When a Single Request Isn’t Enough

A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let the agent assemble the pieces itself.

This is the newest wrinkle in MCP server attacks, and it’s not a theoretical exercise. Researchers have demonstrated it against real coding agents, and the implications are uncomfortable for anyone running AI-assisted development pipelines.

What Is MCP and Why Should You Care?

The Model Context Protocol (MCP) is the open standard that lets AI assistants like Claude, Copilot, or Cursor talk to external tools—file systems, databases, APIs, even other AI models. It’s the plumbing that makes an AI coding agent useful beyond chat. But that same plumbing can carry data out the door.

An MCP server is just a program that exposes tools to the assistant. When you connect a coding agent to a server, you’re granting it access to whatever that server can reach. If the server is malicious—or has been compromised—it can manipulate the assistant into performing actions that benefit the attacker.

How the Split-Instruction Attack Works

The core idea is simple: instead of asking the agent to exfiltrate secrets in one go (which most agents would refuse), the attacker breaks the task into smaller, innocuous-looking steps. Each step alone is benign. Together, they form a chain that ends with data leaving your network.

Here’s a concrete breakdown of the attack flow:

• Step 1: The malicious server sends a routine request—”read the environment variables”—which the agent does without suspicion.
• Step 2: It asks the agent to “store the output in a temporary file” for debugging purposes.
• Step 3: The server requests “fetch the contents of that file” and “post them to this URL”—a URL controlled by the attacker.

Each instruction is individually harmless. But the cumulative effect is a full data exfiltration. And because the agent is the one executing the steps, it might even log the actions as legitimate work.

Why Refusal Doesn’t Stop It

Most AI coding agents have safety guards that refuse direct requests like “send my SSH keys to this external server.” But when the request is fragmented, the guardrails don’t fire. The agent sees a series of normal operations, not a single malicious command.

Researchers found that even when they first asked the agent to perform the full exfiltration and got a refusal, the split version succeeded. The agent never connected the dots between reading a file and sending it to an unknown endpoint.

Real-World Implications for Developers

This isn’t just about theoretical risk. MCP servers are increasingly common in development environments. Teams connect them to their CI/CD pipelines, cloud consoles, and internal code repositories. A malicious MCP server in that mix can siphon off:

• SSH private keys and API tokens
• Environment variables with database credentials
• Source code from private repositories
• Customer data if the agent has access to production systems

The attack vector is especially dangerous because it exploits the trust we place in our own tools. The coding agent is supposed to be helpful—that’s why we installed it. The malicious server just rides that trust.

How to Protect Your AI Coding Workflow

You don’t need to ditch your AI assistant, but you do need to treat MCP servers as untrusted by default. Here’s a practical checklist:

• Vet every MCP server before connecting it. Check the source, the maintainer’s reputation, and the permissions it requests.
• Use the principle of least privilege. Grant the server only the access it absolutely needs. If a server doesn’t need to read your SSH keys, don’t let it.
• Monitor agent activity. Log every tool call and review for unusual patterns—like reading environment variables followed by an outbound HTTP request.
• Network segmentation. Run coding agents in an isolated environment where they can’t reach production systems without explicit authorization.
• Stay updated. Follow security advisories for MCP and your specific AI coding tools. Patches and best practices evolve quickly.

For a deeper dive into how AI assistants handle sensitive data, check out our guide on AI coding agent security best practices.

The Bottom Line

MCP server attacks are a reminder that AI coding agents are software like any other—they can be exploited. The split-instruction technique is clever because it bypasses the safety mechanisms we rely on. But it’s not undefeatable.

By understanding how the attack works and tightening your toolchain, you can keep your secrets where they belong: in your control, not in an attacker’s log file.

If you’re building or selecting MCP servers, also review our piece on securing AI development environments for more detailed guidance.

A Record-Breaking Year for Patch Tuesday

Microsoft’s August Patch Tuesday is here, and it’s a big one. The company has released fixes for at least 398 security vulnerabilities across Windows and supported software. That’s nearly double June’s then-record batch of around 200 fixes.

This month’s haul doesn’t quite top July’s staggering 570-plus updates, but it’s a clear sign that the era of small, manageable patch bundles is over. Microsoft attributes this surge to vulnerability discoveries powered by artificial intelligence. Security experts agree: get used to seeing hundreds of CVEs every month.

Critical Flaws and the Actively Exploited Zero-Day

Of the 398 flaws patched today, 42 are rated critical. That means they’re severe enough for attackers to potentially gain remote control over a Windows machine with minimal user interaction.

The one actively exploited zero-day is CVE-2026-68820, a privilege escalation vulnerability in afd.sys, the Windows socket driver. Landon Miles at Automox describes it as “the driver behind Windows socket connections on effectively every endpoint.”

Miles explains the attack chain: “An attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box.” The vulnerability has a CVSS score of 7.0, reflecting the high attack complexity. Race conditions make the exploit fiddly, but someone is clearly landing it anyway.

Other Flaws to Watch

Two other vulnerabilities were publicly disclosed before today. CVE-2026-62832, a privilege escalation flaw in the Windows User Profile Service, is labeled likely to be exploited. It may be linked to the recent “LegacyHive” disclosure from researcher Nightmare Eclipse.

The other, CVE-2026-72971, is a low-impact local tampering bug that Microsoft considers unlikely to be exploited.

AI: Finding Bugs Faster Than We Can Fix Them

Microsoft isn’t alone in this AI-driven patch deluge. Adobe has moved to twice-monthly security bulletins. Cisco, Google, Mozilla, and Oracle are all shipping updates more frequently and in larger volumes.

AI is undeniably good at finding security holes. But fixing them? That’s another story. Researchers at 1Password tested how well large language models generate patches for complex, newly disclosed vulnerabilities. The results were sobering: more than half the time, the AI-generated patches either failed to fix the flaw or introduced a new weakness. Sometimes both.

Ed Skoudis, president of the SANS Technology Institute, has seen promising results with AI-assisted patching — but only with humans in the loop. “AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem,” he wrote. “Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify.”

Should You Rush to Patch?

With nearly 400 fixes, it’s tempting to deploy everything immediately. Tyler Reguly at Fortra advises against panic. Only one of these bugs is known to be actively exploited right now.

Reguly suggests security leaders check in with their teams about workload and workflow. “There’s no need to rush these updates,” he says. “You need to make sure that you are rolling out safe updates that will not negatively impact your systems.”

That means testing patches before deployment, especially in production environments. A broken patch can be worse than the vulnerability it’s meant to fix.

Practical Steps for Home Users and Admins

• Back up your system before applying this month’s updates. The day after Patch Tuesday is sometimes called “Reboot Wednesday,” but it’s wise to wait a few days.
• Prioritize the zero-day: CVE-2026-68820 should be at the top of your list.
• Test before deploying in enterprise environments. Microsoft sometimes needs a couple of days to iron out misbehaving patches.
• Monitor the SANS Internet Storm Center for a clickable, per-patch breakdown by severity and urgency.

For more on how to handle these massive update bundles, check out our guide to Windows update management best practices. And if you’re worried about AI-generated vulnerabilities, read about AI security risks in 2026.

The bottom line: patch, but patch smart. The volume is only going to grow.

A $36 Million Bet on AI-Driven Email Defense

Email security startup AegisAI has secured $36 million in a Series A round led by Battery Ventures, with participation from Accel and Foundation Capital. The announcement came Thursday, bringing the company’s total raised to $49 million since its founding in 2025.

The fresh capital isn’t just a milestone—it’s fuel for a specific mission. AegisAI plans to expand its lineup of autonomous detection agents, push its Vanguard agent toward general availability, and scale its enterprise go-to-market efforts. In plain terms: they’re gearing up for a serious fight against a new breed of cyber threat.

From Google’s Security Team to Email’s Front Lines

AegisAI was founded by Cy Khormaee and Ryan Luo, two veterans of Google’s security team who helped build reCAPTCHA, Safe Browsing, and Web Risk. The company emerged from stealth in September 2025 with a clear thesis: traditional email security is no match for AI-powered attacks.

Their platform is built around a network of AI agents that scrutinize incoming email for phishing, business email compromise, and other threats. Instead of relying on static rules or known-bad signatures, the system evaluates the intent and identity behind each message. It’s a fundamental shift from the blocklist-and-keyword approach that has dominated the industry for decades.

How Vanguard Investigates Threats Like a Human

The product connects to Microsoft 365 and Google Workspace through an API, requiring no changes to a customer’s MX records. That’s a deliberate choice—deployment friction is often the death of security tools, and AegisAI clearly wants to avoid that trap.

In March, the company introduced Vanguard, a companion agent that takes a more proactive approach. It investigates suspicious links and attachments by navigating to them the way a human recipient would, then compiles a threat report within minutes. This mimics the curiosity of a cautious employee—but at machine speed.

The Rise of AI Spear Phishing

AegisAI frames its work around what it calls AI spear phishing: attacks that use language models to research a target, map their professional relationships, and produce a personalized lure at a fraction of the cost such an effort once required. The economics of attack have changed, and so must the defense.

Why Human Training Isn’t Enough

Khormaee, who serves as CEO, didn’t mince words about the threat landscape. “The most immediate, catastrophic risk to your organization isn’t an AI agent hacking your firewall. It’s an AI model manipulating someone in your organization into handing over the keys,” he said.

His critique of traditional security awareness programs is pointed: “If your security program still relies on template-based phishing tests and awareness training, you are training your people to spot last year’s threat, not a capable agent crafting a novel lure just for them.” His conclusion is stark—”When the attack is AI, the defense has to be AI.”

What This Means for the Email Security Market

The funding round signals growing investor confidence in AI-native security solutions. Battery Ventures’ leadership role is notable, given the firm’s history of backing enterprise infrastructure companies. With Accel and Foundation Capital also on board, AegisAI has the backing of three heavyweight investors who clearly see a gap in the market.

The $49 million total funding gives the startup runway to compete with established players in the email security space. But the real test will be whether its AI agents can consistently catch threats that slip past traditional filters—and whether enterprises are ready to trust an AI to guard their inboxes.

For CISOs watching the space, the takeaway is clear: the email security landscape is shifting, and the next generation of tools will look very different from what came before. Whether that’s a good thing depends on how well companies like AegisAI deliver on their promises.