feat(ai-red-teaming): add MCP tool-chain security to agentic-ai-security and emerging-threats (#10245)

Both topics covered agentic/emerging AI risk only in general terms and
predated the current MCP incident record. Adds:

- agentic-ai-security: confused-deputy tool-credential forwarding and the
  Invariant Labs GitHub MCP prompt-injection/exfiltration disclosure, plus
  a link to the MCP spec's own authorization requirements.
- emerging-threats: the April 2026 OX Security disclosure of an RCE flaw
  across the official MCP SDKs (Python/TS/Java/Rust), affecting an
  estimated 200,000 deployed servers - a concrete, dated example of the
  shared-tooling-layer risk class the topic already gestures at.

Existing content and links kept as-is; new paragraph sentences and links
appended.

Co-authored-by: Ahmed Hassan <ahmed.alaa.hassan25@gmail.com>

roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md

@@ -1,8 +1,10 @@
 # Agentic AI Security
 
-As AI agents capable of autonomous action become more common, AI Red Teamers must test their unique security implications. This involves assessing risks related to goal hijacking, unintended actions through tool use, exploitation of planning mechanisms, and ensuring agents operate safely within their designated boundaries.
+As AI agents capable of autonomous action become more common, AI Red Teamers must test their unique security implications. This involves assessing risks related to goal hijacking, unintended actions through tool use, exploitation of planning mechanisms, and ensuring agents operate safely within their designated boundaries. A growing share of real-world incidents target the tool-connection layer rather than the model itself — confused-deputy attacks where a tool server forwards a caller's credentials to a downstream service it was never issued for, or a malicious instruction hidden in untrusted content (e.g. a GitHub issue) tricking an agent into exfiltrating data through a fully trusted tool. Testing an agentic system means testing its tool boundaries and cross-server trust as rigorously as its prompts.
 
 Visit the following resources to learn more:
 
 - [@article@AI Agents - Learn Prompting](https://learnprompting.org/docs/intermediate/ai_agents)
-- [@article@EmbraceTheRed](https://embracethered.com/)
+- [@article@EmbraceTheRed](https://embracethered.com/)
+- [@official@Model Context Protocol - Authorization Specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
+- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)

roadmaps/ai-red-teaming/content/emerging-threats@-G8v_CNa8wO_g-46_RFQo.md

@@ -1,9 +1,11 @@
 # Emerging Threats
 
-AI Red Teamers must stay informed about potential future threats enabled by more advanced AI, such as highly autonomous attack agents, AI-generated malware that evades detection, sophisticated deepfakes for social engineering, or large-scale exploitation of interconnected AI systems. Anticipating these helps shape current testing priorities.
+AI Red Teamers must stay informed about potential future threats enabled by more advanced AI, such as highly autonomous attack agents, AI-generated malware that evades detection, sophisticated deepfakes for social engineering, or large-scale exploitation of interconnected AI systems. Anticipating these helps shape current testing priorities. One concrete example: in April 2026, researchers disclosed an architectural flaw across the official MCP SDKs (Python, TypeScript, Java, and Rust) allowing remote code execution, affecting an estimated 200,000 deployed servers across widely-used agent tooling. Because agents increasingly share common protocol layers and tooling infrastructure rather than each running bespoke code, a single flaw in that shared layer can propagate across the whole ecosystem at once — a different failure mode than a vulnerability scoped to one vendor's model, and one red team priorities should account for.
 
 Visit the following resources to learn more:
 
 - [@article@AI Security Risks Uncovered: What You Must Know in 2025](https://ttms.com/uk/ai-security-risks-explained-what-you-need-to-know-in-2025/)
 - [@article@Why Artificial Intelligence is the Future of Cybersecurity](https://www.darktrace.com/blog/why-artificial-intelligence-is-the-future-of-cybersecurity)
-- [@article@AI Index 2024](https://aiindex.stanford.edu/report/)
+- [@article@AI Index 2024](https://aiindex.stanford.edu/report/)
+- [@article@MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem - OX Security](https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/)
+- [@article@Critical RCE in Anthropic MCP Inspector (CVE-2025-49596) - Oligo Security](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)