Dependency Security

Dependency security covers the risk that the third-party software libraries and packages an organization relies on contain flaws or malicious code that can be exploited, often without the organization's direct knowledge. For AI systems, this extends to open-source machine learning frameworks, model-serving tools, and pre-trained model files, any of which can carry vulnerabilities or hidden backdoors. Compliance teams care because a single compromised upstream component can expose customer data, trigger breach-notification duties, and create liability under security and supply-chain rules such as the EU's Cyber Resilience Act.

1 item

ResearchGlobal2026-10-27

Four Agent Framework Flaws Let Attackers Cross Session Boundaries and Bypass Authorization

Security researcher Corgea has published advisories for four widely used AI agent and infrastructure frameworks: Strands Agents SDK, LangGraph, FastMCP, and MLflow. The flaws allow attackers to access other users' session data and navigate outside permitted file paths. They can also bypass access controls after data is processed and make unauthorized outbound network requests from scoring components. Organizations running these frameworks in production should treat the advisories as requiring immediate dependency review.

agentic AI agent frameworks authorization bypass dependency security session isolation LangGraph MLflow FastMCP