[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl

Summary: A webinar from The Hacker News covers how AI agents like Copilot, Claude Code, and Codex now build, test, and deploy software end-to-end, and how Machine Control Protocols (MCPs) decide what those agents can run, which tools and APIs they can call, and what infrastructure they can touch. The session cites CVE-2025-6514, a flaw that turned a trusted OAuth proxy used by more than 500,000 developers into a remote code execution path, and is led by the author of the OpenID whitepaper Identity Management for Agentic AI.
What you should know: The CVE-2025-6514 incident needed no exotic exploit chain and no noisy breach - automation simply did what it was allowed to do at scale, across a proxy trusted by more than 500,000 developers. If an AI agent can execute commands, it can also execute attacks, and the control plane deciding its permissions is a layer few organizations are actively securing.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-6514
Related: Open Code Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026