Monday, October 19, 2026 · 1 of 5

1. Claude Agent SDK for Python has a critical argument-injection flaw

   An untrusted resume value can inject an MCP server and run commands at CLI startup, bypassing permission controls. Update the package.

   Oct 16SecurityAgents