Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
16 Sept 2026 · Google, Microsoft, Opera, Anthropic, Perplexity
Researchers at Forever Security demonstrated that a single ordinary browser extension could take control of AI assistants built into Chrome (Gemini Live), Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension, gaining access with a single click.
technology·browsing·excessive permissions·
16 Sept 2026 ·
A newly identified attack technique, dubbed BragJack, hijacks AI assistants built into browsers to access sensitive information, execute malicious actions, and exfiltrate data.
technology·browsing·unknown·
16 Sept 2026 · vLLM
vLLM's audio decode-duration guard is only applied to the speech-to-text endpoint but not the chat endpoint, allowing unauthenticated clients to submit compressed audio files that expand to multiple GB and cause out-of-memory denial of service attacks.
technology·other·misconfiguration·
16 Sept 2026 · rmcp
An unauthenticated attacker can leak session entries from rmcp's HTTP server by sending malformed JSON-RPC requests, causing permanent memory allocation that eventually exhausts server memory at a rate of ~75 GB per day.
technology·other·misconfiguration·
16 Sept 2026 ·
Spanish data protection regulators disclosed what they describe as the first data breach carried out by an autonomous AI agent, which chained together a successful login, vulnerability discovery, and access to personal data.
technology·other·unknown·
16 Sept 2026 ·
Mandiant reported that an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider; the assistant then recommended poisoned software that was accepted, allowing the Shai-Hulud worm to spread across roughly 100 internal code repositories and steal secrets and source code.
technology·coding·supply chain·
15 Sept 2026 · zereight
@zereight/mcp-gitlab contains five defects that defeat its safety controls for exposing GitLab to LLM agents, including read-only mode bypasses, unauthenticated transports, DNS rebinding vulnerabilities, session exhaustion DoS, and SSRF via header injection.
technology·other·prompt injection·
15 Sept 2026 · Contentful
Contentful MCP Server versions prior to 1.7.19 expose network configuration options to LLM-controlled arguments, allowing prompt injection attacks to redirect API requests and steal authentication tokens. The vulnerability affects space-to-space migration tools and is fixed in updated versions.
technology·coding·prompt injection·
14 Sept 2026 · ESPHome
ESPHome Device Builder's environment variable rename from USERNAME/PASSWORD to ESPHOME_USERNAME/ESPHOME_PASSWORD removed backward compatibility, causing deployments using the legacy names to lose authentication on upgrade and expose the dashboard to unauthenticated access.
technology·other·misconfiguration·
12 Sept 2026 · MCPHub
MCPHub before version 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional, allowing attackers to redeem intercepted authorization codes for access tokens without proper credentials.
technology·other·misconfiguration·
11 Sept 2026 · IBM
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain multiple vulnerabilities allowing remote authenticated attackers to execute arbitrary Python code, OS commands, and access sensitive information due to improper authorization, insufficient session expiration, and pathname restrictions.
technology·workflow·excessive permissions·
11 Sept 2026 · FrontMCP
A GitHub advisory reports that the patch for an earlier SSRF issue (CVE-2026-39885) in mcp-from-openapi 2.3.0 can be bypassed, letting untrusted OpenAPI specs loaded by FrontMCP 1.2.1 trigger backend-origin requests to loopback or private services via DNS-to-loopback names, redirects, and IPv4-mapped IPv6 forms. In hosted or multi-user FrontMCP deployments where users can import specs, this can expose internal APIs not reachable externally.
technology·other·supply chain·
11 Sept 2026 · Anthropic
Anthropic reported that multiple threat groups, including financially motivated actors and state-linked espionage groups associated with Russia and China, attempted to abuse its Claude AI model for malicious purposes, including extracting secrets from 1.8 million Android apps. Separate reporting describes attackers abusing trusted AI platforms, such as weaponized Claude Artifacts and shared AI conversations, to host malicious content and lure users into installing malware.
technology·other·tool misuse·
11 Sept 2026 · mysql-mcp-server
The mysql-mcp-server MCP package, when run in SSE/HTTP transport mode, created its SSE transport without security settings, disabling DNS-rebinding protection and leaving all routes unauthenticated while binding to 0.0.0.0. This allowed network attackers or malicious web pages to invoke execute_sql for arbitrary unauthenticated SQL execution, data exfiltration, and potentially file read/write and RCE; 25 publicly reachable instances were found.
technology·workflow·misconfiguration·
10 Sept 2026 · Lenovo
A command injection vulnerability in Tianxi AI Agent PC Application could allow OS command execution if a local user opens a specially crafted link handled by the application.
technology·other·tool misuse·
10 Sept 2026 ·
A Chinese-speaking operator used three open-source AI penetration-testing harnesses (Strix, Cairn, Hermes) to autonomously scan and breach over 100 organizations between August and September 2026, compromising at least 27 companies including a Fortune 500 hospitality firm and a major US airline, stealing over 600,000 credit card records and deploying checkout-page skimmers on dozens of websites.
technology·other·tool misuse·
10 Sept 2026 · OmniRoute
OmniRoute versions 3.8.49 and earlier allowed remote code execution through the POST /api/acp/agents endpoint by passing attacker-controlled binary and versionCommand values that bypassed security filters. An unauthenticated attacker could execute arbitrary code on the server when requireLogin was false or during bootstrap.
technology·other·excessive permissions·
10 Sept 2026 · n8n
Five security vulnerabilities were disclosed in n8n affecting regular expression denial of service, domain-restriction bypass, approval-gate bypass, workflow disclosure, and prototype pollution. The vulnerabilities could allow authenticated users to freeze instances, bypass domain restrictions, bypass approval gates, disclose workflow information, or cause denial of service.
technology·workflow·misconfiguration·
10 Sept 2026 · AWS
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before version 0.2.0 allows remote attackers to obtain private source archives including credentials and infrastructure state via pre-registered storage buckets derived from publicly known account identifiers.
technology·other·misconfiguration·
10 Sept 2026 · n8n
The Elasticsearch and ElasticSecurity nodes in n8n allowed path injection attacks through unencoded identifiers, enabling attackers to access unintended endpoints or documents using stored Elasticsearch credentials. The vulnerability was patched in versions 1.123.76, 2.37.7, and 2.38.2.
technology·workflow·tool misuse·
9 Sept 2026 · Open WebUI
Three vulnerabilities in Open WebUI allow authenticated users to hang the server via cyclic chat structures and channel members to overwrite other users' messages. Versions 0.5.0-0.11.0 are affected; fixes are available in 0.11.1.
technology·other·misconfiguration·
9 Sept 2026 · functype-mcp-server
The set_functype_version MCP tool in functype-mcp-server accepts an unconstrained version string, allowing attackers to inject arbitrary package aliases and execute remote code through dynamic import of attacker-controlled packages.
technology·workflow·prompt injection·
8 Sept 2026 · Microsoft
Two vulnerabilities in GitHub Copilot and Visual Studio Code allow attackers to disclose information over a network through command injection and insufficiently protected credentials.
technology·coding·prompt injection·
8 Sept 2026 · Okta
Two vulnerabilities were discovered in the Okta Hyperdrive agent plugin: one returns unverified authentication responses without signed SAML assertions when MFA is not required, and another writes decoded SAML bearer assertions to local log files, exposing authentication credentials to local users.
technology·other·misconfiguration·
8 Sept 2026 · ASUS
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via direct connection when an active login session exists.
technology·other·misconfiguration·
8 Sept 2026 · OpenAI
Check Point Research disclosed that ChatGPT's internal JFrog Artifactory instance exposed a hidden channel letting one account plant instructions that a victim's ChatGPT session would silently execute, reading data from the victim's connected Gmail account and returning it to the attacker's account. The proof-of-concept was disclosed to OpenAI in late June 2026, by which time the Artifactory instance had already been decommissioned, closing the channel.
technology·other·prompt injection·
8 Sept 2026 · Roo-Code
Roo-Code through version 3.54.0 contains multiple auto-approve bypass vulnerabilities in shell command parsing that allow attackers to execute denied shell commands by exploiting parser logic flaws. Attackers can craft malicious command lines that pass the approval gate but execute denied commands with the agent's auto-execute privileges on developer machines.
technology·coding·excessive permissions·
7 Sept 2026 · knowns-dev
Multiple path traversal vulnerabilities in knowns before version 0.30.0 and through 0.33.0 allow attackers to read, create, overwrite and delete files outside the project directory via MCP tool arguments. AI agent sessions can bypass permission checks and access arbitrary files on the host system.
technology·coding·tool misuse·
7 Sept 2026 · Eclipse Ankaios
Eclipse Ankaios versions v0.5.1 through v1.0.1 have an authorization bypass vulnerability where multi-segment allow rules with leading wildcards incorrectly authorize empty field masks, allowing authenticated workloads to access or modify restricted cluster state.
technology·other·misconfiguration·
5 Sept 2026 · Rowboat Labs
Rowboat through version 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations and perform server-side request forgery attacks against internal services and cloud metadata endpoints.
technology·workflow·misconfiguration·
5 Sept 2026 · Microsoft
A 16-year-old security researcher, aided by a self-built AI hackbot named Antares, discovered that Microsoft's internal Titan analytics platform failed to verify JWT signatures, letting him gain admin access and query databases containing an estimated 17.3 trillion rows, including employee and account data. Microsoft locked down the API, confirmed the finding, and paid a $5,000 bug bounty.
technology·coding·misconfiguration·
5 Sept 2026 · AVideo
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass protected operations including login brute-force protection and perform unlimited password guessing attempts.
technology·other·misconfiguration·
4 Sept 2026 · LaVague
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code.
technology·coding·prompt injection·
4 Sept 2026 · AgentScope
AgentScope through version 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that allows attackers to copy arbitrary server directories into the agent workspace via an unconfined source path parameter.
technology·workflow·excessive permissions·
4 Sept 2026 · CodeWhale
A time-of-check-time-of-use (TOCTOU) vulnerability in CodeWhale's DNS pinning implementation allows attackers to bypass SSRF mitigations by controlling a custom DNS server to fail initial requests and succeed on secondary requests.
technology·browsing·tool misuse·
4 Sept 2026 · aider-chat
Aider automatically loads and executes commands from a .aider.conf.yml configuration file in git repositories without user confirmation, allowing arbitrary code execution when users clone and run aider in attacker-controlled repositories.
technology·coding·misconfiguration·
4 Sept 2026 · OWL
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that allows attackers to inject malicious URLs through prompt injection to fetch internal resources.
technology·other·prompt injection·
4 Sept 2026 · excel-mcp-server
excel-mcp-server 0.1.8 fails to enforce path confinement when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files accessible to the process through unchecked file paths in tools.
technology·other·misconfiguration·
4 Sept 2026 · LobeHub
LobeChat 2.2.1 fails to properly verify webhook signatures in QQ and Feishu adapters, allowing unauthenticated attackers to forge inbound messages and manipulate bot behavior by sending crafted requests to the unauthenticated webhook endpoint.
technology·workflow·misconfiguration·
4 Sept 2026 · ms-swift
ms-swift 4.5.2 contains a server-side request forgery vulnerability in its OpenAI-compatible API that fetches multimodal media URLs without proper validation. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server access internal services and cloud metadata endpoints.
technology·coding·tool misuse·
4 Sept 2026 · xiaobei
xiaobei through version 5.5.2 fails to validate webhook authentication, allowing unauthenticated attackers to inject malicious messages into the agent pipeline and exploit unvalidated media URL fetching to perform server-side request forgery attacks.
technology·workflow·misconfiguration·
4 Sept 2026 · Amazon
Three vulnerabilities discovered in Amazon awslabs MCP server products: template injection in dynamodb-mcp-server, SQL injection in postgres-mcp-server, and OS command injection via COPY TO PROGRAM statement. Additionally, a supply chain issue in Kiro IDE allows remote actors to redirect registry requests and exfiltrate workspace data.
technology·workflow·prompt injection·
4 Sept 2026 · Postgres MCP Pro
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses, allowing attackers to execute file-reading functions and read arbitrary files.
technology·coding·misconfiguration·
4 Sept 2026 · IBM
IBM ContextForge MCP Gateway and Langflow OSS 1.0.0-1.11.2 contain multiple vulnerabilities including server-side request forgery, authentication bypass, arbitrary file writes, path traversal, stored XSS, and remote code execution affecting authenticated attackers.
technology·other·excessive permissions·
4 Sept 2026 · OGX
OGX (formerly Llama Stack) contains an unauthenticated SSRF vulnerability in the /v1/responses endpoint where MCP tool definitions accept a server_url parameter that is fetched server-side without destination validation, allowing remote attackers to access arbitrary internal addresses including cloud metadata endpoints.
technology·other·excessive permissions·
4 Sept 2026 · git-mcp-server
git-mcp-server 2.15.1 contains an argument injection vulnerability in git_log, git_diff, and git_show tools that allows attackers to inject git command-line options and write files to arbitrary paths.
technology·coding·prompt injection·
4 Sept 2026 · LLaMA-Factory
LLaMA-Factory contains a server-side request forgery vulnerability in its OpenAI-compatible API multimodal media URL handler. Unauthenticated attackers can bypass SSRF validation using HTTP redirects or DNS rebinding to access internal addresses and cloud metadata endpoints.
technology·coding·misconfiguration·
4 Sept 2026 · Xinference
Xinference v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint that allows attackers to extract file contents from the server filesystem without authentication.
technology·other·excessive permissions·
4 Sept 2026 · firecrawl
firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can read sensitive files like credentials and environment variables.
technology·coding·excessive permissions·
4 Sept 2026 · cli-mcp-server
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators function when ALLOW_SHELL_OPERATORS is enabled. Attackers can use shell command substitution syntax to execute non-allowlisted commands.
technology·coding·misconfiguration·
