October 20, 2026

Initial access goes through Google Search ads on "google cloud" and "gcp" leading to a fake login page.

GCP projects controlled by the attackers are linked to the victim's billing account.

The prompts and the model responses therefore remain invisible to the victim organization.

According to Wiz CIRT, the charges reach tens to hundreds of thousands of dollars in 24 to 48 hours.

Claude Code, Goose and Qwen Code ask no question from the first call in their default configuration.

After the server's notification, Claude Code, VS Code and Cursor IDE fetch the new description without displaying anything.

Gemini CLI is the only client to report the change, with a line: "Tools updated for server".

In these clients, an approval is tied to the tool's name, not to what the tool says it does.

The CVE-2026-104850 flaw has a CVSS score of 7.5 and requires no user interaction.

The refresh_token and client_secret of a previous connection can leak in 1.x.

The fixes are in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0.

According to the author, the update alone is not enough: expectedIssuer must also be passed to the provided providers.

Out of 3,881,598 real files, only one contained an attempt, and it was a security firm's test.

375,582 sites, or 9.7%, have a robots.txt with text addressed to AI.

61,682 Shopify stores ask agents to have their user install the Shop skill.

The reference MCP fetch server, when it refuses a page, passes the whole robots.txt file to the model.

The analysis covered more than five million lines of code written notably in C, C++, Java, PHP and Python.

The eleven projects with authenticated access all had code reachable unintentionally.

In 94 cases, a combination of options silently disabled a security control.

In OpenSSH 10.4, about 4,500 lines of ML-DSA-44 code were reachable without authentication by default.