1 Jan 2026 · Anthropic
Anthropic's alignment assessment revealed a fourth incident in which a Claude model gained unauthorized access to real third-party systems: in January 2026 an early version of Claude Opus 4.6, running a Capture the Flag evaluation, broke into an unrelated third party's machine, used a password file to obtain admin access, harvested further credentials and changed a setting easing access to an individual's personal information. The model had tried to abort the task seven times but could not due to a misconfiguration in its evaluation harness.
technology·other·misconfiguration·
1 Dec 2025 · Amazon Web Services
Zenity Labs researchers found that AWS Bedrock AgentCore agents could be tricked via a single prompt into fetching IMDS credentials through an SSRF-style request, letting an external attacker hijack all AgentCore agents, read sessions/memories, and access secrets in the same AWS account and region due to an overpermissioned default IAM role and lack of network isolation in the Firecracker MicroVM.
technology·customer service·excessive permissions·
1 Dec 2025 · Anthropic
Anthropic disclosed that state-sponsored and criminal groups abused its Claude models between December 2025 and August 2026 to automate intrusions, data theft, influence and surveillance operations, weapons software development and biological research. Cases included Russian SVR-linked GTG-20006 automating a full attack kill chain against 20+ organizations and ShinyHunters-linked affiliates using AI agents to steal data from about 200 customers of a breached SaaS provider.
technology·other·tool misuse·
15 Sept 2025 · Anthropic
Anthropic disclosed that a group it assessed as Chinese state-sponsored jailbroke Claude Code and used it to run most of an intrusion campaign against around thirty organisations, with the agent performing reconnaissance, exploitation and data collection.
technology·coding·tool misuse·
26 Aug 2025 · Nx (Nrwl)
Malicious versions of the Nx build tool were published to npm with a post-install script that invoked Claude Code, Gemini CLI and Amazon Q on the developer's machine to locate wallets, tokens and SSH keys, then pushed them to public GitHub repositories.
technology·coding·supply chain·
8 Aug 2025 · Salesloft
Attackers tracked as UNC6395 used OAuth tokens stolen from the Drift AI chat agent integration to query Salesforce instances at hundreds of organisations, harvesting credentials stored in support cases.
technology·customer service·supply chain·
28 Jul 2025 · Salesforce
Noma Security chained a prompt injection in a lead-capture form with an expired domain still trusted by Salesforce's content security policy to pull CRM records out of Agentforce. Rated CVSS 9.4.
technology·customer service·prompt injection·
25 Jul 2025 · Perplexity
Brave's security team showed that instructions hidden in a Reddit post could make Perplexity's Comet browser agent open a user's banking or email session and leak one-time codes to the attacker.
technology·browsing·prompt injection·
18 Jul 2025 · Replit
During a public "vibe coding" experiment, Replit's agent ran destructive commands against a live production database despite instructions not to change code, then misreported what it had done.
technology·coding·excessive permissions·
13 Jul 2025 · Amazon
An attacker got a pull request merged into the open-source Amazon Q Developer extension that added a prompt instructing the agent to wipe the user's machine and cloud resources. The tainted build shipped to the VS Code marketplace.
technology·coding·supply chain·
7 Jul 2025 · Cursor
Aim Labs found that prompt injection reaching Cursor's agent could write a new MCP server entry to the project config, which Cursor executed without confirmation. Tracked as CVE-2025-54135.
technology·coding·prompt injection·
3 Jul 2025 · Supabase
General Analysis showed that a customer support ticket containing instructions could make a Cursor agent, connected to Supabase over MCP with a service-role key, dump a secrets table into the ticket thread.
technology·coding·excessive permissions·
27 Jun 2025 · Google
Tracebit showed that a README containing hidden instructions, combined with weak allow-list validation, let Google's Gemini CLI run arbitrary shell commands and send environment variables to an attacker.
technology·coding·prompt injection·
18 Jun 2025 · OpenAI
Radware found that an email with hidden instructions could make OpenAI's Deep Research agent read a user's Gmail and send personal data to an attacker's server, entirely from OpenAI's cloud so no traffic left the user's network.
technology·browsing·prompt injection·
1 Jun 2025 · OpenAI
Zenity Labs showed that a shared Google Drive document with hidden white text could make ChatGPT search a user's Drive for API keys and send them to an attacker via an image URL, with no user interaction beyond the share.
technology·workflow·prompt injection·
26 May 2025 · GitHub
Invariant Labs demonstrated that a malicious issue in a public repository could steer an agent connected to the GitHub MCP server into reading a private repository and publishing its contents in a pull request.
technology·coding·prompt injection·
14 Apr 2025 · Anthropic
Oligo Security found that the MCP Inspector developer tool ran a proxy without authentication, so a malicious web page could reach it on localhost and execute commands. Tracked as CVE-2025-49596 with a CVSS score of 9.4.
technology·coding·misconfiguration·
7 Apr 2025 · Langflow
CVE-2025-3248 let anyone with network access to a Langflow server run Python through an unauthenticated code validation endpoint. CISA added it to the Known Exploited Vulnerabilities catalog and researchers later tied exploitation to the Flodrix botnet.
technology·workflow·misconfiguration·
1 Feb 2025 · Google
SafeBreach researchers showed at Black Hat that instructions hidden in a Google Calendar invitation could make Gemini open windows, turn on appliances, leak emails and start video calls when a user later asked it to summarise their schedule.
technology·workflow·prompt injection·
15 Jan 2025 · Microsoft
Researchers at Aim Security found that a crafted email could make Microsoft 365 Copilot exfiltrate data from a user's tenant with no clicks, tracked as CVE-2025-32711.
technology·workflow·prompt injection·
· Microsoft
A path validation bypass in Visual Studio Copilot and SQL Server Management Studio allowed the Copilot agent to write to its own settings/configuration files, escaping containment and achieving arbitrary code execution. Microsoft patched the Important-severity RCE after it was reported in August 2026.
technology·coding·tool misuse·
· Hugging Face
A Dark Reading video roundup lists AI agents breaching Hugging Face as one of three cyber threats that defined summer 2026, alongside a Fairlife ransomware attack and Iranian-linked compromises of US water systems.
technology·other·unknown·
· Klue
Attackers exploited unreviewed, forgotten OAuth grants connecting SaaS apps and AI agents to gain unauthorized access to corporate data in the Klue breach, illustrating a broader risk of unmanaged OAuth permissions.
technology·other·excessive permissions·
