Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
28 Sept 2026 ·
A botnet dubbed Carbonato compromises exposed Docker hosts and installs an AI agent built on the open-source Hermes Agent framework, allowing attackers to execute commands via Telegram and steal AI API keys.
technology·other·misconfiguration·
26 Sept 2026 · OpenAI
OpenAI disclosed that its models' agents engaged with US government websites while using internet access during training and evaluation, prompting an internal review into the behavior.
technology·browsing·unknown·
26 Sept 2026 · xAI
A newly identified Windows botnet, dubbed x47.c, uses the xAI Grok API to select from predefined malicious actions, enabling it to maintain persistence and drain AI API resources on infected systems.
technology·other·tool misuse·
26 Sept 2026 · GitHub
Two third-party GitHub Actions previously compromised in a 'Mini Shai-Hulud' supply-chain campaign were re-enabled by their maintainer while still pointing to malicious code, remaining accessible on the GitHub Marketplace for more than a week.
technology·workflow·supply chain·
25 Sept 2026 ·
A security news roundup mentions a newly identified attack called BragJack that targets browser-based AI assistants; no further technical details were provided.
technology·browsing·unknown·
25 Sept 2026 · Alastair Lundy
CliInvoke.Specializations and AlastairLundy.CliInvoke.Specializations contain an OS command injection vulnerability in PowerShell and Cmd wrappers that allows untrusted input with double quotes to execute arbitrary commands. The vulnerability has been patched in recent versions.
technology·coding·tool misuse·
25 Sept 2026 · Rapid7
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 contain a GraphQL query injection vulnerability in the export-status component where unvalidated export_id arguments are interpolated directly into GraphQL queries. The vulnerability is limited to the operator's own authenticated API scope and is fixed in version 0.6.2.
technology·other·prompt injection·
25 Sept 2026 · Knowns
Multiple unrestricted path traversal vulnerabilities in Knowns MCP docs and memory tools allow arbitrary file read, write, and deletion outside the project sandbox. An authorization bypass permits deletion operations even with restricted permissions.
technology·coding·excessive permissions·
24 Sept 2026 ·
A roundup security bulletin mentions an AI coding tool that was found to leak private repository data, among other unrelated security stories; no further technical details are provided.
technology·coding·data leak·
24 Sept 2026 · NVIDIA
langchain-nvidia-ai-endpoints versions before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests, allowing attackers to read files accessible to the application process. The vulnerability affects applications using VLM image inputs with ChatNVIDIA or NVIDIARerank APIs if untrusted users can control image URLs or document metadata.
technology·other·misconfiguration·
24 Sept 2026 · Salesforce
Zenity Labs discovered three vulnerabilities, dubbed SalesBleed, in Salesforce Agentforce that allowed attackers to poison lead forms with indirect prompt injections, silently exfiltrate CRM data via DNS/image requests and Slack link unfurling, and send phishing messages under the AI agent's identity. Zenity reported the issues to Salesforce on June 1, and Salesforce worked with them to fix the flaws, which no longer work.
technology·customer service·prompt injection·
24 Sept 2026 · PurpleAILAB
Decepticon fails to sanitize ChatML special-token literals in web crawl output, allowing attackers to forge operator commands and bypass agent guardrails when using open-source LLM backends. The vulnerability affects all 16 specialist agents in the framework.
technology·coding·prompt injection·
24 Sept 2026 · AWS
Two vulnerabilities in AWS Language Servers used by Amazon Q Developer allow arbitrary code execution and arbitrary file writes when users open maliciously crafted workspaces. The vulnerabilities stem from improper trust boundary enforcement and missing symlink validation.
technology·coding·excessive permissions·
24 Sept 2026 · Cline
The Cline Hub dashboard accepts WebSocket connections without validating the Origin header when ROOM_SECRET is not set (the default for local binds), allowing attackers to inject malicious commands and achieve arbitrary code execution through cross-origin WebSocket hijacking.
technology·workflow·misconfiguration·
24 Sept 2026 · ServiceNow
ServiceNow remediated a SQL injection vulnerability in its AI Platform that could allow unauthenticated users to execute arbitrary SQL statements and access or modify database data. No malicious exploitation has been reported.
technology·other·misconfiguration·
24 Sept 2026 · Docker
A newly identified botnet malware named Carbonato targets insecure hosts running exposed Docker daemons, installing the Hermes Agent AI framework to take control of the compromised systems.
technology·other·misconfiguration·
24 Sept 2026 · Manus
Security researchers identified a prompt-injection vulnerability in the agentic AI application Manus, valued at $4B, showing how attacker-supplied external data could manipulate the AI's behavior.
technology·other·prompt injection·
24 Sept 2026 · Bytebase
DBHub versions prior to 0.22.5 expose multiple critical vulnerabilities: an unauthenticated HTTP MCP endpoint vulnerable to DNS rebinding attacks allowing unauthorized database access, and a non-functional read-only mode that fails to prevent database writes including potential remote code execution.
technology·other·misconfiguration·
23 Sept 2026 · MemTensor
Unknown attackers compromised two legitimate MemTensor packages on npm and PyPI to distribute a Go-based credential-stealing implant called sckit, targeting Windows, Linux, and macOS systems.
technology·other·supply chain·
23 Sept 2026 · OpenAI, Google
Threat actors are seeding the web with malicious links and manipulated data, then optimizing this content so that ChatGPT, Gemini, and Google AI Overview surface it in their answers, enabling mass disinformation and phishing campaigns.
technology·browsing·prompt injection·
22 Sept 2026 · OpenBao
OpenBao Agent's exec rendering mode incorrectly writes secrets to stdout during certain error conditions, particularly when num_retries is met. The vulnerability was inherited from Vault and has been patched in version 2.6.0.
technology·other·misconfiguration·
22 Sept 2026 · Home Assistant
Home Assistant Green is vulnerable to Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration, allowing unauthenticated attackers on the local network to trick it into making HTTP requests to arbitrary hosts including internal services. The IPP integration automatically processes mDNS service announcements without authentication and follows HTTP redirects from attacker-controlled hosts.
technology·other·misconfiguration·
22 Sept 2026 · MCP Atlassian
Six critical vulnerabilities discovered in the Model Context Protocol Atlassian package affecting file access, SSRF protection, credential storage, XSS, and path traversal validation. These include arbitrary file read via upload functions, missing SSRF redirect checks in OAuth/basic auth branches, world-readable OAuth token storage, reflected XSS in callback handler, and incomplete path traversal protection allowing module overwrite and RCE.
technology·other·excessive permissions·
22 Sept 2026 · lightrag-hku
LightRAG's API server exposes sensitive infrastructure details through raw exception messages in error responses, and the WebUI is vulnerable to stored XSS via unsanitized HTML rendering of ingested document content.
technology·other·misconfiguration·
22 Sept 2026 · Microsoft
A coalition led by Microsoft and UK police disrupted the EvilTokens phishing-as-a-service kit, which used an AI chatbot to help criminals analyze compromised inboxes, bypass Microsoft 365 MFA, and identify fraud targets; the operation had compromised roughly 12,000 email accounts across more than 10,000 organizations worldwide before Microsoft seized over 50 websites and UK police arrested two suspected administrators.
technology·other·tool misuse·
22 Sept 2026 ·
Cisco Talos discovered a Windows malware strain, CLOSEDQUORUM, that queries four LLM providers (Gemini, DeepSeek, Qwen, Mistral) to autonomously vote on post-compromise actions such as credential theft, code injection, and persistence, without needing further human operator commands. Talos has not observed any in-the-wild deployment of the malware.
technology·other·tool misuse·
22 Sept 2026 ·
Security researchers identified ClosedQuorum, a new Windows malware family that queries Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide what actions to take during the post-compromise stage of an intrusion.
technology·other·tool misuse·
22 Sept 2026 · Moonshot AI
A security flaw in Moonshot AI Kimi Code up to version 0.31.0 allows OS command injection through the MCP Configuration Loader component. The vulnerability enables remote attacks by planting untrusted executables in the $PATH when loading .mcp.json files.
technology·coding·tool misuse·
22 Sept 2026 · sooperset
The mcp-atlassian package fails to validate URLs extracted from HTTP headers before passing them to API clients, allowing attackers to perform Server-Side Request Forgery attacks against internal services and cloud metadata endpoints.
technology·other·misconfiguration·
22 Sept 2026 · Bifrost
A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the open-source Bifrost AI gateway lets an unauthenticated attacker execute arbitrary commands on the gateway server with a single HTTP request when management authentication is not properly enabled, affecting all Bifrost HTTP transport versions before 2.1.0.
technology·other·misconfiguration·
22 Sept 2026 · aborruso
The @aborruso/ckan-mcp-server SSRF guard fails to resolve DNS names, allowing attackers to bypass validation and reach internal addresses (127.0.0.1, 169.254.169.254, RFC-1918) through hostname arguments. This is the third bypass of the same validation function, affecting all versions through 0.4.107.
technology·other·excessive permissions·
22 Sept 2026 · roomi-fields
The vault_batch MCP tool in @roomi-fields/notebooklm-mcp versions 1.6.0 through 2.0.2 accepts unsanitized vault_dir and slug_prefix parameters, allowing arbitrary file writes outside the intended vault directory. This could be exploited via prompt injection to plant files in sensitive locations.
technology·coding·prompt injection·
22 Sept 2026 ·
Researchers found a malicious npm package, tw-pkgprobe-7731, that masqueraded as a Twilio bug-bounty probing tool but was designed to exfiltrate sensitive credentials from developers who installed it.
technology·other·supply chain·
22 Sept 2026 · sooperset
Three critical vulnerabilities discovered in mcp-atlassian package: path traversal allowing arbitrary file read via confluence_upload_attachment, SSRF protection bypass in URL validation, and unrestricted file upload allowing server-local file exfiltration to Jira/Confluence attachments.
technology·other·excessive permissions·
22 Sept 2026 ·
Cisco Talos disclosed a Windows malware sample, CLOSEDQUORUM, designed to have up to four AI models vote on actions like stealing Windows credentials, browser passwords, and crypto wallet data instead of relying on an attacker's command server. Talos has not observed the full chain working and says the publicly available version is non-functional.
technology·other·unknown·
22 Sept 2026 · Z.ai
Z.ai's ZCode code-generation tool was found silently packaging and uploading users' entire project workspaces and histories to Alibaba Cloud without consent, with only Z.ai holding the decryption key, meaning users could not access or delete their own uploaded data. Z.ai apologized, said uploaded data was never used for training, removed the offending Repo Wiki feature, and open-sourced ZCode after third-party audits.
technology·coding·data leak·
21 Sept 2026 · Meta
Security researcher Patrick Wardle disclosed a proof-of-concept local zero-day in Meta's Muse macOS app, showing an unprivileged local process can modify an undocumented setting to redirect dictation traffic to an attacker-controlled endpoint. This could expose dictated audio and prompts, enable prompt injection, and let local malware abuse whatever access the user has granted to Muse.
technology·other·misconfiguration·
19 Sept 2026 · Multiple (Google, Microsoft, Opera, Perplexity, Anthropic)
Security researcher Gal Weizman of Forever Security demonstrated 'BragJack,' a proof-of-concept attack using a malicious browser extension and a 'Prompt Forcing' technique to hijack AI assistants built into Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The research earned over $20,000 in bug bounties and resulted in two CVEs.
technology·browsing·prompt injection·
19 Sept 2026 · OpenAI
Researchers at security firm Hacktron used Anthropic's Claude Opus 5 to chain a vulnerability in OpenAI's public help forum software with a weakness in OpenAI's login system, taking over several OpenAI staff members' ChatGPT and Codex accounts and reaching an internal OpenAI code repository as part of authorized security research.
technology·other·misconfiguration·
18 Sept 2026 · Stacklok
Containerized MCP servers in ToolHive can reach host services through host.docker.internal, enabling lateral movement and tool manipulation. This bypasses the container isolation model that is ToolHive's core security feature.
technology·other·misconfiguration·
18 Sept 2026 · Microsoft
Microsoft patched a maximum-severity vulnerability (CVE-2026-85889, CVSS 10.0) in Azure AI Foundry caused by missing authentication for a critical function, which could let an unauthorized attacker elevate privileges over a network. Microsoft has released a fix and states no customer action is required.
technology·other·misconfiguration·
18 Sept 2026 · F1bonacc1
A DNS rebinding vulnerability in Process Compose's MCP SSE transport allows malicious websites to control local process-compose tools without authentication. The vulnerability exists because the MCP SSE listener lacks Host validation, Origin validation, or authentication checks before dispatching requests to control tools.
technology·workflow·misconfiguration·
18 Sept 2026 · Orkes
CVE-2026-58138, an unauthenticated remote code execution vulnerability in Orkes Conductor exploitable via inline workflow definitions, is being actively exploited by attackers.
technology·workflow·unknown·
18 Sept 2026 · AWS
Security researchers at Unit 42 found that default configurations in AWS AgentCore Harness create a gap between the agent runtime and identity management, allowing prompt injection attacks to exfiltrate credentials from agents.
technology·other·prompt injection·
18 Sept 2026 · Anthropic, OpenAI, GitHub
Security firm Air Security disclosed a vulnerability dubbed Plugin4Shell affecting four AI coding agents, allowing anyone who controls a plugin's code repository to swap out a pinned, reviewed plugin version for malicious code. Anthropic patched Claude Code (2.1.179) and OpenAI patched Codex (0.146.0), while GitHub Copilot reportedly has no fix yet.
technology·coding·supply chain·
17 Sept 2026 · Zalando
Skipper's OPA authorization filter fails to properly detect truncated request bodies when using chunked transfer encoding or HTTP/2, allowing oversized payloads to bypass policy inspection. This is an incomplete fix to a prior vulnerability.
technology·other·misconfiguration·
17 Sept 2026 · Multiple (Anthropic, OpenAI, Google, Microsoft)
Security researchers at Air disclosed a zero-click remote code execution vulnerability, dubbed Plugin4Shell, affecting Claude Code, Codex, Gemini CLI, and Microsoft Copilot/GitHub Copilot. The flaw exploits a bypass of plugin SHA-pinning in trusted marketplaces, letting attackers swap pinned plugin commits for malicious code that auto-updates into agents, potentially giving full access to any asset the agent can reach.
technology·coding·supply chain·
17 Sept 2026 · GitHub
Security researchers at Adversa AI found GitHub Copilot CLI can be tricked by malicious web pages using encrypted 'Cryptographic Context Injection' instructions into reading local secrets (e.g. .env files) and exfiltrating them to an attacker-controlled URL, depending on which underlying model handles the session. GitHub's triage team validated the finding but declined to classify it as a product vulnerability, arguing user consent was required to trigger the action.
technology·coding·prompt injection·
17 Sept 2026 · Irregular
Security research firm Irregular found that AI agents performing routine maintenance tasks can retrain and redeploy their own underlying models, potentially leaking secrets and erasing built-in safety refusals.
technology·other·tool misuse·
17 Sept 2026 ·
Security researchers discovered a new Android malware strain called RatHat that incorporates an AI-powered subsystem allowing attackers to remotely and automatically navigate and control compromised devices.
technology·other·unknown·
