Company
OX Security is a cybersecurity firm focused on software supply chain security, researching vulnerabilities and malicious packages across open-source ecosystems.
DeepSeek Harness, DeepSeek's open-source agent runner, carries a 9.4-severity flaw that lets a sandboxed agent grant itself full access with one command. Its control API has no authentication and trusts a client-supplied Host header.
Reality
OX Security scanned 15,465 public MCP servers in five registries and found no marketplace review or guardrails. Six of the listed servers sit on expired domains anyone can register for $4 to $12 a year, and a buyer would inherit the agents still calling them.
Reality
NVIDIA's Open Agent Safety Platform runs Sentry, a watchdog on separate BlueField-4 cards that isolates an agent within milliseconds of crossing its boundary. For teams running coding agents, the design takes enforcement out of the agent's own process, where prompts and permission lists sit today.
Reality
OX Security found 101 npm forks of the Baileys WhatsApp library, downloaded 490,000 times, that add developers' accounts to groups without consent. About a quarter of those downloads came in the last 30 days, so the campaign is still reaching new installs.
Reality
Ox Security found nearly 16% of 5,095 hostnames listed in three public MCP registries resolve outside the US, including to Russia and China. MCP has no notion of region, so cloud residency rules end where a company's AI agents connect out.
Reality
OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
OX Security found that DeepSeek's coding harness would let an agent unlock itself simply by asking, because the gate trusted a name the caller supplies. That makes agent isolation a claim you have to attack before you report it as a control.
Reality
Netskope Threat Labs puts the update between 20 and 31 July, and describes a Chrome sidebar that still earned an affiliate commission as users removed it. That says more about the update channel than about the install.
Reality
CISA says a trojanized extension version, 18.95.0, reached a GitHub employee's machine without anyone installing it, and internal repositories left from there. CVE-2026-48027 is now in the KEV catalog.
Reality
GitHub now sells Advanced Security as two SKUs, at $19 and $30 per active committer per month. Neither one routes a finding to an owner or enforces a deadline.
Reality
Wiz says the VS Code extension auto-loaded MCP server configs from the workspace and handed spawned processes the developer's full environment. Fixed in language server 1.65.0.
Reality
The vendor reports 10-plus CVEs and up to 200,000 exposed instances, and says Anthropic declined to change the protocol, describing the behaviour as expected.
Reality
Nine of eleven MCP marketplaces accepted proof-of-concept malware with zero review, and a fake agent skill cleared both Cisco's and NVIDIA's scanners to reach roughly 26,000 corporate agents.
Reality