The attack surface moved into the AI supply chain

Malicious packages in the agent's toolbox

Knostic researchers found two malicious npm packages that pose as document tools for AI agents: @ifasn/mmdd-doc-mcp and @ifasn/ms-doc-mcp, both published to the npm registry on 3 November 2026. Knostic assessed both as malicious. The company's AgentMesh scanner had rated mmdd-doc-mcp Dangerous, which prompted the review. m:…0543

The mmdd package gathers process information, including command lines that may contain secrets, checks the cloud metadata service, and tries to send a report over plain HTTP to 121.199.24.94. It captures command-line arguments containing 'password', 'secret' or 'jasypt'. Its file header falsely claims no network reporting. The ms-doc package records the full values of environment variables with secret-like names and writes them to stderr and a local file. Knostic found no code in ms-doc-mcp that transmits the collected report to an external server, and no path from its outputs to the publisher was established — but the secrets are still logged, and the advice is the same: remove both packages and rotate any secrets that may have been exposed. m:…0543

Stolen sessions at the identity layer

The second thread is an identity flaw, not an AI flaw — but it sits underneath the systems agents log into. OpenAM versions before 16.1.4 carry three critical vulnerabilities under CVE-2026-123551. The SAML bypass occurs because OpenAM accepts unsigned SAML assertions on ECP and HTTP-Artifact bindings, and a self-registration flaw lets an anonymous user join an administrative group. The token disclosure flaw is rated CVSS 10.0; the other two are rated 9.3. m:…4335

The mechanism is a small configuration error with large consequences. The notification WebSocket flaw allows token theft because the security filter was incorrectly mapped to request dispatches only, and internal forwards to /notifications bypass the security filter. The fix is OpenAM 16.1.4, released on 22 October 2026, and the mitigations are to require signed assertions, restrict the notifications WebSocket to policy-agent hosts, and disable self-registration in every realm. No public proof of concept exists, and the flaws were not in the CISA known-exploited-vulnerabilities catalog as of 8 November. m:…4335

The threat intel you never see

The third thread is about the tooling meant to catch all of this. Broad exclusions in dark-web threat intelligence queries create blind spots: "Excluding a software name from a dark web search can remove the posts your analysts need." Remote access software shows up both in support discussions and in offers to sell unauthorised access to a system — exclude the name and both disappear. m:…7388

The case study is ScreenConnect. Elastic research published on 4 November 2026, based on confirmed intrusions from April to September 2026, found ScreenConnect was the product named most among 23 confirmed remote monitoring and management abuse cases. In Webz.io's Cyber API, the NOT operator excludes a term and unprefixed terms match both post text and thread titles, so a broad exclusion acts on more than the text the analyst meant to omit — and thread handling in collectors can lose matching replies as well. The advice is to test exclusions against synthetic records, keep the reason for each exclusion with the query version and reviewer, and check query exclusions and thread restrictions separately, since fixing one does not guarantee the whole conversation reaches the analyst. m:…7388