# Cognivators

> Cognivators is a Chicago-based AI agent and MCP server security company. Its product, Agent Surface, maps what AI agents and MCP servers can reach and proves what an attacker could do with that access. It maintains mcp-safeguard, an open source MCP security scanner.

## Facts
- Legal entity: Cognivators LLC, founded September 2025, Chicago, IL, United States
- Founder: Syed Anas Mohiuddin (https://www.cognivators.com/founder)
- Product: Agent Surface, AI agent and MCP server security review
- Open source: mcp-safeguard, an MCP security scanner (PyPI: mcp-safeguard, MIT licence)
- Contact: anas.syed@cognivators.com

## Vulnerability record (each links to the primary source)
- [CVE-2026-14540: Google, 8.0 High (CVSS 4.0, assigned by Google)](https://www.cognivators.com/research/cve-2026-14540): The HTTP source in Google's MCP Toolbox followed redirects without validating where they led, so a crafted path parameter could make the server call internal or arbitrary external endpoints.
- [CVE-2026-97228: Rapid7, 2.7 Low (CVSS 3.1)](https://www.cognivators.com/research/cve-2026-97228): An MCP tool argument was placed straight into a GraphQL query string, so a crafted identifier could append extra selections to the query. Rated Low, and published because the pattern is common in MCP servers.
- [github-mcp-server PR #3056: GitHub, Hardening change, no CVE](https://www.cognivators.com/research/github-mcp-server-pr-3056): A transport re-added the Authorization header on every redirect hop. We wrote the patch that keeps the token on GitHub's own hosts. GitHub merged it as hardening, not as a response to a known exploit.
- Weaviate, weaviate/weaviate PR #12961: Fix merged by the Weaviate team, 2026-09-07 (https://github.com/weaviate/weaviate/pull/12961)
- JPMorgan Chase, jpmorgan-payments/ai PR #19: Fix merged by the JPMorgan Chase team, 2026-09-18 (https://github.com/jpmorgan-payments/ai/pull/19)
- 1Password-MCP (community project), GHSA-q3gg-rgxh-gh64: Advisory published 2026-09-01, severity High, finder credited. No CVE assigned. (https://github.com/CakeRepository/1Password-MCP/security/advisories/GHSA-q3gg-rgxh-gh64)

## Press
- Ars Technica, Oct 5, 2026: MCP for agent-to-agent comms may be the riskiest protocol you've never heard of (https://arstechnica.com/security/2026/10/vulnerability-in-agents-from-google-and-others-exposes-structural-flaw-in-mcp/)
- Unite.AI, Oct 5, 2026: Researcher Discloses Same MCP Flaw at Google, JPMorgan, Two Governments (https://www.unite.ai/researcher-discloses-same-mcp-flaw-at-google-jpmorgan-two-governments/)
- The Next Web, Oct 6, 2026: Google, JPMorgan and two governments fixed the same MCP flaw (https://thenextweb.com/news/mcp-flaw-ssrf-google-jpmorgan-dinum-protocol-pivoting)
- Tech Times, Oct 6, 2026: Six Weeks After Google and JPMorgan Patched MCP Flaw, US Servers Stay Exposed (https://www.techtimes.com/articles/328621/20261006/six-weeks-after-google-jpmorgan-patched-mcp-flaw-us-servers-stay-exposed.htm)

## Publications by the founder
- Never Emitted: Reporter Attribution in GitHub's Machine-Readable Vulnerability Records (Preprint, Zenodo, 2026-08-26): https://doi.org/10.5281/zenodo.22119724
- Protocol Pivoting: Cross-Protocol Attack Escalation in Agentic AI Systems (Preprint, Zenodo, 2026-05-24): https://doi.org/10.5281/zenodo.20371152
- Security Considerations for Model Context Protocol (MCP) Implementations in AI Agent Systems (IETF Internet-Draft, revision 00, 2026-06-02): https://datatracker.ietf.org/doc/draft-mohiuddin-mcp-security-considerations/
- Four vendors, one bad assumption: SSRF in MCP servers (dev.to, 2026-09-29): https://dev.to/syedanas01/four-vendors-one-bad-assumption-ssrf-in-mcp-servers-48ii
- ai-fix: when a command fails, one word fixes it (dev.to, 2026-05-23): https://dev.to/syedanas01/ai-fix-when-a-command-fails-one-word-fixes-it-5hmn
- The security problem nobody is talking about: MCP servers (dev.to, 2026-05-20): https://dev.to/syedanas01/the-security-problem-nobody-is-talking-about-mcp-servers-15oi

## Blog
- [The MCP tool that followed a redirect: how CVE-2026-14540 worked](https://www.cognivators.com/blog/mcp-tool-followed-a-redirect)
- [Why stripping the Authorization header on redirect does not work](https://www.cognivators.com/blog/why-stripping-authorization-on-redirect-fails)
- [A Low-severity CVE worth publishing: GraphQL injection through an MCP tool argument](https://www.cognivators.com/blog/a-low-severity-cve-worth-publishing)

## Pages
- [Research](https://www.cognivators.com/research)
- [Founder profile and timeline](https://www.cognivators.com/founder)
- [Founder research and publications](https://www.cognivators.com/founder/research)
- [Founder open source work](https://www.cognivators.com/founder/open-source)
- [Founder speaking and judging](https://www.cognivators.com/founder/speaking)
- [Press](https://www.cognivators.com/press)
- [About](https://www.cognivators.com/about)
- [Security services](https://www.cognivators.com/security)