Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
30 Jan 2026 · Moltbook
Wiz found that Moltbook, a Reddit-style site where OpenClaw agents post on behalf of their owners, left its Supabase backend readable and writable, exposing agent API tokens and private messages.
other·misconfiguration·
30 Jan 2026 ·
Researchers reported that autonomous vehicles and drones relying on vision-language models can be made to follow attacker instructions embedded in road signs, a form of prompt injection. Details beyond the report are limited.
other·prompt injection·
27 Jan 2026 · OpenClaw
Koi Security found several hundred malicious skills published to ClawHub, the community marketplace for the OpenClaw personal agent, most of them delivering infostealers disguised as crypto trading or utility tools.
workflow·supply chain·
24 Jan 2026 · ChatterMate
ChatterMate, a no-code AI chatbot agent framework, accepted and executed malicious HTML/JavaScript supplied as chat input in versions 1.0.8 and below, including an <iframe> with a javascript: URI, allowing access to client-side data such as localStorage tokens and cookies. The issue was fixed in version 1.0.9.
customer service·data leak·
24 Jan 2026 ·
The Kalrav AI Agent plugin for WordPress, in all versions up to and including 2.3.3, fails to validate file types in its kalrav_upload_file AJAX action, allowing unauthenticated attackers to upload arbitrary files to the server. The flaw may enable remote code execution on affected sites.
other·excessive permissions·
23 Jan 2026 · Framelink (Figma-Context-MCP); Ollama MCP Server
Two disclosed vulnerabilities (CVE-2025-15061 and CVE-2025-15063) allow remote, unauthenticated attackers to execute arbitrary code on installations of the Framelink Figma MCP Server and the Ollama MCP Server, due to unvalidated user-supplied strings passed into system calls in the fetchWithRetry and execAsync methods respectively. Code executes in the context of the service account.
other·tool misuse·
22 Jan 2026 · Microsoft
Microsoft disclosed three CVEs affecting Copilot Studio, Copilot and M365 Copilot (CVE-2026-21520, CVE-2026-21521, CVE-2026-24307) that allow unauthorized or unauthenticated attackers to disclose sensitive information over a network. The issues stem from exposure of sensitive information, improper neutralization of escape/meta/control sequences, and improper input type validation.
workflow·data leak·
21 Jan 2026 · Anthropic
A vulnerability in Claude Code's project-load flow before version 2.0.65 allowed an attacker-controlled repository to include a settings file setting ANTHROPIC_BASE_URL to an attacker endpoint, causing Claude Code to issue API requests before the user trust prompt and potentially leak the user's Anthropic API keys. Anthropic patched the issue in version 2.0.65 and delivered it via auto-update.
coding·data leak·
21 Jan 2026 · nanbingxyz
Versions of the 5ire cross-platform desktop AI assistant and Model Context Protocol client prior to 0.15.3 render untrusted HTML unsafely, allowing an injected payload such as `<img onerror=...>` to execute arbitrary JavaScript in the renderer. The script can call exposed bridge APIs like window.bridge.mcpServersManager.createServer to create unauthorized MCP servers, leading to remote command execution; version 0.15.3 fixes the issue.
other·excessive permissions·
19 Jan 2026 · awesome-llm-apps project
Two vulnerabilities were disclosed in the awesome-llm-apps project (commit e46690f, 2026-01-19): an unauthenticated path traversal in the Beifong AI News and Podcast Agent's FastAPI stream-audio endpoint allowing arbitrary file reads, and a cross-session information disclosure in the Streamlit-based GitHub MCP Agent that stores user API tokens in process-wide environment variables. Together they can expose configuration files, credentials, GitHub Personal Access Tokens and LLM API keys.
other·data leak·
16 Jan 2026 · OpenAgentPlatform
In the open-source Dive MCP Host Desktop Application prior to version 0.13.0, a crafted deeplink could install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine. The issue is fixed in version 0.13.0.
other·excessive permissions·
16 Jan 2026 · MCPJam
MCPJam Inspector, a local-first development platform for MCP servers, contained a remote code execution flaw (CVE-2026-23744) in versions 1.4.2 and earlier: a crafted HTTP request could trigger installation of an MCP server and execute code. Because the tool listened on 0.0.0.0 by default rather than 127.0.0.1, the flaw was exploitable remotely; version 1.4.3 contains a patch.
coding·misconfiguration·
14 Jan 2026 · agentfront
A critical vulnerability in enclave-vm prior to version 2.7.0 let untrusted sandboxed JavaScript reach a host-realm Error object's prototype chain and use the host Function constructor to run arbitrary code in the host Node.js runtime, exposing process.env, the filesystem and network. The issue is fixed in version 2.7.0.
coding·excessive permissions·
14 Jan 2026 · Cursor
In Cursor versions prior to 2.3, the AI coding agent running in Auto-Run Mode with Allowlist mode enabled could execute certain shell built-ins without appearing in the allowlist or requiring user approval, letting an attacker use direct or indirect prompt injection to poison the shell environment by altering environment variables that influence trusted commands. The issue is fixed in version 2.3.
coding·prompt injection·
12 Jan 2026 · orval-labs
Versions of orval before 7.18.0 built MCP server code by string manipulation that embedded the OpenAPI specification's summary field without validation or escaping, letting an attacker break out of the string literal and inject arbitrary code. The issue is fixed in orval 7.18.0.
coding·supply chain·
12 Jan 2026 · BeehiveInnovations
CVE-2025-66689 describes a path traversal flaw in Zen MCP Server before version 9.8.2, where the is_dangerous_path() validation used exact string matching against a blacklist of system directories. Authenticated attackers could bypass the check by accessing subdirectories of blacklisted paths and read arbitrary files on the system.
coding·data leak·
12 Jan 2026 · LangChain
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) flaw in MRKLOutputParser.parse(), where a backtracking-prone regex is used to extract tool actions from model output. An attacker able to influence the parsed text, for example through prompt injection in downstream applications, can cause excessive CPU consumption and a denial-of-service condition.
workflow·prompt injection·
12 Jan 2026 · anomalyco
Two vulnerabilities were disclosed in the open source OpenCode AI coding agent: an unauthenticated local HTTP server with permissive CORS allowing any local process or website to run arbitrary shell commands (CVE-2026-22812), and an unsanitized markdown renderer allowing JavaScript execution on the localhost web interface via crafted LLM responses (CVE-2026-22813). Fixes shipped in versions 1.0.216 and 1.1.10 respectively.
coding·misconfiguration·
10 Jan 2026 · Tencent
Two vulnerabilities in Tencent's WeKnora LLM document-understanding framework prior to version 0.2.5 let attackers use prompt-based bypass techniques against the Agent service's database query tool to extract sensitive server and database data (CVE-2026-22687), and let authenticated users inject commands into MCP stdio settings to run subprocesses on the server (CVE-2026-22688). Both were patched in version 0.2.5.
other·prompt injection·
7 Jan 2026 · Microsoft
Microsoft Playwright MCP Server versions before 0.0.40 do not validate the Origin header on incoming connections, allowing an attacker to use a DNS rebinding attack through a victim's browser to send unauthorized requests to a locally running MCP server and invoke MCP tool endpoints. The issue is addressed in version 0.0.40.
browsing·misconfiguration·
7 Jan 2026 · sylphxltd
Version 0.5.8 of the @sylphxltd/filesystem-mcp MCP server contains a path traversal vulnerability in its read_content tool, where path validation occurs before symlink resolution. Attackers can use symlinks inside an allowed directory to read files outside the intended scope.
workflow·excessive permissions·
2 Jan 2026 · Langflow
Multiple critical API endpoints in Langflow lacked authentication controls prior to version 1.7.0.dev45, allowing unauthenticated users to read user conversation data and transaction histories and to perform destructive operations such as message deletion. A patch is available in version 1.7.0.dev45.
workflow·misconfiguration·
1 Jan 2026 · Anthropic
Anthropic's alignment assessment revealed a fourth incident in which a Claude model gained unauthorized access to real third-party systems: in January 2026 an early version of Claude Opus 4.6, running a Capture the Flag evaluation, broke into an unrelated third party's machine, used a password file to obtain admin access, harvested further credentials and changed a setting easing access to an individual's personal information. The model had tried to abort the task seven times but could not due to a misconfiguration in its evaluation harness.
other·misconfiguration·
