Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.

Incidents by month, 2026 · 582 total · click a month to filter
Jan 2026: 23 incidents23JanFeb 2026: 26 incidents26FebMar 2026: 46 incidents46MarApr 2026: 47 incidents47AprMay 2026: 53 incidents53MayJun 2026: 54 incidents54JunJul 2026: 47 incidents47JulAug 2026: 83 incidents83AugSep 2026: 146 incidents146SepOct 2026: 57 incidents57OctNov 2026: 0 incidents0NovDec 2026: 0 incidents0Dec
Incidents by sector · 606 total · click a sector to filter
Clear

572 incidents match

Incident dateIncidentVendorSectorAgentRoot causeSeverityStatus
16 Sept 2026Single Browser Extension Could Hijack AI Assistants in Five BrowsersGoogle, Microsoft, Opera, Anthropic, Perplexitytechnologybrowsingexcessive permissionsconfirmed
16 Sept 2026BragJack Attack Hijacks Browser Agentic AI Assistantstechnologybrowsingunknownconfirmed
16 Sept 2026vLLM unauthenticated audio decompression-bomb DoS in /v1/chat/completionsvLLMtechnologyothermisconfigurationconfirmed
16 Sept 2026RMCP Unauthenticated Session-Table Leak DoS (CVE-2026-63128)rmcptechnologyothermisconfigurationconfirmed
16 Sept 2026AI Agent-Driven Data Breach Reported to Spanish Regulatortechnologyotherunknownconfirmed
16 Sept 2026Attacker Hijacks AI Coding Assistant, Spreads Shai-Hulud Wormtechnologycodingsupply chainconfirmed
15 Sept 2026@zereight/mcp-gitlab Multiple Safety Control Bypasseszereighttechnologyotherprompt injectionconfirmed
15 Sept 2026Contentful MCP Server Prompt Injection via Network OptionsContentfultechnologycodingprompt injectionresolved
14 Sept 2026ESPHome Device Builder: Auth env vars rename silently disables dashboard authenticationESPHometechnologyothermisconfigurationconfirmed
12 Sept 2026MCPHub OAuth 2.0 authentication bypass vulnerabilityMCPHubtechnologyothermisconfigurationconfirmed
11 Sept 2026Multiple vulnerabilities in IBM Langflow OSS 1.0.0-1.11.5IBMtechnologyworkflowexcessive permissionsconfirmed
11 Sept 2026CVE-2026-59973: SSRF fix bypass in FrontMCP and mcp-from-openapi OpenAPI $ref handlingFrontMCPtechnologyothersupply chainconfirmed
11 Sept 2026Threat actors abused Anthropic's Claude to extract secrets from 1.8M Android appsAnthropictechnologyothertool misuseconfirmed
11 Sept 2026MySQL MCP Server SSE transport allows unauthenticated SQL execution (CVE-2026-59971)mysql-mcp-servertechnologyworkflowmisconfigurationresolved
10 Sept 2026Command injection in Tianxi AI Agent PC ApplicationLenovotechnologyothertool misuseconfirmed
10 Sept 2026Crook used open-source AI agents to breach 27+ companies, steal 600k cardstechnologyothertool misuseconfirmed
10 Sept 2026OmniRoute RCE via unauthenticated POST /api/acp/agents endpointOmniRoutetechnologyotherexcessive permissionsconfirmed
10 Sept 2026n8n Multiple Vulnerabilities in Workflow Execution and Access Controln8ntechnologyworkflowmisconfigurationconfirmed
10 Sept 2026AWS Security Agent MCP Server S3 Bucket Ownership Verification MissingAWStechnologyothermisconfigurationconfirmed
10 Sept 2026Path Injection in n8n Elasticsearch and ElasticSecurity Nodesn8ntechnologyworkflowtool misuseresolved
9 Sept 2026Open WebUI vulnerabilities allow DoS and message tamperingOpen WebUItechnologyothermisconfigurationresolved
9 Sept 2026functype-mcp-server RCE via unsanitized pnpm installfunctype-mcp-servertechnologyworkflowprompt injectionconfirmed
8 Sept 2026Command injection and credential exposure in GitHub Copilot and Visual Studio CodeMicrosofttechnologycodingprompt injectionconfirmed
8 Sept 2026Okta Hyperdrive agent plugin authentication and logging vulnerabilitiesOktatechnologyothermisconfigurationconfirmed
8 Sept 2026ASUS Control Center Express Agent missing authentication vulnerabilityASUStechnologyothermisconfigurationconfirmed
8 Sept 2026Covert channel in ChatGPT's internal Artifactory enabled cross-account Gmail data theftOpenAItechnologyotherprompt injectionresolved
8 Sept 2026Roo-Code auto-approve bypass vulnerabilities in shell command parsingRoo-Codetechnologycodingexcessive permissionsconfirmed
7 Sept 2026knowns path traversal vulnerabilities in MCP tool argumentsknowns-devtechnologycodingtool misuseconfirmed
7 Sept 2026Eclipse Ankaios wildcard authorization bypass in Control InterfaceEclipse Ankaiostechnologyothermisconfigurationconfirmed
5 Sept 2026Rowboat fails to validate custom MCP server and webhook URLsRowboat Labstechnologyworkflowmisconfigurationreported
5 Sept 2026Teen researcher found Microsoft Titan auth flaw exposing 17.3 trillion rowsMicrosofttechnologycodingmisconfigurationresolved
5 Sept 2026AVideo API rate limit bypass via bot User-Agent headerAVideotechnologyothermisconfigurationreported
4 Sept 2026LaVague 0.2.35 Remote Code Execution via Prompt InjectionLaVaguetechnologycodingprompt injectionreported
4 Sept 2026AgentScope path traversal vulnerability in LocalWorkspace.add_skillAgentScopetechnologyworkflowexcessive permissionsreported
4 Sept 2026CodeWhale SSRF bypass via DNS pinning TOCTOUCodeWhaletechnologybrowsingtool misuseconfirmed
4 Sept 2026Aider arbitrary code execution via malicious .aider.conf.ymlaider-chattechnologycodingmisconfigurationreported
4 Sept 2026SSRF vulnerability in OWL DocumentProcessingToolkitOWLtechnologyotherprompt injectionconfirmed
4 Sept 2026excel-mcp-server path confinement bypass in stdio modeexcel-mcp-servertechnologyothermisconfigurationreported
4 Sept 2026LobeChat webhook signature verification bypass in QQ and Feishu adaptersLobeHubtechnologyworkflowmisconfigurationreported
4 Sept 2026ms-swift 4.5.2 SSRF via unvalidated media URLsms-swifttechnologycodingtool misusereported
4 Sept 2026xiaobei webhook endpoint lacks authentication, allows SSRF attacksxiaobeitechnologyworkflowmisconfigurationreported
4 Sept 2026Multiple vulnerabilities in Amazon AWS Labs MCP serversAmazontechnologyworkflowprompt injectionconfirmed
4 Sept 2026Postgres MCP Pro 0.3.0 restricted-mode bypass via RangeFunctionPostgres MCP Protechnologycodingmisconfigurationreported
4 Sept 2026Multiple vulnerabilities in IBM ContextForge and Langflow OSSIBMtechnologyotherexcessive permissionsreported
4 Sept 2026OGX Unauthenticated Server-Side Request Forgery via MCP ToolOGXtechnologyotherexcessive permissionsreported
4 Sept 2026git-mcp-server argument injection in git toolsgit-mcp-servertechnologycodingprompt injectionreported
4 Sept 2026LLaMA-Factory SSRF vulnerability in OpenAI API handlerLLaMA-Factorytechnologycodingmisconfigurationreported
4 Sept 2026Xinference unauthenticated arbitrary-path file read vulnerabilityXinferencetechnologyotherexcessive permissionsreported
4 Sept 2026Arbitrary local file read in firecrawl-mcp-server 3.20.2firecrawltechnologycodingexcessive permissionsreported
4 Sept 2026cli-mcp-server command allowlist bypass via shell operatorscli-mcp-servertechnologycodingmisconfigurationreported