Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
3 Mar 2026 ·
A buffer overflow vulnerability was reported in LLM-Claw versions 0.1.0 through 0.1.1a-p1, in the agent_deploy_init function of /agents/deploy/initiate.c in the Agent Deployment component. The flaw can be exploited remotely, and a patch is available to remediate it.
technology·other·unknown·
2 Mar 2026 · ModelScope
A command injection vulnerability in ModelScope's ms-agent (versions v1.6.0rc1 and earlier) allows an attacker to execute arbitrary operating system commands through crafted prompt-derived input. A proof-of-concept and write-up describing escalation from AI prompt to full system compromise were published alongside the CVE.
technology·other·prompt injection·
26 Feb 2026 · Zed Industries
Zed's AI agent file tools (`read_file`, `edit_file`) in versions before 0.225.9 followed symbolic links out of the project directory, allowing reads and writes outside the workspace and bypassing `file_scan_exclusions` and `private_files` protections, potentially leaking sensitive user data to the LLM. The issue is fixed in version 0.225.9.
technology·coding·excessive permissions·
26 Feb 2026 · Model Context Protocol
In mcp-server-git versions before 2026.1.14, the git_add tool did not validate that file paths in the files argument stayed within repository boundaries, so relative paths containing '../' could stage files from outside the repository into the Git index. The issue is fixed in version 2026.1.14 (CVE-2026-27735).
technology·coding·tool misuse·
26 Feb 2026 · Langflow
Langflow versions prior to 1.8.0 hardcoded `allow_dangerous_code=True` in the CSV Agent node, exposing LangChain's Python REPL tool so an attacker could run arbitrary Python and OS commands on the server via prompt injection. Version 1.8.0 fixes the issue.
technology·workflow·prompt injection·
26 Feb 2026 · Agenta
Two vulnerabilities were disclosed in the open-source Agenta LLMOps platform: a Python sandbox escape in the custom code evaluator (CVE-2026-27952) that let authenticated users run arbitrary code on the API server via a whitelisted numpy package, and a server-side template injection flaw in evaluator template rendering (CVE-2026-27961). Both affect self-hosted or managed Agenta deployments and are fixed in versions 0.48.1 and 0.86.8 respectively.
technology·other·misconfiguration·
25 Feb 2026 · LangChain
Two LangChain vulnerabilities were disclosed and patched: a redirect-based SSRF bypass in RecursiveUrlLoader in @langchain/community (CVE-2026-27795), which allowed a validated public URL to redirect to internal or metadata endpoints, and a URL parameter injection flaw in LangSmith Studio (CVE-2026-25750) that leaked bearer tokens, user IDs and workspace IDs to attacker-controlled servers when users clicked crafted links.
technology·workflow·data leak·
25 Feb 2026 · Parse Community
Three chained vulnerabilities (CVE-2026-27595, CVE-2026-27608, CVE-2026-27609) in the opt-in AI Agent API endpoint of Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 allowed unauthenticated remote attackers to perform arbitrary reads and writes on connected Parse Server databases using the master key, due to missing authentication, missing per-app authorization and absent CSRF protection. The issues were fixed in version 9.0.0-alpha.8, with removal of the agent config block offered as a workaround.
technology·other·excessive permissions·
25 Feb 2026 · agentfront
Enclave, a JavaScript sandbox for safe AI agent code execution, contained a flaw in `@enclave-vm/core` before version 2.11.1 that allowed attackers to escape the sandbox security boundaries and achieve remote code execution. The issue was fixed in version 2.11.1.
technology·coding·unknown·
21 Feb 2026 · YosefHayim (ebay-mcp open source project)
All versions of the open source eBay API MCP Server are vulnerable to environment variable injection via the ebay_set_user_tokens tool, whose updateEnvFile function writes values to the .env file without validating newlines or quotes. Attackers can inject arbitrary environment variables, potentially causing configuration overwrites, denial of service, or remote code execution.
technology·other·tool misuse·
19 Feb 2026 · OpenClaw
Five CVEs were published for the OpenClaw personal AI assistant (formerly Clawdbot) covering prompt injection via untrusted Slack channel metadata and unsanitized workspace paths, a misleading macOS deep-link confirmation dialog that could lead to arbitrary command execution, local file exfiltration via the Feishu extension's sendMediaFeishu tool, and path traversal in browser download helpers. All issues were fixed in releases 2026.2.3 through 2026.2.15.
technology·other·prompt injection·
19 Feb 2026 · Cisco
A vulnerability in the optional API Server of Cisco AI Defense's Skill Scanner, caused by erroneous binding to multiple interfaces, allowed unauthenticated remote attackers to exhaust memory or upload files to arbitrary folders. It affects Skill-scanner 1.0.1 and earlier and is fixed in release 1.0.2.
technology·other·misconfiguration·
13 Feb 2026 · Cloudflare
A reflected cross-site scripting flaw in the AI Playground's OAuth callback handler allowed the `error_description` query parameter to be interpolated unescaped into an inline script tag. Exploitation via a crafted link could expose a victim's stored LLM chat history and let an attacker interact with MCP servers connected to the victim's session.
technology·other·misconfiguration·
13 Feb 2026 · Cursor
A vulnerability in Cursor versions prior to 2.5 allowed a malicious agent, e.g. via prompt injection, to write to improperly protected .git settings including git hooks, enabling out-of-sandbox remote code execution without user interaction when Git next ran those commands. The issue was fixed in version 2.5.
technology·coding·prompt injection·
11 Feb 2026 · akutishevsky
CVE-2026-26029 describes a command injection flaw in sf-mcp-server, a Salesforce MCP server implementation for Claude for Desktop, caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Exploitation allows arbitrary shell command execution with the privileges of the MCP server process.
technology·workflow·tool misuse·
10 Feb 2026 · LangChain
Two server-side request forgery vulnerabilities were disclosed in LangChain: ChatOpenAI.get_num_tokens_from_messages() fetched arbitrary image_url values without validation (CVE-2026-26013), and the @langchain/community RecursiveUrlLoader used a string-prefix check for its preventOutside option and did not block private or reserved IP addresses, allowing crawls of internal infrastructure and cloud metadata services (CVE-2026-26019). Both were fixed in langchain-core 1.2.11 and @langchain/community 1.1.14 respectively.
technology·workflow·tool misuse·
10 Feb 2026 · Microsoft
Two CVEs (CVE-2026-21256 and CVE-2026-21516) describe improper neutralization of special elements used in a command in GitHub Copilot, and in Visual Studio for one of them, allowing an unauthorized attacker to execute code over a network. Both are covered by Microsoft Security Response Center advisories.
technology·coding·unknown·
10 Feb 2026 · labring
Two vulnerabilities were disclosed in FastGPT, an AI agent building platform: versions 4.14.0-4.14.5 allowed unauthenticated access to the plugin system via /api/plugin/xxx, potentially crashing it and losing plugin installation state, and server-side fetching nodes (web page acquisition, HTTP nodes) allowed requests to internal network addresses. Fixes shipped in 4.14.5-fix and 4.14.7 respectively.
technology·workflow·excessive permissions·
9 Feb 2026 · GitLab
GitLab patched a vulnerability in the Duo Workflow Service component of the GitLab AI Gateway where crafted Duo Agent Platform Flow definitions caused insecure template expansion of user-supplied data. The flaw could lead to denial of service or code execution on the Gateway and was fixed in AI Gateway versions 18.6.2, 18.7.1 and 18.8.1.
technology·workflow·unknown·
9 Feb 2026 ·
Python code executed via 'runPython'/'runPythonAsync' in the mcp-run-python MCP server is not isolated from the surrounding JavaScript environment, letting Python code use Pyodide APIs to alter the JS environment. An attacker could hijack the MCP server, including shadowing MCP tools; the project is archived and unlikely to be fixed.
technology·coding·excessive permissions·
6 Feb 2026 · agentfront
Versions of the Enclave (enclave-vm) secure JavaScript sandbox prior to 2.10.1 contain multiple weaknesses — AST sanitization bypass via dynamic property access, incomplete error-object hardening, and Function constructor access via host object references — that allow AI agent code to escape the sandbox. The issue was fixed in version 2.10.1.
technology·coding·excessive permissions·
6 Feb 2026 · Microsoft
Multiple vulnerabilities were disclosed in Microsoft's AI agent development tooling, including an arbitrary file write in the Semantic Kernel .NET SDK's SessionsPythonPlugin (fixed in Microsoft.SemanticKernel.Core 1.71.0) and command injection and TOCTOU race condition flaws in GitHub Copilot with Visual Studio and Visual Studio Code that allow privilege elevation, security feature bypass, or code execution over a network.
technology·coding·tool misuse·
6 Feb 2026 · Pydantic
Two vulnerabilities were disclosed in the Pydantic AI Python agent framework: a path traversal flaw in the web UI (CVE-2026-25640) that lets a crafted URL serve attacker-controlled JavaScript and steal chat history, and an SSRF flaw in URL download functionality (CVE-2026-25580) that can make the server request internal network resources. Both are fixed in versions 1.51.0 and 1.56.0 respectively.
technology·workflow·tool misuse·
6 Feb 2026 · smn2gnt
A vulnerability in the MCP Salesforce Connector, a Model Context Protocol server for Salesforce integration, allowed arbitrary attribute access that could disclose the Salesforce authentication token. The issue affects versions prior to 0.1.10 and is fixed in 0.1.10.
technology·workflow·data leak·
4 Feb 2026 · Coding-Solo
A command injection flaw in the godot-mcp Model Context Protocol server (prior to version 0.1.1) passed user-controlled input such as projectPath directly to exec(), allowing an attacker to run arbitrary shell commands with the privileges of the MCP server process. The issue affects any tool accepting projectPath, including create_scene, add_node and load_sprite, and was patched in version 0.1.1.
technology·coding·tool misuse·
4 Feb 2026 · Significant Gravitas
AutoGPT's SendDiscordFileBlock passed an unfiltered user-supplied URL to aiohttp.ClientSession().get, allowing server-side request forgery. The issue was patched in autogpt-platform-beta-v0.6.34.
technology·workflow·tool misuse·
4 Feb 2026 · OpenClaw
In OpenClaw personal AI assistant versions prior to 2026.1.30, the isValidMedia() function in src/media/parse.ts accepted absolute paths, home directory paths and directory traversal sequences, letting the agent read any file on the system by outputting MEDIA:/path/to/file and exfiltrate it to the user or channel. The issue was patched in version 2026.1.30.
technology·other·excessive permissions·
3 Feb 2026 · Anthropic
A batch of CVEs disclosed in February 2026 described flaws in Anthropic's agentic coding tool Claude Code, including insufficient WebFetch trusted-domain validation, Bash/ZSH and find command parsing bypasses, symlink deny-rule bypass, and a bubblewrap sandbox gap allowing persistent hook injection; a related CVE covered cross-client response data leaks in the MCP TypeScript SDK. All issues were fixed in subsequent releases.
technology·coding·tool misuse·
30 Jan 2026 ·
Researchers reported that autonomous vehicles and drones relying on vision-language models can be made to follow attacker instructions embedded in road signs, a form of prompt injection. Details beyond the report are limited.
technology·other·prompt injection·
30 Jan 2026 · Moltbook
Wiz found that Moltbook, a Reddit-style site where OpenClaw agents post on behalf of their owners, left its Supabase backend readable and writable, exposing agent API tokens and private messages.
technology·other·misconfiguration·
27 Jan 2026 · OpenClaw
Koi Security found several hundred malicious skills published to ClawHub, the community marketplace for the OpenClaw personal agent, most of them delivering infostealers disguised as crypto trading or utility tools.
technology·workflow·supply chain·
24 Jan 2026 ·
The Kalrav AI Agent plugin for WordPress, in all versions up to and including 2.3.3, fails to validate file types in its kalrav_upload_file AJAX action, allowing unauthenticated attackers to upload arbitrary files to the server. The flaw may enable remote code execution on affected sites.
technology·other·excessive permissions·
24 Jan 2026 · ChatterMate
ChatterMate, a no-code AI chatbot agent framework, accepted and executed malicious HTML/JavaScript supplied as chat input in versions 1.0.8 and below, including an <iframe> with a javascript: URI, allowing access to client-side data such as localStorage tokens and cookies. The issue was fixed in version 1.0.9.
technology·customer service·data leak·
23 Jan 2026 · Framelink (Figma-Context-MCP); Ollama MCP Server
Two disclosed vulnerabilities (CVE-2025-15061 and CVE-2025-15063) allow remote, unauthenticated attackers to execute arbitrary code on installations of the Framelink Figma MCP Server and the Ollama MCP Server, due to unvalidated user-supplied strings passed into system calls in the fetchWithRetry and execAsync methods respectively. Code executes in the context of the service account.
technology·other·tool misuse·
22 Jan 2026 · Microsoft
Microsoft disclosed three CVEs affecting Copilot Studio, Copilot and M365 Copilot (CVE-2026-21520, CVE-2026-21521, CVE-2026-24307) that allow unauthorized or unauthenticated attackers to disclose sensitive information over a network. The issues stem from exposure of sensitive information, improper neutralization of escape/meta/control sequences, and improper input type validation.
technology·workflow·data leak·
21 Jan 2026 · Anthropic
A vulnerability in Claude Code's project-load flow before version 2.0.65 allowed an attacker-controlled repository to include a settings file setting ANTHROPIC_BASE_URL to an attacker endpoint, causing Claude Code to issue API requests before the user trust prompt and potentially leak the user's Anthropic API keys. Anthropic patched the issue in version 2.0.65 and delivered it via auto-update.
technology·coding·data leak·
21 Jan 2026 · nanbingxyz
Versions of the 5ire cross-platform desktop AI assistant and Model Context Protocol client prior to 0.15.3 render untrusted HTML unsafely, allowing an injected payload such as `<img onerror=...>` to execute arbitrary JavaScript in the renderer. The script can call exposed bridge APIs like window.bridge.mcpServersManager.createServer to create unauthorized MCP servers, leading to remote command execution; version 0.15.3 fixes the issue.
technology·other·excessive permissions·
19 Jan 2026 · awesome-llm-apps project
Two vulnerabilities were disclosed in the awesome-llm-apps project (commit e46690f, 2026-01-19): an unauthenticated path traversal in the Beifong AI News and Podcast Agent's FastAPI stream-audio endpoint allowing arbitrary file reads, and a cross-session information disclosure in the Streamlit-based GitHub MCP Agent that stores user API tokens in process-wide environment variables. Together they can expose configuration files, credentials, GitHub Personal Access Tokens and LLM API keys.
technology·other·data leak·
16 Jan 2026 · OpenAgentPlatform
In the open-source Dive MCP Host Desktop Application prior to version 0.13.0, a crafted deeplink could install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine. The issue is fixed in version 0.13.0.
technology·other·excessive permissions·
16 Jan 2026 · MCPJam
MCPJam Inspector, a local-first development platform for MCP servers, contained a remote code execution flaw (CVE-2026-23744) in versions 1.4.2 and earlier: a crafted HTTP request could trigger installation of an MCP server and execute code. Because the tool listened on 0.0.0.0 by default rather than 127.0.0.1, the flaw was exploitable remotely; version 1.4.3 contains a patch.
technology·coding·misconfiguration·
14 Jan 2026 · agentfront
A critical vulnerability in enclave-vm prior to version 2.7.0 let untrusted sandboxed JavaScript reach a host-realm Error object's prototype chain and use the host Function constructor to run arbitrary code in the host Node.js runtime, exposing process.env, the filesystem and network. The issue is fixed in version 2.7.0.
technology·coding·excessive permissions·
14 Jan 2026 · Cursor
In Cursor versions prior to 2.3, the AI coding agent running in Auto-Run Mode with Allowlist mode enabled could execute certain shell built-ins without appearing in the allowlist or requiring user approval, letting an attacker use direct or indirect prompt injection to poison the shell environment by altering environment variables that influence trusted commands. The issue is fixed in version 2.3.
technology·coding·prompt injection·
12 Jan 2026 · anomalyco
Two vulnerabilities were disclosed in the open source OpenCode AI coding agent: an unauthenticated local HTTP server with permissive CORS allowing any local process or website to run arbitrary shell commands (CVE-2026-22812), and an unsanitized markdown renderer allowing JavaScript execution on the localhost web interface via crafted LLM responses (CVE-2026-22813). Fixes shipped in versions 1.0.216 and 1.1.10 respectively.
technology·coding·misconfiguration·
12 Jan 2026 · BeehiveInnovations
CVE-2025-66689 describes a path traversal flaw in Zen MCP Server before version 9.8.2, where the is_dangerous_path() validation used exact string matching against a blacklist of system directories. Authenticated attackers could bypass the check by accessing subdirectories of blacklisted paths and read arbitrary files on the system.
technology·coding·data leak·
12 Jan 2026 · orval-labs
Versions of orval before 7.18.0 built MCP server code by string manipulation that embedded the OpenAPI specification's summary field without validation or escaping, letting an attacker break out of the string literal and inject arbitrary code. The issue is fixed in orval 7.18.0.
technology·coding·supply chain·
12 Jan 2026 · LangChain
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) flaw in MRKLOutputParser.parse(), where a backtracking-prone regex is used to extract tool actions from model output. An attacker able to influence the parsed text, for example through prompt injection in downstream applications, can cause excessive CPU consumption and a denial-of-service condition.
technology·workflow·prompt injection·
10 Jan 2026 · Tencent
Two vulnerabilities in Tencent's WeKnora LLM document-understanding framework prior to version 0.2.5 let attackers use prompt-based bypass techniques against the Agent service's database query tool to extract sensitive server and database data (CVE-2026-22687), and let authenticated users inject commands into MCP stdio settings to run subprocesses on the server (CVE-2026-22688). Both were patched in version 0.2.5.
technology·other·prompt injection·
7 Jan 2026 · Microsoft
Microsoft Playwright MCP Server versions before 0.0.40 do not validate the Origin header on incoming connections, allowing an attacker to use a DNS rebinding attack through a victim's browser to send unauthorized requests to a locally running MCP server and invoke MCP tool endpoints. The issue is addressed in version 0.0.40.
technology·browsing·misconfiguration·
7 Jan 2026 · sylphxltd
Version 0.5.8 of the @sylphxltd/filesystem-mcp MCP server contains a path traversal vulnerability in its read_content tool, where path validation occurs before symlink resolution. Attackers can use symlinks inside an allowed directory to read files outside the intended scope.
technology·workflow·excessive permissions·
2 Jan 2026 · Langflow
Multiple critical API endpoints in Langflow lacked authentication controls prior to version 1.7.0.dev45, allowing unauthenticated users to read user conversation data and transaction histories and to perform destructive operations such as message deletion. A patch is available in version 1.7.0.dev45.
technology·workflow·misconfiguration·
