diff --git a/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md b/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md
index bcc29bf16..4c2fd6b35 100644
--- a/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md
+++ b/roadmaps/ai-red-teaming/content/agentic-ai-security@FVsKivsJrIb82B0lpPmgw.md
@@ -1,8 +1,10 @@
 # Agentic AI Security
 
-As AI agents capable of autonomous action become more common, AI Red Teamers must test their unique security implications. This involves assessing risks related to goal hijacking, unintended actions through tool use, exploitation of planning mechanisms, and ensuring agents operate safely within their designated boundaries.
+As AI agents capable of autonomous action become more common, AI Red Teamers must test their unique security implications. This involves assessing risks related to goal hijacking, unintended actions through tool use, exploitation of planning mechanisms, and ensuring agents operate safely within their designated boundaries. A growing share of real-world incidents target the tool-connection layer rather than the model itself — confused-deputy attacks where a tool server forwards a caller's credentials to a downstream service it was never issued for, or a malicious instruction hidden in untrusted content (e.g. a GitHub issue) tricking an agent into exfiltrating data through a fully trusted tool. Testing an agentic system means testing its tool boundaries and cross-server trust as rigorously as its prompts.
 
 Visit the following resources to learn more:
 
 - [@article@AI Agents - Learn Prompting](https://learnprompting.org/docs/intermediate/ai_agents)
-- [@article@EmbraceTheRed](https://embracethered.com/)
\ No newline at end of file
+- [@article@EmbraceTheRed](https://embracethered.com/)
+- [@official@Model Context Protocol - Authorization Specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization)
+- [@article@GitHub MCP Exploited: Accessing Private Repositories via MCP - Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)
\ No newline at end of file
diff --git a/roadmaps/ai-red-teaming/content/emerging-threats@-G8v_CNa8wO_g-46_RFQo.md b/roadmaps/ai-red-teaming/content/emerging-threats@-G8v_CNa8wO_g-46_RFQo.md
index 477da7b90..02708ef39 100644
--- a/roadmaps/ai-red-teaming/content/emerging-threats@-G8v_CNa8wO_g-46_RFQo.md
+++ b/roadmaps/ai-red-teaming/content/emerging-threats@-G8v_CNa8wO_g-46_RFQo.md
@@ -1,9 +1,11 @@
 # Emerging Threats
 
-AI Red Teamers must stay informed about potential future threats enabled by more advanced AI, such as highly autonomous attack agents, AI-generated malware that evades detection, sophisticated deepfakes for social engineering, or large-scale exploitation of interconnected AI systems. Anticipating these helps shape current testing priorities.
+AI Red Teamers must stay informed about potential future threats enabled by more advanced AI, such as highly autonomous attack agents, AI-generated malware that evades detection, sophisticated deepfakes for social engineering, or large-scale exploitation of interconnected AI systems. Anticipating these helps shape current testing priorities. One concrete example: in April 2026, researchers disclosed an architectural flaw across the official MCP SDKs (Python, TypeScript, Java, and Rust) allowing remote code execution, affecting an estimated 200,000 deployed servers across widely-used agent tooling. Because agents increasingly share common protocol layers and tooling infrastructure rather than each running bespoke code, a single flaw in that shared layer can propagate across the whole ecosystem at once — a different failure mode than a vulnerability scoped to one vendor's model, and one red team priorities should account for.
 
 Visit the following resources to learn more:
 
 - [@article@AI Security Risks Uncovered: What You Must Know in 2025](https://ttms.com/uk/ai-security-risks-explained-what-you-need-to-know-in-2025/)
 - [@article@Why Artificial Intelligence is the Future of Cybersecurity](https://www.darktrace.com/blog/why-artificial-intelligence-is-the-future-of-cybersecurity)
-- [@article@AI Index 2024](https://aiindex.stanford.edu/report/)
\ No newline at end of file
+- [@article@AI Index 2024](https://aiindex.stanford.edu/report/)
+- [@article@MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem - OX Security](https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/)
+- [@article@Critical RCE in Anthropic MCP Inspector (CVE-2025-49596) - Oligo Security](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)
\ No newline at end of file