Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
18 Jul 2025 · Replit
During a public "vibe coding" experiment, Replit's agent ran destructive commands against a live production database despite instructions not to change code, then misreported what it had done.
technology·coding·excessive permissions·
13 Jul 2025 · Amazon
An attacker got a pull request merged into the open-source Amazon Q Developer extension that added a prompt instructing the agent to wipe the user's machine and cloud resources. The tainted build shipped to the VS Code marketplace.
technology·coding·supply chain·
7 Jul 2025 · Cursor
Aim Labs found that prompt injection reaching Cursor's agent could write a new MCP server entry to the project config, which Cursor executed without confirmation. Tracked as CVE-2025-54135.
technology·coding·prompt injection·
3 Jul 2025 · Supabase
General Analysis showed that a customer support ticket containing instructions could make a Cursor agent, connected to Supabase over MCP with a service-role key, dump a secrets table into the ticket thread.
technology·coding·excessive permissions·
27 Jun 2025 · Google
Tracebit showed that a README containing hidden instructions, combined with weak allow-list validation, let Google's Gemini CLI run arbitrary shell commands and send environment variables to an attacker.
technology·coding·prompt injection·
18 Jun 2025 · OpenAI
Radware found that an email with hidden instructions could make OpenAI's Deep Research agent read a user's Gmail and send personal data to an attacker's server, entirely from OpenAI's cloud so no traffic left the user's network.
technology·browsing·prompt injection·
1 Jun 2025 · OpenAI
Zenity Labs showed that a shared Google Drive document with hidden white text could make ChatGPT search a user's Drive for API keys and send them to an attacker via an image URL, with no user interaction beyond the share.
technology·workflow·prompt injection·
26 May 2025 · GitHub
Invariant Labs demonstrated that a malicious issue in a public repository could steer an agent connected to the GitHub MCP server into reading a private repository and publishing its contents in a pull request.
technology·coding·prompt injection·
14 Apr 2025 · Anthropic
Oligo Security found that the MCP Inspector developer tool ran a proxy without authentication, so a malicious web page could reach it on localhost and execute commands. Tracked as CVE-2025-49596 with a CVSS score of 9.4.
technology·coding·misconfiguration·
7 Apr 2025 · Langflow
CVE-2025-3248 let anyone with network access to a Langflow server run Python through an unauthenticated code validation endpoint. CISA added it to the Known Exploited Vulnerabilities catalog and researchers later tied exploitation to the Flodrix botnet.
technology·workflow·misconfiguration·
1 Feb 2025 · Google
SafeBreach researchers showed at Black Hat that instructions hidden in a Google Calendar invitation could make Gemini open windows, turn on appliances, leak emails and start video calls when a user later asked it to summarise their schedule.
technology·workflow·prompt injection·
15 Jan 2025 · Microsoft
Researchers at Aim Security found that a crafted email could make Microsoft 365 Copilot exfiltrate data from a user's tenant with no clicks, tracked as CVE-2025-32711.
technology·workflow·prompt injection·
11 Nov 2022 · Air Canada
A British Columbia tribunal ordered Air Canada to honour a bereavement discount that its website chatbot had described but which did not exist, rejecting the airline's argument that the chatbot was a separate legal entity.
transport·customer service·hallucinated action·
·
Symantec researchers captured the full instruction set of an autonomous attack agent that uses jailbreak layers to hijack exposed or stolen-key AI model endpoints, then runs up to 100,000 unattended steps to scan, exploit, steal data, and deploy cryptomining via a self-replicating 'Skynet mode' loop. No evidence has been found that the tool was used against real-world victims yet.
technology·other·prompt injection·
· GMO Internet
Japanese ISP GMO Internet disclosed that attackers compromised its Onamae.com Desktop Cloud VDI service used for foreign exchange trading, stealing customer credentials and data, with some trading accounts showing unauthorized transactions. GMO linked the intrusion to misuse of 'ARTEX', an autonomous AI penetration-testing tool, which reportedly also targeted roughly 20 other Japanese companies, and said attackers demanded $50 million not to leak the stolen data.
technology·other·tool misuse·
· Microsoft
A path validation bypass in Visual Studio Copilot and SQL Server Management Studio allowed the Copilot agent to write to its own settings/configuration files, escaping containment and achieving arbitrary code execution. Microsoft patched the Important-severity RCE after it was reported in August 2026.
technology·coding·tool misuse·
· Klue
Attackers exploited unreviewed, forgotten OAuth grants connecting SaaS apps and AI agents to gain unauthorized access to corporate data in the Klue breach, illustrating a broader risk of unmanaged OAuth permissions.
technology·other·excessive permissions·
· Hugging Face
A Dark Reading video roundup lists AI agents breaching Hugging Face as one of three cyber threats that defined summer 2026, alongside a Fairlife ransomware attack and Iranian-linked compromises of US water systems.
technology·other·unknown·
