Last seen September 25, 2025

Anthropic Prompt Injection Vulnerability

Evidence indicates that Anthropic is affected by prompt injection.

Technical Severity
Low severity
Lifecycle Status

STABLE

Sources

What Happened

Evidence indicates that Anthropic is affected by prompt injection.

Why This Matters

The evidence matters to defenders using Anthropic because it may let untrusted content influence connected tools or sensitive workflows.

Recommended Action

No confirmed vendor remediation is available in the current evidence. Confirm whether Anthropic is present in your environment and review the affected configuration.

Exposure

Recommended Response
First Seen

Jul 01, 2025 05:30

Last Seen

Sep 25, 2025 05:30

Exploitation status: UNKNOWN

Primary entities:

Anthropic AI Agents Data Leakage MCP Prompt Injection Remote Code Execution

Authoritative Intelligence

CVE CVE-2025-49596 Incident identifier

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Timeline

  • Incident first seen
    Jul 01, 2025 05:30

    BugSkan first recorded this incident.

  • Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits - The Hacker News
    Jul 01, 2025 05:30

    thehackernews.com · Vulnerability

  • The MCP Security Survival Guide: Best Practices, Pitfalls, and Real-World Lessons - Towards Data Science
    Aug 06, 2025 05:30

    towardsdatascience.com · Vulnerability

  • Salesforce AI Agents Forced to Leak Sensitive Data - Dark Reading | Security
    Sep 25, 2025 05:30

    darkreading.com · Data Leak

  • Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection - The Hacker News
    Sep 25, 2025 05:30

    thehackernews.com · Vulnerability

  • Latest observed development
    Sep 25, 2025 05:30

    Most recent source or update associated with this incident.

Sources

Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits - The Hacker News

thehackernews.com · Jul 01, 2025 05:30

A critical remote code execution (RCE) vulnerability, CVE-2025-49596 (CVSS 9.4), has been identified in Anthropic's Model Context Protocol (MCP) Inspector, exposing developer machines to compromise. Attackers can exploit this by chaining a browser flaw dubbed "0.0.0.0 Day" with a CSRF vulnerability in the Inspector, leveraging default settings that lack authentication and encryption.

Open publisher source
The MCP Security Survival Guide: Best Practices, Pitfalls, and Real-World Lessons - Towards Data Science

towardsdatascience.com · Aug 06, 2025 05:30

The article details critical security vulnerabilities within Model Context Protocol (MCP) deployments, including a remote code execution exploit (CVE-2025-49596) affecting exposed MCP Inspector tools. It also outlines how malicious OAuth proxying, leveraging the "Confused Deputy Problem," can lead to user impersonation and unauthorized access to third-party services.

Open publisher source
Salesforce AI Agents Forced to Leak Sensitive Data - Dark Reading | Security

darkreading.com · Sep 25, 2025 05:30

Researchers discovered "ForcedLeak," a critical indirect prompt injection vulnerability (CVSS 9.4) within Salesforce's Agentforce AI platform. This exploit enables attackers to embed malicious instructions into web forms, compelling the autonomous agent to exfiltrate sensitive CRM data, including PII and corporate secrets, to attacker-controlled domains.

Open publisher source
Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection - The Hacker News

thehackernews.com · Sep 25, 2025 05:30

Salesforce Agentforce was susceptible to a critical indirect prompt injection vulnerability, codenamed ForcedLeak (CVSS 9.4). This flaw allowed attackers to exfiltrate sensitive CRM data by manipulating Web-to-Lead forms, causing AI agents to transmit information to an attacker-controlled domain.

Open publisher source

Watchlist Match

Want personalized relevance?

Create an account to see which incidents overlap with the technologies you monitor.

← Back to incident intelligence