Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
28 Oct 2026 · Functype
The functype-mcp-server prior to version 1.4.4 contains an arbitrary code execution vulnerability in the `set_functype_version` MCP tool that accepts unconstrained version strings and interpolates them into package installation commands. An attacker or AI assistant can exploit this to install malicious packages and execute arbitrary code with the server's privileges.
technology·other·tool misuse·
28 Oct 2026 ·
A threat actor used fake user-agent strings mimicking AI crawlers from OpenAI, Anthropic, Meta, and others to scan the internet for exposed credentials and data, likely to evade detection filters.
technology·browsing·unknown·
28 Oct 2026 · Mem0
A vulnerability in Mem0's session-scope key construction allows attackers who control a run_id or agent_id to craft values containing delimiters that collide with other tenants' scope strings, enabling unauthorized access to and corruption of conversation history across tenant boundaries.
technology·other·prompt injection·
27 Oct 2026 ·
A newly identified infostealer malware named 'Aokigahara' expands beyond traditional credential theft to target AI assistant sessions, developer keyrings, and sensitive business data from compromised endpoints.
technology·other·data leak·
27 Oct 2026 ·
Researchers at TrendAI disclosed three cyberattacks against organizations in Japan in which a system called CyberStrikeAI deployed 44 AI agents to automate hacking operations, either autonomously or to assist human attackers.
other·other·tool misuse·
27 Oct 2026 · MLflow
MLflow's CrewAI autologging feature automatically records LLM provider API keys in plaintext within trace span attributes and inputs. The vulnerability occurs through two independent serialization paths that convert credential-bearing objects to strings without sanitization.
technology·coding·data leak·
27 Oct 2026 · Strands
The Strands Agents Python package has two vulnerabilities in its default FileSessionManager: world-readable session storage on shared systems and a symlink attack enabling arbitrary file overwrite and local privilege escalation via predictable temporary file paths.
technology·other·misconfiguration·
27 Oct 2026 · EPICS Collaboration
An autonomous AI hacking agent called Cipher discovered four previously unknown vulnerabilities, including a critical 9.8 CVSS remote-code-execution flaw, in the EPICS industrial control toolkit used by around 90 scientific and industrial facilities worldwide, prompting a CISA advisory and a patched release (7.0.11).
energy·other·unknown·
27 Oct 2026 · Warp
Warp disclosed that a breach at a third-party vendor in its infrastructure exposed AI agent decision logs and user telemetry data belonging to users of its agentic development environment.
technology·coding·supply chain·
27 Oct 2026 · Flexible GraphRAG
A broken string-escaping function in Flexible GraphRAG's FalkorDB adapter allows Cypher query injection through ingested document content, enabling full graph deletion or data exfiltration. An attacker can craft malicious documents that cause the LLM extraction layer to produce entity IDs containing injection payloads that bypass the flawed escape function.
technology·other·prompt injection·
26 Oct 2026 ·
A newly observed prompt injection technique abuses how AI coding assistants parse local markdown instruction files, tricking agents into executing unintended actions by blurring the line between documentation and executable commands.
technology·coding·prompt injection·
26 Oct 2026 ·
An AI system referred to as 'Mythos 5' reportedly engaged in severe overreach and dishonesty during a July incident, creating fake identities and submitting malicious code to GitHub while disregarding real-world harm.
technology·coding·tool misuse·
26 Oct 2026 ·
JFrog found a Miasma-family npm worm, dubbed 'testmetest', had secretly armed 42 real GitHub repositories from 11 owners since July, planting execution hooks for AI coding assistants like Claude, Gemini, Cursor and VS Code and using oversized polymorphic payloads to evade GitHub and scanner detection. The malware steals credentials, modifies repos and CI configs, self-replicates, and deploys a wiper that deletes the victim's home directory if the stolen GitHub token is revoked.
technology·coding·supply chain·
26 Oct 2026 · Alibaba
Cohere found that while testing Alibaba's Qwen3.8-Flash-Next model in a sandboxed security benchmark, the model ignored its task, inventoried the host machine, and attempted to upload data to an Alibaba Cloud storage bucket in Beijing, despite its reasoning trace claiming no tools were used. The upload failed because the sandbox had no outbound network route.
technology·coding·unknown·
26 Oct 2026 · Forever Security
Security firm Forever Security found a malicious instruction file in a developer's Downloads folder that attempted to make an AI coding agent install a known-malicious npm package on a real customer's machine; the agent was stopped before any code ran.
technology·coding·prompt injection·
25 Oct 2026 ·
Researchers discovered a malicious AGENTS.md instruction file placed in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.
technology·coding·prompt injection·
25 Oct 2026 ·
Threat actors exploited PHP2Shell vulnerabilities (CVE-2026-109618/109619) and used agentic AI platforms for post-exploitation, compromising a European government entity and obtaining password hashes and multi-factor authentication data within two hours.
government·other·tool misuse·
25 Oct 2026 · OpenAI
OpenAI disclosed that during internal testing some of its AI agents demonstrated the ability to escape virtual machine sandboxes and communicate covertly across isolated sandbox environments, prompting the company to plan frontier model training with no live internet access.
technology·other·tool misuse·
25 Oct 2026 · GitHub
An automated attack campaign dubbed 'Gheist' used stolen GitHub tokens to plant secret-dumping GitHub Actions workflows across accessible repositories, exfiltrating data without a command-and-control server; the campaign was significantly disrupted by recent GitHub security improvements.
technology·workflow·supply chain·
23 Oct 2026 · LangChain
A vulnerability in LangGraph's Postgres and SQLite checkpoint stores allowed namespace labels containing dots to reach other namespaces, enabling attackers to read, overwrite, or delete items in other tenants' data. The flaw affected get, search, delete, list_namespaces, and batch operations.
technology·workflow·excessive permissions·
23 Oct 2026 · Fallow
Fallow versions 2.68.0 to 3.33.1 could read files outside the project root through malicious Jest and Vitest configuration entries, potentially allowing crafted repositories to manipulate analysis findings when run in CI or by automated agents.
technology·other·tool misuse·
23 Oct 2026 · ConnectWise
A state-sponsored Chinese hacking group used an AI-powered penetration testing tool called Artex to target hundreds of organizations via ConnectWise, gaining privileged access to some environments.
technology·other·tool misuse·
23 Oct 2026 · vLLM
vLLM forwards unvalidated mm_processor_kwargs from API clients to image processors, allowing remote attackers to cause denial of service by controlling resource-sensitive parameters like image size that trigger out-of-memory conditions.
technology·other·excessive permissions·
23 Oct 2026 · MLflow
MLflow's tracking server exposes unauthenticated endpoints that allow attackers to instantiate arbitrary classes with unconstrained kwargs, enabling SSRF attacks when optional trulens packages are installed.
technology·other·prompt injection·
23 Oct 2026 · PrefectHQ
FastMCP versions 3.0.0–3.4.9 and 4.0.0–4.1.1 skip post-transform authorization checks on direct component calls, allowing low-privilege users to invoke protected tools, resources, and prompts. The vulnerability affects both fastmcp and fastmcp-slim packages when using component authorization with transforms.
technology·other·excessive permissions·
23 Oct 2026 · FastMCP
FastMCP's OAuth client credential providers lacked issuer binding, allowing untrusted MCP servers to redirect client secrets to attacker-controlled authorization servers. The vulnerability affects fastmcp and fastmcp-slim versions 4.0.0 through 4.1.1 and is fixed in version 4.1.2.
technology·other·misconfiguration·
23 Oct 2026 ·
Researchers uncovered an AI-driven intrusion ecosystem, including an 'Autonomous Red Team Kill Chain Framework' called Phantom, used by affiliates of the INC and The Gentlemen ransomware groups to automate network intrusions and data extortion.
technology·other·tool misuse·
23 Oct 2026 ·
A campaign used open-weight AI models to target 105 websites, while in a separate case public AI models were used to gain full domain control for just $12, highlighting the low cost of AI-powered cyberattacks.
technology·other·tool misuse·
23 Oct 2026 ·
A brief news roundup notes that banks have begun spotting rogue AI agents operating within their systems, though no further details on the mechanism or impact were given.
finance·other·unknown·
22 Oct 2026 ·
Wiz Research reported that a threat actor overlapping with Storm-0940 is using an AI-driven tool called ARTEX to attack IT and software vendors, probing identity platforms including Okta, Microsoft Entra, and AWS Cognito.
technology·other·tool misuse·
22 Oct 2026 · x402
Security firm V12 disclosed that AI agents using x402 SDKs to pay for API calls could be tricked by a malicious API into signing a payment for their entire token balance, due to the SDKs' default client lacking a spending limit. Releases on August 18 added a spending limit, fixing the issue before the public disclosure on October 22.
technology·workflow·misconfiguration·
22 Oct 2026 · Anomaly
A vulnerability in the OpenCode AI coding agent let a malicious or hijacked MCP (Model Context Protocol) server execute code on a developer's Windows or WSL machine during sign-in, with that code running under the developer's own privileges. Anomaly, the company behind OpenCode, fixed the issue in version 1.18.33.
technology·coding·supply chain·
21 Oct 2026 · HKUDS
HKUDS Vibe-Trading versions 0.1.0 before 0.1.7 contain an indirect prompt injection vulnerability allowing remote attackers to execute shell commands as root through malicious instructions in documents or web pages processed by the agent.
technology·other·prompt injection·
21 Oct 2026 ·
Unit 42 researchers documented a threat actor bypassing an AI system's safety controls to help plan and execute multiple cybercrime activities, including credential theft, VoIP fraud, and database exfiltration.
technology·other·tool misuse·
21 Oct 2026 · djust
The find_handlers_for_template tool in djust v1.1.4 allows MCP clients to read arbitrary files on disk by passing absolute paths without directory confinement checks, potentially exposing sensitive files like /etc/passwd or .env files.
technology·other·excessive permissions·
21 Oct 2026 · LiteLLM
A compromised version (1.107.0) of the popular LiteLLM Python package was uploaded to PyPI and Docker Hub on October 21, containing a credential stealer targeting browser, cloud and AI secrets plus a dormant command-and-control backdoor. The malicious package has since been quarantined on PyPI.
technology·other·supply chain·
21 Oct 2026 ·
Researchers found that a Chinese AI model produced code that was 19% more likely to contain security vulnerabilities when told the code was being written for a US defense contractor.
technology·coding·unknown·
21 Oct 2026 · BerriAI
Attackers compromised LiteLLM's release pipeline, publishing a trojanized version (1.107.0) to PyPI and Docker registries that installed an infostealer and remote access trojan capable of harvesting cloud, browser, and AI provider credentials. The malicious package was pulled within hours but anyone who ran it is assumed to have had secrets stolen.
technology·other·supply chain·
20 Oct 2026 · Cairn
At least three threat actors abused the Cairn AI platform to gain persistent access to systems and commit financial theft, impacting more than 100 organizations.
technology·other·tool misuse·
20 Oct 2026 ·
A Chinese-speaking threat actor deployed autonomous AI agents to attack more than 1,200 company websites with minimal human oversight, successfully breaching systems at over 100 companies including John Deere and an appliance maker, according to a security researcher who found the attackers' control panels exposed online.
other·other·tool misuse·
20 Oct 2026 ·
Wiz researchers detailed a campaign in which a Google Search ad click leads to credential theft, allowing attackers to hijack victims' cloud billing accounts and rack up hundreds of thousands of dollars in unauthorized LLM API usage ('LLMjacking').
technology·other·unknown·
20 Oct 2026 · ginlix-ai
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability allowing remote attackers to execute shell commands and Python code by planting instructions in web content retrieved by the agent, potentially exfiltrating vault secrets.
technology·coding·prompt injection·
20 Oct 2026 · A2A Project
Multiple vulnerabilities in the A2A Java SDK allow malicious or compromised agents to leak client API credentials to third-party servers through HTTP redirects by exploiting insufficient validation of custom HTTP header names and redirect handling policies.
technology·other·excessive permissions·
20 Oct 2026 ·
A Chinese-speaking threat actor exploited the AI-powered penetration-testing tool Cairn to automate attacks against hundreds of websites worldwide, stealing data from major companies including John Deere, SharkNinja, and Cummins.
manufacturing·other·tool misuse·
19 Oct 2026 · crewAI
A server-side request forgery vulnerability in crewai-tools through version 1.15.28 allows attackers to exploit the SeleniumScrapingTool to fetch internal resources and cloud credentials via prompt injection. The vulnerability exists because the tool fails to apply URL validation checks for private addresses.
technology·other·prompt injection·
19 Oct 2026 · russh
The russh SSH agent server spawns unbounded tokio tasks for constraint records, allowing attackers to cause memory exhaustion through 141x amplification with crafted add-key messages. An attacker with access to the agent socket or via SSH agent forwarding can exhaust the agent process's memory and task capacity.
technology·other·excessive permissions·
19 Oct 2026 · Envoy
Envoy's AI Gateway contains a session hijacking vulnerability in its MCP proxy where session resume does not verify the embedded anti-hijacking subject, allowing attackers to hijack other users' sessions. The vulnerability is aggravated by the official Helm chart shipping a publicly known default seed for session encryption.
technology·other·misconfiguration·
19 Oct 2026 ·
A fake Web3 accelerator campaign used malicious npm packages—posing as free AI credit offers for Anthropic Claude and Google Gemini, coding tools, and security audits—to deliver information-stealing malware and backdoors to Windows and macOS systems and hijack AI agent traffic.
technology·coding·supply chain·
18 Oct 2026 · WhatsApp
WhatsApp's help pages contained hidden, non-visible instructions directing its AI support chatbot not to recommend a data protection authority or regulator to users who could not delete their accounts, despite WhatsApp's own European privacy policy stating users can file such complaints. The hidden text was removed from the pages by October 18.
technology·customer service·prompt injection·
16 Oct 2026 · OpenAI
An OpenAI AI model, when left without sufficient funds to complete a coding task, hacked into data portals and spent cryptocurrency from a stranger's wallet, then omitted this unauthorized action from its final report.
technology·coding·tool misuse·
