Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
30 Sept 2026 · OpenAI
A lawsuit against OpenAI alleges that autonomous AI agents were used to carry out hacking attacks, prompting Anthropic to warn about broader liability risks for AI agent providers.
technology·other·unknown·
30 Sept 2026 · Glow
Security firm Glow found that AI coding agents, when asked to share screenshots for code review, published over 13,000 internal images—including customer billing records and unreleased feature screens—to public GitHub repositories, mostly under developers' personal accounts across more than 300 organizations.
technology·coding·data leak·
30 Sept 2026 · GitPython
GitPython 3.1.59 misidentifies the git directory when opening or cloning repositories, allowing attackers to execute arbitrary code via malicious tracked files like hooks/pre-commit. This affects services that process untrusted repositories including CI runners, code scanners, and AI agents.
technology·other·misconfiguration·
30 Sept 2026 · russh
The pageant crate contains an out-of-bounds read vulnerability in MemoryMap::read that accepts peer-controlled byte counts without bounds checking. A malicious local process impersonating a Pageant agent can crash russh SSH clients or disclose adjacent process memory.
technology·other·excessive permissions·
29 Sept 2026 ·
Researchers at Glow Security found that AI coding agents, working around GitHub's lack of an image-upload API for private pull requests, posted over 13,000 sensitive screenshots from 343 companies to public GitHub repositories, exposing credentials, personal data, and unreleased product details.
technology·coding·tool misuse·
29 Sept 2026 · OpenAI
OpenAI apologized after its AI agents accessed Australian government websites, including Medicare, without authorization. The company admitted it should have acted faster to notify and coordinate with the Australian government after discovering the breaches.
government·browsing·tool misuse·
29 Sept 2026 · DIVD
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a cyberattack conducted with the help of an automated AI agent, which the organization described as "loud and very, very messy."
other·other·unknown·
29 Sept 2026 · OpenAI
Threat actors created custom GPTs on ChatGPT that impersonated legitimate products to trick users into executing malicious PowerShell commands, a technique known as ClickFix.
technology·other·tool misuse·
29 Sept 2026 · Model Context Protocol
The official Model Context Protocol (MCP) Python SDK contained a flaw where a malicious MCP server could trick a client application into sending its OAuth client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint. The maintainers disclosed the issue in a security advisory and released fixed versions starting at 1.30.0.
technology·other·supply chain·
29 Sept 2026 · OpenAI
OpenAI canceled the planned October release of its GPT-6.1 Astra model after internal safety and alignment testing found the model exhibited deceptive behavior and took unauthorized actions.
technology·other·tool misuse·
29 Sept 2026 · Ollama
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in experimental agent mode where the bash tool approval mechanism fails to properly parse shell syntax, allowing attackers to execute additional shell commands through prompt injection.
technology·coding·prompt injection·
29 Sept 2026 · Unsloth
A vulnerability in Unsloth Studio allowed malicious AI models to execute arbitrary Python code during routine model inspection, exploiting the trust_remote_code setting. The issue has since been patched.
technology·other·misconfiguration·
28 Sept 2026 · Microsoft
An agentic AI-driven threat actor dubbed JadePuffer allegedly used exposed credentials to access an Azure tenant and delete cloud-based storage, applications, and databases in a destructive attack.
technology·other·misconfiguration·
28 Sept 2026 · code-ollama
The grep_search tool in code-ollama fails to properly escape shell metacharacters in user-supplied input, allowing an attacker-controlled Ollama server to inject and execute arbitrary OS commands. Because grep_search is classified as read-only, it executes without user approval.
technology·coding·tool misuse·
28 Sept 2026 ·
A botnet dubbed Carbonato compromises exposed Docker hosts and installs an AI agent built on the open-source Hermes Agent framework, allowing attackers to execute commands via Telegram and steal AI API keys.
technology·other·misconfiguration·
28 Sept 2026 ·
A security research report from SOCRadar found infostealer malware logs containing AI service account credentials and sessions tied to more than 80,000 corporate domains, exposing organizations to risks including stolen conversations and LLMjacking.
technology·other·data leak·
28 Sept 2026 ·
The Carbonato botnet targets exposed Docker daemons to install the open-source Hermes Agent AI framework, overwriting its persona configuration file with a 39-line prompt that directs the agent to execute attacker tasks received via Telegram.
technology·other·misconfiguration·
26 Sept 2026 · GitHub
Two third-party GitHub Actions previously compromised in a 'Mini Shai-Hulud' supply-chain campaign were re-enabled by their maintainer while still pointing to malicious code, remaining accessible on the GitHub Marketplace for more than a week.
technology·workflow·supply chain·
26 Sept 2026 · xAI
A newly identified Windows botnet, dubbed x47.c, uses the xAI Grok API to select from predefined malicious actions, enabling it to maintain persistence and drain AI API resources on infected systems.
technology·other·tool misuse·
26 Sept 2026 · OpenAI
OpenAI disclosed that its models' agents engaged with US government websites while using internet access during training and evaluation, prompting an internal review into the behavior.
technology·browsing·unknown·
25 Sept 2026 · Alastair Lundy
CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations contain an OS command injection vulnerability in PowerShell and Cmd wrappers that allows untrusted input with double quotes to execute arbitrary commands. The vulnerability has been patched in recent versions.
technology·coding·tool misuse·
25 Sept 2026 · Knowns
Multiple unrestricted path traversal vulnerabilities in Knowns MCP docs and memory tools allow arbitrary file read, write, and deletion outside the project sandbox. An authorization bypass permits deletion operations even with restricted permissions.
technology·coding·excessive permissions·
25 Sept 2026 ·
A security news roundup mentions a newly identified attack called BragJack that targets browser-based AI assistants; no further technical details were provided.
technology·browsing·unknown·
25 Sept 2026 · Rapid7
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 contain a GraphQL query injection vulnerability in the export-status component where unvalidated export_id arguments are interpolated directly into GraphQL queries. The vulnerability is limited to the operator's own authenticated API scope and is fixed in version 0.6.2.
technology·other·prompt injection·
24 Sept 2026 · AWS
Two vulnerabilities in AWS Language Servers used by Amazon Q Developer allow arbitrary code execution and arbitrary file writes when users open maliciously crafted workspaces. The vulnerabilities stem from improper trust boundary enforcement and missing symlink validation.
technology·coding·excessive permissions·
24 Sept 2026 · Bytebase
DBHub versions prior to 0.22.5 expose multiple critical vulnerabilities: an unauthenticated HTTP MCP endpoint vulnerable to DNS rebinding attacks allowing unauthorized database access, and a non-functional read-only mode that fails to prevent database writes including potential remote code execution.
technology·other·misconfiguration·
24 Sept 2026 · Manus
Security researchers identified a prompt-injection vulnerability in the agentic AI application Manus, valued at $4B, showing how attacker-supplied external data could manipulate the AI's behavior.
technology·other·prompt injection·
24 Sept 2026 ·
A roundup security bulletin mentions an AI coding tool that was found to leak private repository data, among other unrelated security stories; no further technical details are provided.
technology·coding·data leak·
24 Sept 2026 ·
A threat actor is leveraging three AI-based tool harnesses to automate vulnerability research, exploitation, and attack orchestration against hundreds of online retailers.
retail·other·tool misuse·
24 Sept 2026 · ServiceNow
ServiceNow remediated a SQL injection vulnerability in its AI Platform that could allow unauthenticated users to execute arbitrary SQL statements and access or modify database data. No malicious exploitation has been reported.
technology·other·misconfiguration·
24 Sept 2026 · Salesforce
Zenity Labs discovered three vulnerabilities, dubbed SalesBleed, in Salesforce Agentforce that allowed attackers to poison lead forms with indirect prompt injections, silently exfiltrate CRM data via DNS/image requests and Slack link unfurling, and send phishing messages under the AI agent's identity. Zenity reported the issues to Salesforce on June 1, and Salesforce worked with them to fix the flaws, which no longer work.
technology·customer service·prompt injection·
24 Sept 2026 · NVIDIA
langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests, allowing attackers to read files accessible to the application process. The vulnerability affects applications using VLM image inputs with ChatNVIDIA or NVIDIARerank APIs if untrusted users can control image URLs or document metadata.
technology·other·misconfiguration·
24 Sept 2026 · Docker
A newly identified botnet malware named Carbonato targets insecure hosts running exposed Docker daemons, installing the Hermes Agent AI framework to take control of the compromised systems.
technology·other·misconfiguration·
24 Sept 2026 · Cline
The Cline Hub dashboard accepts WebSocket connections without validating the Origin header when ROOM_SECRET is not set (the default for local binds), allowing attackers to inject malicious commands and achieve arbitrary code execution through cross-origin WebSocket hijacking.
technology·workflow·misconfiguration·
24 Sept 2026 · PurpleAILAB
Decepticon fails to sanitize ChatML special-token literals in web crawl output, allowing attackers to forge operator commands and bypass agent guardrails when using open-source LLM backends. The vulnerability affects all 16 specialist agents in the framework.
technology·coding·prompt injection·
23 Sept 2026 · MemTensor
Unknown attackers compromised two legitimate MemTensor packages on npm and PyPI to distribute a Go-based credential-stealing implant called sckit, targeting Windows, Linux, and macOS systems.
technology·other·supply chain·
23 Sept 2026 ·
A financially motivated threat actor is using open-source AI agent frameworks to automate attacks against hundreds of online retailers, installing payment-card skimmers that have stolen more than 600,000 credit card records.
retail·other·tool misuse·
23 Sept 2026 · OpenAI, Google
Threat actors are seeding the web with malicious links and manipulated data, then optimizing this content so that ChatGPT, Gemini, and Google AI Overview surface it in their answers, enabling mass disinformation and phishing campaigns.
technology·browsing·prompt injection·
22 Sept 2026 · lightrag-hku
LightRAG's API server exposes sensitive infrastructure details through raw exception messages in error responses, and the WebUI is vulnerable to stored XSS via unsanitized HTML rendering of ingested document content.
technology·other·misconfiguration·
22 Sept 2026 · MCP Atlassian
Six critical vulnerabilities discovered in the Model Context Protocol Atlassian package affecting file access, SSRF protection, credential storage, XSS, and path traversal validation. These include arbitrary file read via upload functions, missing SSRF redirect checks in OAuth/basic auth branches, world-readable OAuth token storage, reflected XSS in callback handler, and incomplete path traversal protection allowing module overwrite and RCE.
technology·other·excessive permissions·
22 Sept 2026 · sooperset
Three critical vulnerabilities discovered in mcp-atlassian package: path traversal allowing arbitrary file read via confluence_upload_attachment, SSRF protection bypass in URL validation, and unrestricted file upload allowing server-local file exfiltration to Jira/Confluence attachments.
technology·other·excessive permissions·
22 Sept 2026 · sooperset
The mcp-atlassian package fails to validate URLs extracted from HTTP headers before passing them to API clients, allowing attackers to perform Server-Side Request Forgery attacks against internal services and cloud metadata endpoints.
technology·other·misconfiguration·
22 Sept 2026 · Moonshot AI
A security flaw in Moonshot AI Kimi Code up to version 0.31.0 allows OS command injection through the MCP Configuration Loader component. The vulnerability enables remote attacks by planting untrusted executables in the $PATH when loading .mcp.json files.
technology·coding·tool misuse·
22 Sept 2026 ·
Security researchers identified ClosedQuorum, a new Windows malware family that queries Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide what actions to take during the post-compromise stage of an intrusion.
technology·other·tool misuse·
22 Sept 2026 ·
Researchers found a malicious npm package, tw-pkgprobe-7731, that masqueraded as a Twilio bug-bounty probing tool but was designed to exfiltrate sensitive credentials from developers who installed it.
technology·other·supply chain·
22 Sept 2026 · Bifrost
A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the open-source Bifrost AI gateway lets an unauthenticated attacker execute arbitrary commands on the gateway server with a single HTTP request when management authentication is not properly enabled, affecting all Bifrost HTTP transport versions before 2.1.0.
technology·other·misconfiguration·
22 Sept 2026 · Z.ai
Z.ai's ZCode code-generation tool was found silently packaging and uploading users' entire project workspaces and histories to Alibaba Cloud without consent, with only Z.ai holding the decryption key, meaning users could not access or delete their own uploaded data. Z.ai apologized, said uploaded data was never used for training, removed the offending Repo Wiki feature, and open-sourced ZCode after third-party audits.
technology·coding·data leak·
22 Sept 2026 · roomi-fields
The vault_batch MCP tool in @roomi-fields/notebooklm-mcp versions 1.6.0 through 2.0.2 accepts unsanitized vault_dir and slug_prefix parameters, allowing arbitrary file writes outside the intended vault directory. This could be exploited via prompt injection to plant files in sensitive locations.
technology·coding·prompt injection·
22 Sept 2026 · aborruso
The @aborruso/ckan-mcp-server SSRF guard fails to resolve DNS names, allowing attackers to bypass validation and reach internal addresses (127.0.0.1, 169.254.169.254, RFC-1918) through hostname arguments. This is the third bypass of the same validation function, affecting all versions through 0.4.107.
technology·other·excessive permissions·
22 Sept 2026 · Microsoft
A coalition led by Microsoft and UK police disrupted the EvilTokens phishing-as-a-service kit, which used an AI chatbot to help criminals analyze compromised inboxes, bypass Microsoft 365 MFA, and identify fraud targets; the operation had compromised roughly 12,000 email accounts across more than 10,000 organizations worldwide before Microsoft seized over 50 websites and UK police arrested two suspected administrators.
technology·other·tool misuse·
