Two chained flaws let unauthenticated callers reach data through Grafana's MCP server
Pillar Security reports that callers could generate locally-formatted session identifiers to invoke MCP tools with no credentials, reaching Grafana data through the server's own service account, and that the grafana_api_request tool let a caller control the destination, method, path and body of outbound requests including internal services. The issue is tracked as CVE-2026-19516 at CVSS 9.1, published August 11, with Grafana shipping v1.1.0 on August 10 adding optional bearer-token authentication. Pillar puts the server at more than 1.9 million cumulative Docker Hub downloads.
A malicious GitHub issue chained through Gemini CLI to Editor access on a Google Cloud project
Pillar Security reports that an automated triage workflow running Gemini CLI with the --yolo flag used a deprecated coreTools key instead of the current tools.core schema, so its allowlist was ignored and an injected issue could invoke run_shell_command freely. The runner held Workload Identity Federation credentials in plain text, which could be used to mint GCP tokens and, through a project-wide roles/iam.serviceAccountTokenCreator grant, reach Editor-level access; Google tightened tool scoping, added the credentials file to .geminiignore and narrowed the role to a single service account.
A malicious MCP server turns hostile only after an agent's third tool call
Pillar Security reports a GitHub account, zellkernel, opening 23 campaign-related pull requests in 74 minutes on August 10 that point projects at a remote MCP endpoint or a hidden local path. The server behaves normally until a connected client reaches three tool calls, after which its tool and prompt responses change to steer the agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity from the user.
Pillar Security shows a malicious GitHub issue could hijack Google's ADK triage agent to run code as a privileged agent
Pillar Security disclosed that Google's Agent Development Kit shipped CI/CD workflows in which a public issue-triage AI agent could be prompted, via a crafted GitHub issue, to post a fix command as the trusted adk-bot account; a separate privileged workflow then acted on that command after checking only who posted it, not whether an outsider had manipulated the account — allowing code execution on CI runners and exfiltration of a bot token, a Google API key and service-account credentials. Google removed the affected workflows and confirmed the fix; no CVE was assigned.
Pillar Security reports sandbox escapes in four AI coding agents, triggered by content inside a repository
Pillar Security published seven sandbox escapes across four AI coding agents — three in Cursor, one in OpenAI's Codex CLI, one in Google's Gemini CLI and two in Google's Antigravity — in which the agent stays inside its sandbox and writes a file that a trusted tool outside the sandbox later runs, loads or scans. The routes include a workspace-controlled hook configuration, an agent editing a virtual environment's interpreter, a git-metadata bypass through fsmonitor, a “safe” command allowlist that trusted a git subcommand by name, Docker socket access reaching unsandboxed execution, a macOS Seatbelt denylist bypass and a VS Code task configuration. Pillar says the trigger is prompt injection planted in a README, an issue, a dependency or a diff, and that “an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts.”