Latest
●Automated 'Gheist' campaign plants secret-stealing GitHub workflows●AI tools used in two-hour breach of European government body●Rogue AGENTS.md file in Downloads tricks AI coding agent●OpenAI says test agents escaped sandboxes and talked to each other●Attack agent hijacks exposed AI models to run itself●Unauthenticated MLflow servers can be forced to call attacker hosts●LangGraph store flaw let one tenant reach another's data●Fallow read files outside project root via test configs
Sunday, 25 October 2026
4 agent hacks today▲ 3 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.

Incidents by month, 2026 · 625 total · click a month to filter
Jan 2026: 23 incidents23JanFeb 2026: 26 incidents26FebMar 2026: 46 incidents46MarApr 2026: 47 incidents47AprMay 2026: 53 incidents53MayJun 2026: 54 incidents54JunJul 2026: 48 incidents48JulAug 2026: 83 incidents83AugSep 2026: 147 incidents147SepOct 2026: 98 incidents98OctNov 2026: 0 incidents0NovDec 2026: 0 incidents0Dec
Incidents by sector · 650 total · click a sector to filter

Highlighted: incidents recorded on 25 October 2026, shown in place among all incidents.Clear

650 incidents

Incident dateIncidentVendorSectorAgentRoot causeSeverityStatus
25 Oct 2026OpenAI AI Agents Found Capable of VM Escapes, Secret Cross-Sandbox CommunicationOpenAItechnologyothertool misuseconfirmed
25 Oct 2026AI-Assisted Hackers Exploit PHP2Shell Flaws, Breach EU Government Entitygovernmentothertool misuseconfirmed
25 Oct 2026Malicious AGENTS.md file hijacks AI coding agents into installing rogue npm packagetechnologycodingprompt injectionconfirmed
25 Oct 2026Gheist campaign abuses stolen GitHub tokens to plant secret-stealing workflowsGitHubtechnologyworkflowsupply chainconfirmed
23 Oct 2026FastMCP OAuth credential binding vulnerability in versions 4.0.0-4.1.1FastMCPtechnologyothermisconfigurationconfirmed
23 Oct 2026Ransomware Affiliates Used AI Agent Framework 'Phantom' for Intrusionstechnologyothertool misuseconfirmed
23 Oct 2026LangGraph namespace labels bypass allows cross-tenant data accessLangChaintechnologyworkflowexcessive permissionsconfirmed
23 Oct 2026FastMCP Authorization Bypass via Direct Component CallsPrefectHQtechnologyotherexcessive permissionsconfirmed
23 Oct 2026MLflow SSRF vulnerability on unauthenticated scorer endpointsMLflowtechnologyotherprompt injectionconfirmed
23 Oct 2026AI-generated attacks compromise 105 sites, gain full domain controltechnologyothertool misuseconfirmed
23 Oct 2026Fallow Path Traversal Vulnerability in Jest/Vitest Config ParsingFallowtechnologyothertool misuseresolved
23 Oct 2026Banks report detecting rogue AI agents acting unexpectedlyfinanceotherunknownconfirmed
23 Oct 2026China-linked APT Uses AI Pentest Tool Artex in ConnectWise AttacksConnectWisetechnologyothertool misuseconfirmed
23 Oct 2026vLLM DoS via unvalidated multimodal processor argumentsvLLMtechnologyotherexcessive permissionsconfirmed
22 Oct 2026Storm-0940-linked actor uses AI agent 'ARTEX' to target IT/software vendorstechnologyothertool misuseconfirmed
22 Oct 2026OpenCode Flaw Allowed Malicious MCP Servers to Run Code at Sign-InAnomalytechnologycodingsupply chainresolved
22 Oct 2026Critical flaw in x402 SDK could drain AI agents' token balancesx402technologyworkflowmisconfigurationresolved
21 Oct 2026LiteLLM supply chain attack distributes credential-stealing malwareBerriAItechnologyothersupply chainconfirmed
21 Oct 2026Chinese AI model writes more hackable code for US defense taskstechnologycodingunknownconfirmed
21 Oct 2026Threat Actor Used AI to Plan Credential Theft and Other Cybercrimetechnologyothertool misuseconfirmed
21 Oct 2026djust: Arbitrary absolute-path file read in MCP tooldjusttechnologyotherexcessive permissionsconfirmed
21 Oct 2026Malicious LiteLLM Package Version Delivers Credential Stealer, BackdoorLiteLLMtechnologyothersupply chainconfirmed
21 Oct 2026CVE-2026-114107: Vibe-Trading Indirect Prompt Injection RCEHKUDStechnologyotherprompt injectionconfirmed
20 Oct 2026A2A Java SDK credentials leaked via HTTP redirectA2A Projecttechnologyotherexcessive permissionsconfirmed
20 Oct 2026LangAlpha indirect prompt injection allows remote code executionginlix-aitechnologycodingprompt injectionconfirmed
20 Oct 2026Phishing Campaign Hijacks Cloud Billing Accounts for LLM API Abusetechnologyotherunknownconfirmed
20 Oct 2026Hackers abuse AI pen-test tool Cairn to breach hundreds of sitesmanufacturingothertool misuseconfirmed
20 Oct 2026AI Agents Used to Autonomously Breach Over 100 Companies' Websitesotherothertool misuseconfirmed
20 Oct 2026AI Platform Cairn Abused to Hack Over 100 OrganizationsCairntechnologyothertool misuseconfirmed
19 Oct 2026AI Gateway MCP session hijacking vulnerability with default insecure seedEnvoytechnologyothermisconfigurationconfirmed
19 Oct 2026Fake Web3 Accelerator Spreads Malware via npm, Hijacks AI Agent Traffictechnologycodingsupply chainconfirmed
19 Oct 2026russh: Unbounded memory allocation in SSH agent via crafted constraintsrusshtechnologyotherexcessive permissionsconfirmed
19 Oct 2026CVE-2026-112308: crewai-tools SSRF in SeleniumScrapingToolcrewAItechnologyotherprompt injectionconfirmed
18 Oct 2026WhatsApp Help Pages Had Hidden Instructions Steering AI Chatbot Away From RegulatorsWhatsApptechnologycustomer serviceprompt injectionresolved
16 Oct 2026CVE-2026-95183: Prompt Injection in DeepSeek Harness Context CompactionDeepSeektechnologyotherprompt injectionconfirmed
16 Oct 2026Fake Claude and ChatGPT campaigns use ClickFix tactics against developerstechnologyotherunknownconfirmed
16 Oct 2026Arcane environment token bypasses admin authorizationArcanetechnologyotherexcessive permissionsconfirmed
16 Oct 2026OpenAI Model Hacked Data Portals and Took Crypto to Complete TaskOpenAItechnologycodingtool misuseconfirmed
16 Oct 2026OpenCode Console breach may have exposed AI provider API keysOpenCodetechnologycodingunknownconfirmed
15 Oct 2026Researchers show prompt injection can hijack TypeSafe AI's Jev decision modelTypeSafe AItechnologybrowsingprompt injectionconfirmed
15 Oct 2026Critical Authenticated RCE Flaw in Langflow Actively ExploitedDataStaxtechnologyworkflowunknownconfirmed
15 Oct 2026Bank of America hires 1,000 contractors to patch bugs found by Mythos AIAnthropicfinancecodingunknownconfirmed
15 Oct 2026Researchers find prompt-injection attempts hidden in website HTTP headersSignals Corpstechnologybrowsingprompt injectionconfirmed
15 Oct 2026Nezha Monitoring Whole-Instance DoS via Race ConditionNezhatechnologyothertool misuseconfirmed
15 Oct 2026Nginx UI: Multiple MCP vulnerabilities bypass security controls0xJackytechnologyotherexcessive permissionsconfirmed
15 Oct 2026IntentKit authorization bypass allows unauthorized tool executionIntentKittechnologyotherexcessive permissionsconfirmed
15 Oct 2026CERT-In Warns AI Agents Accessed Sensitive Data in Indiaotherotherexcessive permissionsconfirmed
15 Oct 2026MCP Python SDK Resource Exhaustion via Unbounded Session AccumulationAnthropictechnologyothermisconfigurationconfirmed
14 Oct 2026AI Pentesting Agent Finds Critical OTP Bypass at Major Insurerfinanceothermisconfigurationconfirmed
13 Oct 2026Roo Code command approval bypass vulnerabilities (CVE-2026-110202 through CVE-2026-110206)Roo Code Inctechnologycodingprompt injectionconfirmed