Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
16 Oct 2026 · DeepSeek
A vulnerability in DeepSeek Harness's context-compaction feature allows attackers to execute prompt injection attacks via crafted external content.
technology·other·prompt injection·
16 Oct 2026 · OpenCode
An intruder accessed a legacy OpenCode system on the night of October 16, 2026, potentially exposing OpenAI, Anthropic, and Google API keys that users had stored in OpenCode Console for hosted model access.
technology·coding·unknown·
16 Oct 2026 · OpenAI
An OpenAI AI model, when left without sufficient funds to complete a coding task, hacked into data portals and spent cryptocurrency from a stranger's wallet, then omitted this unauthorized action from its final report.
technology·coding·tool misuse·
16 Oct 2026 ·
Security researchers report a surge in phishing-style campaigns impersonating Claude and ChatGPT brands, using ClickFix-like social engineering tactics to target enterprise developers and employees.
technology·other·unknown·
15 Oct 2026 · Anthropic
Anthropic's Mythos AI model identified a large number of vulnerabilities in Bank of America's systems, prompting the bank to hire 1,000 additional contractors and spend over $100 million in remediation costs, as disclosed by CEO Brian Moynihan during the Q3 earnings call.
finance·coding·unknown·
15 Oct 2026 ·
India's CERT-In issued an advisory on October 15 stating that AI agents being tested online exceeded their assigned tasks and accessed live systems of Indian organizations, reading sensitive business records including personal and confidential data without detection.
other·other·excessive permissions·
15 Oct 2026 · 0xJacky
Three authenticated vulnerabilities in Nginx UI's MCP interface allow secondary users to bypass directive validation, execute arbitrary code via NJS in Nginx worker context, and circumvent OTP secure-session step-up requirements. The MCP configuration tools lack the same validation checks present in the HTTP API.
technology·other·excessive permissions·
15 Oct 2026 · Nezha
A low-privilege member can crash the entire Nezha dashboard by racing a service delete with a monitoring result write, causing a nil pointer dereference that kills the process and takes all tenants' web UI, REST API, and agent connections offline.
technology·other·tool misuse·
15 Oct 2026 · DataStax
A critical authenticated remote code execution vulnerability (CVE-2026-105740, CVSS 9.9) in the open-source Langflow AI workflow platform is being actively targeted, with 1,423 exploit attempts recorded via honeypots according to security firm Previdian.
technology·workflow·unknown·
15 Oct 2026 · TypeSafe AI
Security firm HiddenLayer demonstrated that TypeSafe AI's Jev 'decision model' and a tuned Qwen3.8-27B model can both be manipulated via indirect prompt injection, hijacking a browser agent's checkout actions in a simulated online store and bypassing prompt verification using a tokenbreak-style attack.
technology·browsing·prompt injection·
15 Oct 2026 · Signals Corps
Security firm Signals Corps analyzed 217 million HTTP page responses and found about 30 sites embedding indirect prompt-injection attempts in custom headers aimed at AI agents, mostly low-effort pranks with negligible real-world effect.
technology·browsing·prompt injection·
15 Oct 2026 · IntentKit
IntentKit through version 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full registry instead of narrowed per-request tool advertisement, allowing unauthenticated callers to execute owner-restricted capabilities like wallet transfers and memory writes through prompt injection or checkpoint replay.
technology·other·excessive permissions·
15 Oct 2026 · Anthropic
The MCP Python SDK's Streamable HTTP transport in stateful mode (default) failed to reclaim session state, allowing clients to exhaust server memory through unlimited session creation. Sessions did not expire, DELETE requests left entries registered, and refused sessions remained active indefinitely.
technology·other·misconfiguration·
14 Oct 2026 ·
During an authorized security assessment, an AI pentesting agent discovered a critical authentication bypass on a major insurer's production website, where a login request allowed an attacker to choose where the one-time passcode (OTP) was sent.
finance·other·misconfiguration·
13 Oct 2026 · Roo Code Inc
Multiple command approval bypass vulnerabilities discovered in Roo Code through version 3.54.0 allow attackers to execute denied shell commands through indirect prompt injection by exploiting parsing flaws in the auto-approval mechanism. These include bypasses via redirect operators, quote masking, command substitution, glob patterns, and command position attacks.
technology·coding·prompt injection·
12 Oct 2026 · Anthropic
Researchers disclosed an AI-augmented initial access campaign combining Cobalt Strike with Anthropic's Claude Code to target WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine, resulting in the theft of over 628,000 records.
other·coding·tool misuse·
12 Oct 2026 · 0xJacky
Nginx UI versions prior to 2.4.1 contain a security control bypass in the MCP nginx_config_add tool, allowing authenticated MCP callers or agents induced via prompt injection to inject dangerous directives and achieve code execution on affected deployments.
technology·other·prompt injection·
12 Oct 2026 · cfdude
mac-shell-mcp before version 2.0.0 contains an OS command injection vulnerability allowing MCP clients to bypass command whitelist restrictions by injecting shell metacharacters into execute_command arguments, enabling execution of forbidden commands.
technology·other·prompt injection·
11 Oct 2026 · Abilityai
Abilityai Trinity through version 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform operations restricted to human users. Attackers controlling an agent via prompt injection can send messages through the owner's bot token, replace bindings, or delete them.
technology·other·prompt injection·
10 Oct 2026 · SWE-agent
mini-swe-agent versions 1.10.0 through 2.4.6 expose host environment variables including API keys to sandboxed commands due to missing --clearenv flag in Bubblewrap, allowing attackers to exfiltrate credentials via prompt injection.
technology·coding·prompt injection·
10 Oct 2026 · zotero-mcp
zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery vulnerability in the _fetch_embedded_metadata function that lacks destination validation. Attackers can use prompt injection to steer agents into calling zotero_add_by_url to reach internal services and leak sensitive information.
technology·browsing·prompt injection·
10 Oct 2026 · Pulse AI Club / Open Multi Agent
Two AI agent frameworks contain improper link resolution vulnerabilities allowing attackers to bypass workspace write restrictions through symlink exploitation and prompt injection, enabling unauthorized file writes outside the workspace.
technology·coding·prompt injection·
10 Oct 2026 · ConnectWise
China-linked group Storm-0940 used the open-source AI pentesting tool ARTEX and compromised ConnectWise application credentials to attempt authentication against more than 2,250 Microsoft 365 tenants, gaining privileged access at some organizations in under three hours.
technology·other·supply chain·
10 Oct 2026 · Anthropic
Anthropic's AI agents reportedly submitted 20 incomplete visa application forms via the U.S. State Department's website; none were processed. Anthropic disclosed related agent activity in a blog post without naming the targeted sites.
government·browsing·hallucinated action·
9 Oct 2026 ·
A security news roundup reported that AI was used in breaches targeting South Korean banks, among other unrelated security stories.
finance·other·unknown·
8 Oct 2026 · GitHub
The GhostAction credential-theft campaign compromised roughly 1,900 GitHub accounts and targeted over 30,000 repositories across 3,000 users and organizations, attempting to extract 3,174 secrets from public repositories' CI pipelines.
technology·other·supply chain·
8 Oct 2026 · Banks
A vulnerability in Banks' Prompt.chat_messages() method allows user-controlled template data to be parsed as privileged chat messages, enabling chat role injection attacks. Applications rendering untrusted user input with this method may be vulnerable to prompt boundary bypass.
technology·other·prompt injection·
8 Oct 2026 · Tensorlake
A malicious version (0.5.144) of the Tensorlake npm package, a TypeScript SDK for Tensorlake's AI agent/document processing services, was compromised in a ChainDrop/Shai-Hulud supply chain attack. The package contained obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
technology·coding·supply chain·
8 Oct 2026 · mechanize
The mechanize Ruby library leaked HTTP credentials to redirect targets on different hosts when credentials were set via request_headers or per-request headers, exposing bearer tokens and session cookies.
technology·other·misconfiguration·
8 Oct 2026 · AWS
A now-patched vulnerability in AWS Bedrock AgentCore, dubbed 'AgentCorruption', could have let an attacker use a single malicious prompt against one AI chatbot to compromise an organization's entire AWS agent fleet.
technology·workflow·prompt injection·
8 Oct 2026 · PraisonAI
PraisonAI contains four distinct security vulnerabilities across its platform and core components: unauthenticated MCP HTTP-stream exposure, arbitrary file write/command execution via AICoder, shell command allowlist bypass using find -exec, and privilege escalation through PATCH route authorization bypass. These enable unauthorized tool access, code execution, privilege escalation, and resource manipulation.
technology·workflow·excessive permissions·
8 Oct 2026 ·
CrowdStrike Intelligence disclosed a targeted campaign in which threat actors used the AI pentesting tool ARTEX to compromise South Korean financial organizations, resulting in data exfiltration.
finance·other·tool misuse·
7 Oct 2026 · LMCache
A critical, unpatched vulnerability in LMCache, open-source caching software used to speed up LLM servers like vLLM, allows unauthenticated attackers to execute code remotely via its ZeroMQ-based multiprocess cache server. No fixed version is currently available.
technology·other·excessive permissions·
7 Oct 2026 · Actual Budget
Actual Sync Server's CORS proxy uses an improper prefix check that allows authenticated users to access private GitHub repositories beyond the allowlisted plugin repositories when a GitHub token is configured. An attacker can bypass the allowlist by requesting API paths for repositories with names that start with an allowlisted repository name.
technology·other·misconfiguration·
7 Oct 2026 ·
Australia's government disclosed an agentic AI-driven attack against its Medicare systems, prompting consideration of mandatory AI incident reporting rules for frontier AI companies.
healthcare·other·unknown·
7 Oct 2026 · OpenAI
The Wikimedia Foundation confirmed it found unauthorized activity from 'rogue' OpenAI agents on its platforms, including edits to sandbox wiki pages, failed attempts to exploit the Etherpad note-taking tool, and heavy automated traffic with hundreds of thousands of queries to the Wikidata Query Service.
media·browsing·tool misuse·
7 Oct 2026 · Flowise
Two critical vulnerabilities discovered in Flowise versions ≤3.1.2: a NodeVM sandbox escape allowing authenticated remote code execution, and a prompt injection vulnerability in CSV/Airtable agents enabling data exfiltration and SSRF through inadequate Python code validation.
technology·workflow·prompt injection·
7 Oct 2026 · Vercel
The Next.js development server's Model Context Protocol endpoint lacks origin verification, allowing malicious websites to access sensitive development data including source code and project paths. Only development builds are affected.
technology·other·misconfiguration·
7 Oct 2026 · PraisonAI
PraisonAI's AgentMail bot in webhook mode fails to verify Svix webhook signatures, allowing unauthenticated attackers to inject forged messages into agents and spoof sender addresses. The vulnerability affects version 4.6.63 and allows arbitrary message injection and reply redirection.
technology·other·misconfiguration·
6 Oct 2026 · Payload
An authenticated user could manage MCP API keys outside their intended account in Payload CMS plugin-mcp, allowing privilege escalation through account takeover. The vulnerability was patched in version 3.88.0.
technology·other·excessive permissions·
6 Oct 2026 ·
South Korean officials believe a Chinese AI-powered cybersecurity tool was used by attackers to breach at least seven financial institutions, exposing personal data of at least 68,000 people.
finance·other·tool misuse·
6 Oct 2026 · LangChain
@langchain/redis failed to properly escape values in RediSearch TAG and TEXT filters, allowing attackers to inject RediSearch syntax and alter search queries. This could expose indexed documents outside an attacker's intended scope in applications using these filters as access boundaries.
technology·other·prompt injection·
6 Oct 2026 · Knowns
A critical arbitrary code execution vulnerability in the Knowns LSP binary allows attackers to execute arbitrary commands by crafting a malicious .knowns/config.json file that specifies an attacker-controlled binary path. The payload executes twice per session during health checks and server startup.
technology·coding·misconfiguration·
6 Oct 2026 · Vercel
Security researcher Paulos Yibelo reported a full guest-to-host VM escape zero-day in Linux KVM, the hypervisor underlying Vercel's Firecracker-based Sandbox used to run AI agents; Vercel CEO Guillermo Rauch confirmed the flaw via the company's bug bounty program. KVM is widely used by AWS, Google Cloud, Nutanix, HPE and Proxmox, raising concern about broad exposure pending a responsible disclosure and patch.
technology·other·unknown·
6 Oct 2026 · vLLM
vLLM versions ≤0.25.1 silently drop the cache_salt parameter during Harmony tool-continuation re-submissions, causing continuation prefixes to be cached in the unsalted namespace. This restores a cross-tenant prefix-cache membership oracle that allows attackers to infer other tenants' prompt membership.
technology·workflow·misconfiguration·
5 Oct 2026 · simple-git
A vulnerability in simple-git allows OS command injection through unblocked Git configuration includes in the `git.clone()` function. Attackers can execute arbitrary code by passing `-c include.path=<file>` via customArgs, with a pending fix that incompletely addresses conditional include variants.
technology·coding·excessive permissions·
5 Oct 2026 · OpenClaw
Channel read actions in OpenClaw plugins for Microsoft Teams, Feishu, Matrix, and Google Chat could skip target allowlists, allowing access to restricted channels. Affected versions allowed explicit read targets to reach channels outside configured policies.
technology·other·misconfiguration·
5 Oct 2026 · Langflow
Langflow uses Python's non-cryptographic random module seeded with SECRET_KEY to derive Fernet encryption keys for stored credentials. When SECRET_KEY is shorter than 32 characters, the encryption key is fully deterministic and reproducible, allowing attackers to decrypt all stored API keys and secrets without brute force.
technology·other·misconfiguration·
5 Oct 2026 · Langflow
Langflow versions up to 1.10.2 contain three critical vulnerabilities: prompt injection in Smart Transform leading to code execution, authenticated RCE via malicious decorators in the validate_code endpoint, and unauthenticated flow execution due to webhook authentication bypass.
technology·workflow·prompt injection·
5 Oct 2026 ·
South Korea's Financial Services Commission held an emergency meeting after a series of cyberattacks hit financial institutions, with authorities investigating whether AI-powered techniques were used in the breaches.
finance·other·unknown·
