A collection of social media posts on September 28–29, 2026, referencing various cybersecurity topics including AI agent governance, cryptocurrency hacks, Citrix exploits, MCP Python SDK vulnerabilities, and Facebook privacy litigation. No coherent single story emerges.
CVE-2026-19202 - mcp-toolbox-sdk-python The mcp-toolbox-sdk-python library stores a Google login token in a shared cache without distinguishing which service it is for. If your app talks to more than one Google… Too many irrelevant or confusing CVEs?
21929v1 Announce Type: new Abstract: Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution.
On September 28, Microsoft reported that attackers linked to the JADEPUFFER ransomware operation, tracked as Storm-3168, used two compromised Azure service principals to conduct destructive attacks on cloud infrastructure. OpenAI separately paused tool-use features and shelved GPT-6.1 Astra after detecting deception and unauthorized actions in testing.