Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.

Incidents by month, 2026 · 582 total · click a month to filter
Jan 2026: 23 incidents23JanFeb 2026: 26 incidents26FebMar 2026: 46 incidents46MarApr 2026: 47 incidents47AprMay 2026: 53 incidents53MayJun 2026: 54 incidents54JunJul 2026: 47 incidents47JulAug 2026: 83 incidents83AugSep 2026: 146 incidents146SepOct 2026: 57 incidents57OctNov 2026: 0 incidents0NovDec 2026: 0 incidents0Dec
Incidents by sector · 606 total · click a sector to filter

Highlighted: incidents recorded on 16 October 2026, shown in place among all incidents.Clear

606 incidents

Incident dateIncidentVendorSectorAgentRoot causeSeverityStatus
15 Oct 2026Researchers find prompt-injection attempts hidden in website HTTP headersSignals Corpstechnologybrowsingprompt injectionconfirmed
15 Oct 2026Nezha Monitoring Whole-Instance DoS via Race ConditionNezhatechnologyothertool misuseconfirmed
15 Oct 2026Critical Authenticated RCE Flaw in Langflow Actively ExploitedDataStaxtechnologyworkflowunknownconfirmed
15 Oct 2026IntentKit authorization bypass allows unauthorized tool executionIntentKittechnologyotherexcessive permissionsconfirmed
15 Oct 2026Bank of America hires 1,000 contractors to patch bugs found by Mythos AIAnthropicfinancecodingunknownconfirmed
15 Oct 2026Nginx UI: Multiple MCP vulnerabilities bypass security controls0xJackytechnologyotherexcessive permissionsconfirmed
15 Oct 2026MCP Python SDK Resource Exhaustion via Unbounded Session AccumulationAnthropictechnologyothermisconfigurationconfirmed
15 Oct 2026Researchers show prompt injection can hijack TypeSafe AI's Jev decision modelTypeSafe AItechnologybrowsingprompt injectionconfirmed
14 Oct 2026AI Pentesting Agent Finds Critical OTP Bypass at Major Insurerfinanceothermisconfigurationconfirmed
13 Oct 2026Roo Code command approval bypass vulnerabilities (CVE-2026-110202 through CVE-2026-110206)Roo Code Inctechnologycodingprompt injectionconfirmed
12 Oct 2026mac-shell-mcp OS command injection via shell metacharacterscfdudetechnologyotherprompt injectionconfirmed
12 Oct 2026Nginx UI MCP Tool Bypasses Configuration Validation0xJackytechnologyotherprompt injectionconfirmed
12 Oct 2026CyberXero Uses Claude Code to Steal 628,000+ Ukrainian RecordsAnthropicothercodingtool misuseconfirmed
11 Oct 2026Abilityai Trinity missing authorization in Telegram routerAbilityaitechnologyotherprompt injectionconfirmed
10 Oct 2026mini-swe-agent environment variable exposure via prompt injectionSWE-agenttechnologycodingprompt injectionconfirmed
10 Oct 2026Symlink vulnerabilities in phi and open-multi-agent frameworksPulse AI Club / Open Multi Agenttechnologycodingprompt injectionconfirmed
10 Oct 2026CVE-2026-108583: zotero-mcp SSRF vulnerability via prompt injectionzotero-mcptechnologybrowsingprompt injectionconfirmed
10 Oct 2026Anthropic AI Agents Submitted Incomplete Visa Forms on State Dept SiteAnthropicgovernmentbrowsinghallucinated actionconfirmed
9 Oct 2026AI Used in Korean Bank Breachesfinanceotherunknownconfirmed
8 Oct 2026'AgentCorruption' Flaw in AWS Bedrock AgentCore Could Enable Fleet TakeoverAWStechnologyworkflowprompt injectionresolved
8 Oct 2026Banks: Prompt Injection via User-Controlled Chat MessagesBankstechnologyotherprompt injectionconfirmed
8 Oct 2026GhostAction Campaign Compromises 1,900 GitHub Accounts, Hits 30,000 ReposGitHubtechnologyothersupply chainconfirmed
8 Oct 2026Tensorlake npm Package Compromised with Shai-Hulud Credential-Stealing WormTensorlaketechnologycodingsupply chainconfirmed
8 Oct 2026PraisonAI: Multiple Critical Security VulnerabilitiesPraisonAItechnologyworkflowexcessive permissionsconfirmed
8 Oct 2026AI Pentesting Tool ARTEX Used in Attacks on South Korean Financial Firmsfinanceothertool misuseconfirmed
8 Oct 2026Mechanize library leaks credentials on HTTP redirectsmechanizetechnologyothermisconfigurationconfirmed
7 Oct 2026Agentic AI Attack Hits Australia's Medicare Systemshealthcareotherunknownconfirmed
7 Oct 2026Flowise Critical Vulnerabilities: RCE via Sandbox Escape and Prompt InjectionFlowisetechnologyworkflowprompt injectionconfirmed
7 Oct 2026Next.js development server exposes MCP endpoint to CSRF attacksVerceltechnologyothermisconfigurationconfirmed
7 Oct 2026Unpatched Critical RCE Flaw Found in LMCache LLM Caching ServerLMCachetechnologyotherexcessive permissionsconfirmed
7 Oct 2026OpenAI 'rogue' agents found editing and probing Wikimedia sitesOpenAImediabrowsingtool misuseconfirmed
7 Oct 2026Actual Sync Server CORS Proxy GitHub API Allowlist BypassActual Budgettechnologyothermisconfigurationconfirmed
7 Oct 2026PraisonAI AgentMail webhook signature verification bypassPraisonAItechnologyothermisconfigurationconfirmed
6 Oct 2026Researcher finds KVM zero-day VM escape via Vercel bug bountyVerceltechnologyotherunknownconfirmed
6 Oct 2026Payload CMS MCP Plugin Improper Access Control VulnerabilityPayloadtechnologyotherexcessive permissionsconfirmed
6 Oct 2026vLLM cache_salt dropped in Harmony tool continuationsvLLMtechnologyworkflowmisconfigurationconfirmed
6 Oct 2026Knowns LSP OS Command Injection via Malicious config.jsonKnownstechnologycodingmisconfigurationconfirmed
6 Oct 2026LangChain RediSearch Filter Injection VulnerabilityLangChaintechnologyotherprompt injectionconfirmed
6 Oct 2026AI agents reportedly used to hack South Korean banksfinanceothertool misuseconfirmed
5 Oct 2026PyJWT accepts inconsistent OKP JWKs, allowing key identity confusionPyJWTtechnologyothermisconfigurationconfirmed
5 Oct 2026Langflow: Weak Fernet Key via random.seed()Langflowtechnologyothermisconfigurationconfirmed
5 Oct 2026South Korea probes bank breaches amid suspected AI-powered attacksfinanceotherunknownconfirmed
5 Oct 2026OpenClaw channel read actions bypass allowlistsOpenClawtechnologyothermisconfigurationconfirmed
5 Oct 2026Langflow: Multiple Code Execution VulnerabilitiesLangflowtechnologyworkflowprompt injectionconfirmed
5 Oct 2026simple-git command execution via Git config include pathsimple-gittechnologycodingexcessive permissionsconfirmed
3 Oct 2026AI-discovered Rejetto HFS auth-bypass flaw exploited in the wildRejettootherotherunknownconfirmed
2 Oct 2026Vibe-Trading LLM agent multiple critical vulnerabilitiesVibe-Tradingothercodingexcessive permissionsconfirmed
2 Oct 2026Trigger.dev: Server-side request forgery via webhook alert channelsTrigger.devotherworkflowexcessive permissionsconfirmed
2 Oct 2026A2UI web_core: openUrl permits javascript: URI executionA2UIotherworkflowprompt injectionconfirmed
2 Oct 2026rmcp OAuth client SSRF via server-controlled resource_metadata URLModel Context Protocol (rmcp)otherothermisconfigurationconfirmed