Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-28 · source-backed
CVE-2026-27896 (MCP Go SDK): High-severity interpretation conflict in the official MCP Go SDK (maintained by Anthropic + Google). Go's encoding/json performs case-insensitive matching — attackers bypass WAFs by sending JSON-RPC messages with non-standard casing the SDK accepts but security tools reject. Fixed in v1.3.1. (CVE Reports)
CVE-2026-0755 (Gemini MCP Tool, CVSS 9.8): Critical command injection — execAsync passes user input directly to system call. No official patch. Maximum severity. (CyberSecurityNews)
Microsoft 365 Copilot DLP Bypass: Code defect caused Copilot to summarize emails with "Confidential" sensitivity labels, bypassing DLP policies. UK NHS reported as INC46740412. Demonstrates that enterprise AI assistants with broad data access create systematic data classification bypass risks. (BleepingComputer)
Each link below shares sources, entities, or timing with this story.
BleepingComputer confirmed Copilot summarized confidential emails despite DLP policies. UK NHS impacted. DLP was designed for human access patterns, not AI agents that index everything they can reach. ---
Microsoft's March 2026 Patch Tuesday (79 flaws, 2 zero-days) includes a Critical vulnerability where Excel's Copilot Agent mode silently exfiltrates data with zero user interaction. An attacker crafts a malicious document; when opened, the Copilot Agent triggers network egress...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
A single PR title. A hidden HTML comment in an issue body. No jailbreak, no social engineering, no user interaction required. Your credentials get exfiltrated through GitHub's own infrastructure before you ever see the notification. Security researcher Aonan Guan (Wyze Labs) a...
Three companies shipped standalone agent platforms in the same week, and none of them are IDE plugins. Google launched Antigravity 2.0 at I/O with a desktop app, a Go-based CLI, and an SDK for self-hosted agent deployments. No IDE. It's conversations, projects, and multi-agent...
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.