Manifold enables security teams to see which AI agent threats to act on first

AI agents load add-ons that nobody reviews

Every AI agent your team runs depends on things it did not ship with: MCP servers that connect it to outside tools, skills that add instructions and scripts, plugins and editor extensions. They update every week and install without review. More and more often the agent installs them itself, by name, with no person reading the listing.

In July our research team found 77 counterfeit extensions on Open VSX, each copying the name of a real VS Code Marketplace extension. Nineteen of them sent the private repository path, git identity and CI project details of whatever machine ran them to a domain registered eleven days earlier. Nothing in their code would have tripped a scanner.

That was one campaign. Public research on threats to agents and the add-ons they load now arrives at about 15 new reports a day.

15 reports a day is more than any team can read

The research is spread across news sites, vulnerability databases and research papers. Teams try to keep up by reading those sources one by one and passing links around in chat. The truth is that it’s too much for anyone to keep up with while holding down their actual job, and nothing even says which report to read first.

On 15 September, two MCP servers received the maximum CVSS score of 10.0 on the same day. CVE-2026-59971 let anyone who could reach a widely used MySQL MCP server run SQL against it without logging in. CVE-2026-53710 gave unauthenticated attackers command execution through a sandbox server shipped with IBM's ContextForge MCP gateway, five days after the gateway itself was found to ship with default admin passwords (CVE-2026-78573, CVSS 9.8). A team reading by hand had to spot all three, work out whether they ran any of them, and patch, alongside everything else published that week.

Until now, Manifold showed this research only when a report named a tool we track in Manifest, where it appeared as an issue on that tool’s page. On 24 September that covered 131 of 1,402 reports. The other 1,271 had no place in the product.

A research agent reads the sources and ranks every report

Threat intelligence is a feed of public research on threats to AI agents, MCP servers, skills and the rest of the agent supply chain. An AI research agent watches public sources, including vulnerability databases, research papers, vendor and lab research, security press and community forums. It drops anything off topic. When the same story appears in several places, it becomes one report, linked to where it was first published.

Each report is then scored from 1 to 5 for severity, relevance and novelty. Whether the attack is being used in the wild is tracked separately, as actively exploited, proof of concept or none observed. Since June the feed has collected more than 1,400 reports. A severe flaw nobody has exploited yet and a smaller one being used today should not look the same, and here they don’t.

From 1,400 reports to a dozen in a few clicks

Open Threat intelligence and every report is listed with its recommended action, exploitation status and score. Filter to the most urgent reports that are actively exploited, then search for “MCP”. The list drops to about a dozen.

Open a report and it tells you what you need to act on it:

Sort the whole feed by severity, relevance, novelty or total score to see what could do the most damage, or by date to see what just arrived. Filter by category, recommended action and exploitation, or search by name.

Live now in the Manifold platform

Threat intelligence is in Manifold now, under Insights, then Threat intelligence, for anyone whose role can see Detections. There is nothing to switch on. When a report names a tool Manifest already tracks, it can also appear as an issue on that tool, and customers whose people use it see the issue in their own inventory.

The research on threats to AI agents is already public. Threat intelligence puts it in one place and tells your team where to start.