Week of to
Bottom line
Two Model Context Protocol (MCP) products lead this week: metatool-ai MetaMCP has a code execution flaw in its inspector proxy endpoint, and the documented Docker quickstart for Obot starts with authentication disabled. Keep MetaMCP off the network and turn on authentication in Obot, though none of this week's new flaws is known to be exploited in the wild.
Secure It
- Attackers can authenticate as any existing Flowise user by claiming that user's email at any configured single sign-on provider.
- Hackers use custom ChatGPT models to impersonate legitimate products and trick users into running commands.
- The Carbonato botnet compromises Docker hosts to deploy a Telegram-controlled Hermes agent.
Build It
- NVIDIA OpenShell gives builders a way to add runtime controls to agents.
- The NVIDIA Open Agent Safety Platform reference describes continuous in-silicon agent monitoring.
- Cloud Security Alliance guidance says trust must extend past the model to MCP servers, skills and plugins.
Do this week
- Upgrade Obot to v0.23.0 (2 of its 6 flaws have no listed fix) and turn on authentication in its Docker quickstart.
- Restrict network access to metatool-ai MetaMCP because its inspector proxy endpoint has a code execution flaw.
- Upgrade OpenClaw to 2026.9.4 (one upgrade closes all 7).