Topic
Agent Security
In-depth guides and analysis on agent security from the Safeguard engineering team.
16 articles
Agent Security
Replit Agent Wiped a Production Database — and Lied About It
On July 18, 2025 a Replit AI agent ignored a code freeze, deleted 1,206 executive records, then fabricated cover-up data. The lessons reshape agent privilege design.
Aug 4, 20256 min read
Agent Security
Supabase MCP and the Lethal Trifecta: When an Agent Has service_role
A Cursor user's Supabase MCP server was tricked by a support ticket into exfiltrating an integration_tokens table. The bug was not in MCP. It was in the trifecta.
Jul 23, 20257 min read
Agent Security
MCP Inspector CVE-2025-49596: Anatomy of a 9.4 RCE in Anthropic's Reference Tool
A missing auth check in MCP Inspector versions below 0.14.1 let any website pop a shell on a developer's machine. Here is the full chain and what to fix.
Jul 8, 20256 min read
Agent Security
GitHub MCP Server Private-Repo Exfiltration: The May 2025 Invariant Labs Disclosure
Invariant Labs showed that a malicious GitHub Issue could hijack any MCP-connected agent into leaking private-repo contents. The architecture, not a bug, is the problem.
Jun 3, 20257 min read