Claude Code, MCP and AI Coding Agent Vulnerabilities: October 2026 Roundup

Between September and early November 2026, a steady run of Claude Code vulnerabilities, MCP vulnerabilities and related research landed on AI coding agents and the Model Context Protocol (MCP), the standard that connects agents to tool servers. It covers the Claude Agent SDK, Claude Code and its plugins, the Claude Desktop preview pane (“SneakPeek”), the official MCP TypeScript SDK, Langflow and a Copilot bug fixed on Microsoft’s October 13 Patch Tuesday.

Most are already fixed, and the Claude Code and Claude Desktop fixes reached users through auto-update. The pattern behind them matters more: coding agents run with a developer’s permissions and read content the developer did not write. That is what our AI penetration testing service tests, covering the agent, its tools and its MCP integrations, from $4,500 with a free retest. Below are the main Claude Code and MCP vulnerabilities from the period, with fixed versions and how to check your exposure.

In short

• What happened: more than a dozen vulnerabilities in AI coding agents, MCP libraries and agent platforms were published or reached advisory databases in October 2026. One, in Langflow, drew attack attempts in honeypots.
• Who is affected: developers using Claude Code, Claude Desktop, Copilot or opencode; teams building on the Claude Agent SDK or MCP TypeScript SDK; anyone self-hosting Langflow, LMCache, DB-GPT or a GitLab AI Gateway.
• What to do: update to the fixed versions below, rotate credentials where the advisories say so, and keep agent platforms off the internet unless they require authentication.

The October 2026 list at a glance

Product	Issue	Severity (who scored)	Fixed in	Exploited?
Claude Agent SDK (Python), CVE-2026-96620	Argument injection via resume leads to command execution	9.2 Critical, CVSS 4.0 (GitHub advisory)	0.2.121	None reported
Claude Code, CVE-2026-103435	Symlink race lets a file write land outside the project	7.7 High, CVSS 4.0 (GitHub advisory)	2.1.129	None reported
Claude Code, CVE-2026-86063	Plugin hash-pin bypass	7.5 High, CVSS 4.0 (GitHub advisory)	2.1.179	None reported
Claude Desktop (Windows), CVE-2026-88066	Runs a git.exe planted in the opened project	7.5 High, CVSS 4.0 (GitHub advisory)	1.8089.0	None reported
Claude Code, CVE-2026-88968	Edit-tool race on macOS writes outside the workspace	7.7 High, CVSS 4.0 (GitHub advisory)	2.1.251	None reported
Claude Desktop, “SneakPeek” (CVE pending)	Preview pane reads local files and sends them out	8.7 High, CVSS 4.0 (Anthropic)	1.30096.1	None reported
MCP TypeScript SDK, CVE-2026-104850	OAuth client sends stored credentials to a server-chosen authorization server	7.5 High, CVSS 3.1 (advisory)	sdk 1.31.0, client 2.2.0	None reported
MCP TypeScript server SDK, CVE-2026-111770	Responses delivered to the wrong client	7.7 High, CVSS 3.1 (advisory)	2.3.0	None reported
MCP Inspector (no CVE)	Code execution via the OAuth callback	9.6 Critical, CVSS 3.1 (advisory)	1.0.3	None reported
Langflow, CVE-2026-105740	Any logged-in user can run commands through MCP stdio	9.9 Critical, CVSS 3.1 (advisory)	1.9.0	Honeypot attempts reported; not in CISA KEV as of November 4
GitLab AI Gateway (self-hosted), CVE-2026-90970	Prompt template sandbox escape	9.9 Critical, CVSS 3.1 (GitLab)	19.2.4, 19.3.2, 19.4.1	None reported
Visual Studio and SSMS Copilot, CVE-2026-103572	Path-check bypass leads to command execution	Important (Microsoft)	October 13, 2026 updates	None reported
opencode on Windows and WSL (no CVE)	Code execution via MCP OAuth	No official score	1.18.33	None reported
LMCache, CVE-2026-105192	Unauthenticated remote code execution	9.8 (JFrog)	0.5.6	None reported
DB-GPT, CVE-2026-77932	Unauthenticated agent endpoint runs code as root	9.3 Critical, CVSS 4.0 (advisory)	No fixed version listed	None reported

Some advisories were first published in September and drew attention in October: the Claude Agent SDK’s on September 12, 2026, Langflow’s on September 10 and the MCP OAuth advisory on September 30. “Exploited?” reflects reports as of November 6, 2026.

Claude and Claude Code vulnerabilities

CVE-2026-96620: Claude Agent SDK

The Python Claude Agent SDK passed the resume session ID to the Claude CLI unchecked. A value starting with a dash was read as a command-line flag, which could load an attacker’s MCP configuration and run commands, bypassing the SDK’s permission controls (GitHub advisory). It was reported through HackerOne.

It matters only if your application passes untrusted input, such as a session ID from a web request, into resume. Upgrade to 0.2.121 and reject session IDs that start with a dash. This is a code problem as much as an AI one: a source code review, from $4,800, traces where request data reaches SDK options.

CVE-2026-86063: Claude Code plugins

When installing a plugin, Claude Code checked out the marketplace’s pinned commit without confirming the checkout matched it, so a branch named like a commit hash could substitute other code (GitHub advisory). Version 2.1.179 fixes it, and the advisory says auto-update users already have the fix. Credit goes to Or Nevo Michrowski of Air Security. The wider lesson: a pinned hash only helps if the tool verifies it, so keep an allowlist of approved plugins and marketplaces.

CVE-2026-103435, CVE-2026-88968 and CVE-2026-88066: file writes and a planted git.exe

Three more high-severity advisories from Anthropic landed in October. Each says auto-update users already have the fix.

• CVE-2026-103435 (October 5, fixed in Claude Code 2.1.129): Claude Code checked that a target file sat inside the project at permission time but not again at write time, so someone with write access to a shared workspace could swap in a symlink and send an edit to a file outside the project (advisory).
• CVE-2026-88968 (October 26, fixed in 2.1.251): a similar race in the Edit tool on macOS. It needed attacker-controlled code already running inside Claude Code’s sandbox, for example from a malicious repository or dependency script (advisory).
• CVE-2026-88066 (October 13, fixed in Claude Desktop 1.8089.0): Claude Desktop on Windows started git.exe without a full path, so a git.exe planted in a project folder, such as a cloned repository, ran when the user opened that folder (advisory).

SneakPeek: Claude Desktop preview pane

Noma Labs published “SneakPeek” on October 14, 2026 (Noma Labs). A poisoned HTML file disguised as a test coverage report could, when shown in the Claude Code Desktop preview pane, read local files and send them out: SSH keys, AWS and npm credentials, GitHub and Kubernetes tokens, and Claude OAuth tokens.

Noma reported it on July 4. The first fix, on July 24, was bypassed, and build 1.30096.1, delivered through auto-update on August 17, closed it. Anthropic scored it 8.7 under CVSS 4.0; a CVE was still pending in October. Confirm your build is 1.30096.1 or later, do not preview HTML you did not produce, and rotate credentials on any machine that previewed untrusted HTML on an affected build.

Instruction files in the Downloads folder

Forever Security showed on October 22 that an AGENTS.md file planted in ~/Downloads is loaded when a developer starts a coding agent there (BleepingComputer, October 25). With a harmless payload, OpenAI Codex followed the file in about 90% of runs. A crafted CLAUDE.md redirected Claude Code’s API traffic to a researcher-controlled server, exposing the OAuth token, in about half of runs.

The researchers say there is nothing for the vendors to patch, because agents load instruction files from their working folder by design. The fix is habit: start agents from the project root, read instruction files you did not write, and keep approval prompts and the sandbox on. Our explainer on indirect prompt injection covers why agents treat file content as instructions.

MCP vulnerabilities: the protocol layer

Several October advisories concern the trust between MCP clients and the servers they connect to.

CVE-2026-104850: OAuth credentials sent to a server-chosen authorization server

In the official MCP TypeScript SDK, the server a client connected to decided where the client’s saved OAuth credentials went, so a hostile MCP server could point the client at an authorization server it controlled and collect stored refresh tokens and client secrets, with no prompt to the user (advisory). Affected versions are @modelcontextprotocol/sdk 1.12.0 up to 1.31.0 and @modelcontextprotocol/client 2.0.0 up to 2.2.0.

The fix records the issuer with saved credentials, and bundled providers need expectedIssuer set. New interactive sign-ins still go where the MCP server says. If a client may have talked to an untrusted server, issue a new client secret or signing key and invalidate existing tokens.

CVE-2026-111770: one client’s messages delivered to another

The server SDK paired each response with a client using only the JSON-RPC request number, and because every SDK client starts counting at zero, those numbers routinely clash; when HTTP clients shared one transport or server instance, replies could land with the wrong client (GitHub advisory). The README examples showed that shared pattern. Version 2.3.0 fixes it by refusing shared instances, so expect to change code as well as the version.

MCP Inspector and opencode (no CVE)

An attacker-run MCP server could smuggle settings through Inspector’s OAuth callback that swapped the remote connection for a local process and ran a command of the attacker’s choosing. Versions 0.13.0 through 1.0.2 are affected and 1.0.3 fixes it (advisory).

In opencode on Windows and WSL, a malicious MCP server’s OAuth authorization URL was evaluated by PowerShell, giving command execution (Pillar Security). Versions 1.0.137 through 1.18.32 are affected and 1.18.33 (September 28, 2026) fixes it. The maintainers consider malicious MCP servers outside their threat model, so no CVE exists and dependency scanners will not flag old installs. Inventory them by hand.

AWS Loom and IBM MCP Context Forge

AWS bulletin 2026-124-AWS (October 2) covers three flaws in Loom, an AWS Labs open-source agent orchestration platform: an authentication bypass when no identity provider is configured (CVE-2026-103956, fixed in 1.6.1), and OAuth secret disclosure and requests reaching the container credential endpoint (CVE-2026-103957 and -103958, fixed in 1.7.0). After upgrading, rotate MCP and A2A OAuth secrets and review CloudTrail (AWS).

IBM MCP Context Forge before 1.0.2 ships a default JWT signing key; where that key is left in place and REQUIRE_USER_IN_DB is false, an unauthenticated attacker can forge platform-admin tokens (CVE-2026-53709, CVSS 3.1 9.8) (OSV). Upgrade and set your own key.

Our guide to MCP server security testing covers how to test an MCP server for these classes of flaw.

AI agent platforms and gateways

Langflow CVE-2026-105740. Any logged-in user, not only admins, could add an MCP server whose command field is passed to a shell (advisory). It scores 9.9 under CVSS 3.1 and is fixed in 1.9.0. Previdian’s honeypots recorded 1,423 exploitation attempts from 27 addresses between September 19 and October 15, 2026 (The Hacker News), rising to 3,460 attempts from 31 addresses by October 22 (iThome), including sign-ins with common credentials. It was not in CISA’s Known Exploited Vulnerabilities catalog as of the November 4, 2026 feed, though earlier Langflow flaws are, including CVE-2026-33017 (added March 25, 2026) and CVE-2026-0770 (added July 21, 2026). Upgrade, keep LANGFLOW_AUTO_LOGIN=false with a strong superuser password, and keep Langflow off the internet, as its documentation advises.

GitLab AI Gateway CVE-2026-90970. A user with Duo Agent Platform access could escape the prompt template sandbox and run commands on the gateway (CVSS 3.1 9.9). It is fixed in 19.2.4, 19.3.2 and 19.4.1, and only self-hosted gateway operators need to act (GitLab).

DB-GPT CVE-2026-77932. Through 0.8.2, an agent endpoint’s placeholder authentication treats every caller as an admin, so an unauthenticated prompt can drive its code and shell tools as root in the container (GitHub advisory). No fixed version is listed. Do not expose it, and put real authentication in front of it.

LMCache CVE-2026-105192. From 0.3.9 up to 0.5.6, unsafe deserialization allows unauthenticated code execution, but only when multiprocess mode is bound to a routable address (default port 5555). JFrog scores it 9.8 (JFrog). Upgrade to 0.5.6, and until then keep the port on localhost or a firewalled network.

Copilot in Visual Studio and SQL Server Management Studio

CVE-2026-103572, fixed on October 13, 2026, let Copilot in Visual Studio and SQL Server Management Studio get past its guard against editing sensitive configuration files through Windows file-name normalization, leading to command execution. The Embrace The Red write-up shows it being triggered by indirect prompt injection in a file the user opens, and notes the same instructions could arrive through MCP server output. Microsoft rates it Important.

Two related items:

• September, SSMS Copilot. CVE-2026-65669, fixed by Microsoft on September 8 and detailed by Embrace The Red on September 30, let a low-privileged database user plant instructions that Copilot later ran over a DBA’s connection, reaching sysadmin (Embrace The Red). Never run AI assistants over highly privileged connections.
• October 6, GitHub Copilot CLI. Adversa showed encrypted web-page instructions leading the agent, in autopilot mode, to send local secrets out. GitHub validated it but does not treat it as a vulnerability (Adversa).

Attackers are using coding agents too

CrowdStrike reported on October 21, 2026 that four previously unreported actors ran agentic intrusion campaigns with Claude Code, two of them through custom pentest harnesses, with activity between May and August 2026 (CrowdStrike). Victims included at least 15 healthcare organizations in Argentina, government bodies and a US CRM vendor, and CrowdStrike says such agents often reach their objectives within an hour. Microsoft says the China-state-aligned group Storm-0940 used ARTEX, an open-source multi-agent pentest framework, in its ConnectWise campaign (Microsoft), which our October 2026 exploited vulnerabilities roundup covers.

Defenders use the same tools. After reviewing unintended model actions in its evaluations and internal use, Anthropic said on October 9 it was extending its shutoff of live internet access to all internal evaluations until its monitoring reliably catches such behavior (Anthropic), and on October 27 it reported that an unreleased internal model found 62 Chrome vulnerabilities, all patched as of Chrome 156 (Anthropic). Bugs are being found faster on both sides, so patch windows have to shrink too.

What these flaws have in common

• Untrusted content becomes instructions. Instruction files, web pages, MCP output and database properties reached agents as if the user wrote them.
• Agents inherit the developer’s credentials. SneakPeek and the CLAUDE.md test went after SSH keys, cloud credentials and OAuth tokens.
• MCP trust was assumed, not verified. OAuth issuers, transports and message routing were taken on the server’s word.
• No CVE means no scanner alert. opencode and the Downloads-folder research have no CVE because the vendors call them out of scope or working as designed, and the MCP Inspector advisory was published without one, so dependency scanners stay quiet.
• Defaults decide exposure. Auto-login, open ports, placeholder authentication and root containers turned bugs into remote compromises.

Our posts on how integrations expand the LLM attack surface and the security risks of vibe coding go further.

How to check your exposure

What to check	How
Claude Agent SDK	pip show claude-agent-sdk should report 0.2.121 or later
Claude Code	claude --version should report 2.1.251 or later (2.1.260 or later also covers the low-severity CVE-2026-103012)
Claude Desktop	Build 1.30096.1 or later
MCP packages	npm ls @modelcontextprotocol/sdk @modelcontextprotocol/client @modelcontextprotocol/server @modelcontextprotocol/inspector: sdk 1.31.0, client 2.2.0, server 2.3.0, Inspector 1.0.3 or later
Agent platforms	Langflow 1.9.0, opencode 1.18.33, GitLab AI Gateway 19.2.4, 19.3.2 or 19.4.1, LMCache 0.5.6, Loom 1.7.0, Context Forge 1.0.2 or later; DB-GPT has no fixed version
Claude Code settings	~/.claude/settings.json and project .claude/settings.json for an ANTHROPIC_BASE_URL or apiKeyHelper you did not set
MCP configuration	Config files for MCP servers nobody approved; allowlists for plugins and marketplaces
Working directories	Agents started from Downloads or the home directory
Credentials	Rotate after an affected Claude Desktop build previewed untrusted HTML, or a client connected to an untrusted MCP server
Network exposure	Langflow, LMCache, DB-GPT and MCP HTTP endpoints reachable from the internet or without authentication

How an AI penetration test covers this

Version checks catch the known bugs. A test looks for the next one in your own setup:

• Map every place untrusted content enters the agent’s context: repositories, tickets, web pages, email, database fields and MCP tool output.
• Plant harmless canary instructions, such as a call to a tester-owned URL, and see whether the agent acts.
• Run a tester-controlled MCP server to see whether clients can be redirected through an OAuth issuer, a transport switch or injected tool definitions.
• Check stdio command allowlisting, and authentication and CORS on MCP HTTP endpoints.
• Review backend code that passes user input into agent SDK options.
• Retest after the fixes.

The other half of the story is what attackers do with the keys they collect: our post on LLMjacking and stolen AI keys covers October’s breaches at AI developer platforms. See what an AI penetration test costs: from $4,500, fixed in writing before work begins, with a free retest of what you fix.

Frequently asked questions

Is Claude Code safe to use after these vulnerabilities? Yes, with the usual care. The Claude Code and Claude Desktop issues above are fixed and reached users through auto-update. Start agents in the project root, keep approvals and the sandbox on, and read instruction files you did not write.

What is CVE-2026-96620? An argument-injection flaw in the Python Claude Agent SDK that leads to command execution, scored 9.2 under CVSS 4.0. An untrusted value passed to the resume option could be read as a CLI flag and load an attacker’s MCP configuration. It is fixed in 0.2.121.

Is upgrading the MCP SDK enough? Not always. For CVE-2026-104850, bundled providers need expectedIssuer set, and a client that may have connected to an untrusted server should rotate its secrets and revoke its tokens. For CVE-2026-111770, the fixed version refuses shared server instances, so the code has to change too.

Why do some AI agent flaws have no CVE? Because the vendor treats the behavior as out of scope or working as designed, as with opencode and the Downloads-folder research. Without a CVE, dependency scanners will not flag the issue, so it needs a manual inventory or a test.

Is Langflow CVE-2026-105740 in CISA’s KEV catalog? Not as of the November 4, 2026 feed, although honeypot attempts were reported and earlier Langflow flaws are listed. Upgrade to 1.9.0 anyway and keep Langflow off the internet.

Fixed price, fixed scope, free retest. Scope your AI penetration test and get the price in writing.