection is the first risk on the OWASP Top 10 for LLM Applications, and goal hijack through manipulated inputs is the first on the agentic list. MITRE added a weakness entry for it, CWE-1427 (Improper Neutralization of Input Used for LLM Prompting). Yet none of the 201,099 CVEs published with 2023 to 2026 identifiers is classified under CWE-1427.
Only 168 CVE descriptions in that whole period mention prompt injection, 67 of them in our AI tooling set, mostly in MCP servers (16), Cursor (15) and Roo Code (8). Where it appears, it is described as the route to a familiar flaw, and those 67 are classified by their consequence, most often as injection and code execution (28).
This is not a gap in the data so much as a difference in kind. A CVE describes a defect in a product that a patch can fix. Much agent risk comes from how an agent is configured and connected: what it is allowed to do, what it reads, and whose instructions it follows. No patch changes that, and no scanner will report it. Agent security therefore needs design review alongside vulnerability management.
Finding 5
A threat model for agents: what can it reach, and who can influence it?
Moderate confidence
Two questions capture most agent risk. What can the agent reach: which systems, data and actions does it have authority over? And who can influence what it reads: whose content enters its context, directly or through documents, email, web pages, memory and tool results? The danger is greatest when an agent that reads untrusted content can also reach sensitive data and send information out.
The table maps nine parts of an agent system to the OWASP Top 10 for Agentic Applications 2026 and the controls we would put first. The last row is not agent-specific, but on current evidence it is where attackers are succeeding. CSA’s Guidelines on Securing AI Systems organise these controls across five lifecycle stages, from planning and design to end of life, and stress that hardening the model alone is not enough.
| Component and OWASP agentic risk | What can go wrong | Priority controls |
|---|---|---|
| Inputs: prompts, documents, email and web pages the agent reads ASI01 Agent Goal Hijack | Hidden instructions in content redirect the agent’s goal | Treat retrieved content as data, not instructions; restrict what an agent can do after reading untrusted content |
| Tools and actions: APIs, browsers, code execution ASI02 Tool Misuse and Exploitation; ASI05 Unexpected Code Execution | Legitimate tools used for harmful ends; generated code runs unchecked | Allowlist tools with narrow scopes; run code in a sandbox; require approval for high-impact actions |
| Identity and credentials ASI03 Identity and Privilege Abuse | The agent acts with more authority than the person who asked; tokens are reused across services | A separate identity per agent; short-lived, scoped credentials; no token passthrough |
| Supply chain: models, MCP servers, plugins, packages ASI04 Agentic Supply Chain Vulnerabilities | Malicious or vulnerable components | Inventory and pin versions; vet MCP servers as third-party software |
| Memory and knowledge stores ASI06 Memory and Context Poisoning | Poisoned memory or retrieval data persists and steers later actions | Control who can write; record where content came from; review and expire stored memory |
| Multi-agent workflows ASI07 Insecure Inter-Agent Communication; ASI08 Cascading Failures | Spoofed messages between agents; one fault spreads through a chain | Authenticate messages between agents; set limits and circuit breakers |
| Human oversight ASI09 Human-Agent Trust Exploitation | People approve actions they do not understand, or are persuaded by the agent | Approval screens that show the actual action and data affected |
| Governance and monitoring ASI10 Rogue Agents | An agent drifts from its intended behaviour without anyone noticing | Log every action and tool call; monitor for anomalies; a tested way to stop an agent |
| Hosting platform: app builder, gateway or ML platform Not agent-specific (see Finding 3) | Familiar web flaws exploited over the network | Keep off the internet; require authentication; patch within days |
Risk names are from the OWASP Top 10 for Agentic Applications 2026 (December 2025). Controls draw on that document, CSA’s Guidelines and Companion Guide on Securing AI Systems (October 2024) and the MCP Security Best Practices. The mapping is Effycace’s judgement.
5Recommendations
Recommendations are ordered by priority. Effort is a broad estimate for a mid-sized organisation; your own will depend on what is already in place.
| # | Recommendation | Owner | Priority | Effort | Framework reference |
|---|---|---|---|---|---|
| 1 | Build an inventory of AI platforms, agents, MCP servers and coding assistants in use, including those run by engineering and data teams outside central IT, with what each can access. | CISO with engineering leads | High | Medium | NIST CSF 2.0 ID.AM-02 CSA AI Guidelines: Planning and Design |
| 2 | Keep AI platforms off the public internet, require authentication on every interface, and patch them on the same short timeline as other exposed systems. | IT operations | High | Low | NIST CSF 2.0 PR.PS-02 CIS Controls v8.1 7.7 |
| 3 | Give each agent its own identity with short-lived, narrowly scoped credentials; never let an agent pass a user’s token on to other services. | Identity team | High | Medium | NIST CSF 2.0 PR.AA-05 OWASP ASI03 MCP Security Best Practices |
| 4 | Require a human decision for actions that move money, delete or export data, change access, or communicate outside the organisation, and run agent-generated code only in a sandbox. | Application owners | High | Medium | OWASP ASI02, ASI05, ASI09 |
| 5 | Do not combine, in one agent, the ability to read untrusted content, access sensitive data and send information out, unless each step is controlled. | Security architecture | High | Medium | OWASP ASI01 OWASP LLM01:2025 |
| 6 | Approve MCP servers and plugins from an allowlist, pin their versions, and review them as you would any third-party software. | Engineering leads | Medium | Low | OWASP ASI04 NIST CSF 2.0 GV.SC-05 |
| 7 | Log every agent action and tool call, monitor them, include agents in incident response plans, and test how to stop an agent quickly. | Security operations | Medium | Medium | NIST CSF 2.0 DE.CM-09 OWASP ASI08, ASI10 |
6Limitations
- The products were chosen by Effycace from the products present in the NVD data. A different list would give different totals, although the rules are published so that this can be tested. Closed hosted services rarely publish CVEs for their own platforms, so they are under-represented.
- CVE counts reflect how much researchers and bug-bounty programmes look at a product, not only how secure it is. Growth and product totals should not be read as rankings of security.
- Each CVE is assigned to the first product its CNA names, and its weakness family to the first mapped CWE. Mentions of prompt injection were found by searching descriptions for the phrase, which will miss some cases.
- The KEV catalogue reflects what reaches CISA. Exploitation of developer tools and internal deployments is less likely to be seen than attacks on internet-facing servers.
- The threat model is a structured judgement based on published frameworks, not an empirical test. Agent technology and the guidance for it are changing quickly, and the model should be revisited at least yearly.
- This report was reviewed by its author and has not yet been independently peer reviewed. We welcome corrections and will record them in the version history.
7How to read this report
Each finding carries a confidence level, which describes the quality of the evidence behind it. Where we estimate likelihood, we use fixed terms so that “likely” means the same thing every time.
- High confidence
- Based on good-quality information from several independent sources, or on a complete dataset. A high-confidence judgement can still be wrong.
- Moderate confidence
- Based on credible information, but with gaps, a limited sample or more than one plausible interpretation.
- Low confidence
- Based on scarce, fragmented or single-source information. Treat it as something to watch, not as the sole basis for a major decision.
| Term | Probability |
|---|---|
| Almost no chance | 1–5% |
| Very unlikely | 5–20% |
| Unlikely | 20–45% |
| Roughly even chance | 45–55% |
| Likely | 55–80% |
| Very likely | 80–95% |
| Almost certain | 95–99% |
8References
- OWASP Gen AI Security Project. (2025). OWASP Top 10 for Agentic Applications for 2026. Published 9 December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- OWASP Gen AI Security Project. OWASP Top 10 for LLM Applications 2025. https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
- OWASP Gen AI Security Project. Agentic AI: Threats and Mitigations. https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/
- Cyber Security Agency of Singapore. (2024). Guidelines and Companion Guide on Securing AI Systems. 15 October 2024. https://www.csa.gov.sg/resources/publications/guidelines-and-companion-guide-on-securing-ai-systems
- Model Context Protocol. Security Best Practices (specification draft). https://modelcontextprotocol.io/specification/draft/basic/security_best_practices
- MITRE. ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. https://atlas.mitre.org/
- MITRE. CWE-1427: Improper Neutralization of Input Used for LLM Prompting. https://cwe.mitre.org/data/definitions/1427.html
- National Institute of Standards and Technology. (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. https://doi.org/10.6028/NIST.AI.600-1
- National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1
- National Institute of Standards and Technology. National Vulnerability Database data feeds (CVE 2.0). Retrieved 11 November 2026. https://nvd.nist.gov/vuln/data-feeds
- Cybersecurity and Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog, version 2026.11.10. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29
- Imran, F. (2026). Exploited at the edge (Report EFF-RR-2026-001) and Severity is not a schedule (Report EFF-RR-2026-002). Effycace Solutions Pte Ltd. /research/
9About this report
- Author
- Fahad Imran, Effycace Solutions
- Funding and interests
- This report was funded by Effycace Solutions. No vendor or project named in it, and none of OWASP, CSA, MITRE or NIST, sponsored, reviewed or approved it. Product CVE counts reflect public data and are not a ranking of product security.
- Distribution
- TLP:CLEAR This report may be shared freely, with attribution.
- Corrections
- If you find an error, write to contact@effycace.com. Corrections are recorded in the version history below.
How to cite
Fahad Imran (2026). Securing AI agents: the familiar flaws come first (Report EFF-RR-2026-006, version 1.0). Effycace Solutions Pte Ltd. https://www.effycace.com/research/reports/securing-ai-agents-2026/
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 12 November 2026 | First published. |
This report is general information, not advice for your specific circumstances. See our Terms of Use.