Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
23 Sept 2026 ·
A financially motivated threat actor is using open-source AI agent frameworks to automate attacks against hundreds of online retailers, installing payment-card skimmers that have stolen more than 600,000 credit card records.
retail·other·tool misuse·
22 Sept 2026 · aborruso
The @aborruso/ckan-mcp-server SSRF guard fails to resolve DNS names, allowing attackers to bypass validation and reach internal addresses (127.0.0.1, 169.254.169.254, RFC-1918) through hostname arguments. This is the third bypass of the same validation function, affecting all versions through 0.4.107.
technology·other·excessive permissions·
22 Sept 2026 · roomi-fields
The vault_batch MCP tool in @roomi-fields/notebooklm-mcp versions 1.6.0 through 2.0.2 accepts unsanitized vault_dir and slug_prefix parameters, allowing arbitrary file writes outside the intended vault directory. This could be exploited via prompt injection to plant files in sensitive locations.
technology·coding·prompt injection·
22 Sept 2026 ·
Cisco Talos discovered a Windows malware strain, CLOSEDQUORUM, that queries four LLM providers (Gemini, DeepSeek, Qwen, Mistral) to autonomously vote on post-compromise actions such as credential theft, code injection, and persistence, without needing further human operator commands. Talos has not observed any in-the-wild deployment of the malware.
technology·other·tool misuse·
22 Sept 2026 ·
Researchers found a malicious npm package, tw-pkgprobe-7731, that masqueraded as a Twilio bug-bounty probing tool but was designed to exfiltrate sensitive credentials from developers who installed it.
technology·other·supply chain·
22 Sept 2026 ·
Cisco Talos disclosed a Windows malware sample, CLOSEDQUORUM, designed to have up to four AI models vote on actions like stealing Windows credentials, browser passwords, and crypto wallet data instead of relying on an attacker's command server. Talos has not observed the full chain working and says the publicly available version is non-functional.
technology·other·unknown·
22 Sept 2026 · Microsoft
A coalition led by Microsoft and UK police disrupted the EvilTokens phishing-as-a-service kit, which used an AI chatbot to help criminals analyze compromised inboxes, bypass Microsoft 365 MFA, and identify fraud targets; the operation had compromised roughly 12,000 email accounts across more than 10,000 organizations worldwide before Microsoft seized over 50 websites and UK police arrested two suspected administrators.
technology·other·tool misuse·
22 Sept 2026 · lightrag-hku
LightRAG's API server exposes sensitive infrastructure details through raw exception messages in error responses, and the WebUI is vulnerable to stored XSS via unsanitized HTML rendering of ingested document content.
technology·other·misconfiguration·
22 Sept 2026 · Moonshot AI
A security flaw in Moonshot AI Kimi Code up to version 0.31.0 allows OS command injection through the MCP Configuration Loader component. The vulnerability enables remote attacks by planting untrusted executables in the $PATH when loading .mcp.json files.
technology·coding·tool misuse·
22 Sept 2026 · Bifrost
A critical vulnerability (CVE-2026-90898, CVSS 9.8) in the open-source Bifrost AI gateway lets an unauthenticated attacker execute arbitrary commands on the gateway server with a single HTTP request when management authentication is not properly enabled, affecting all Bifrost HTTP transport versions before 2.1.0.
technology·other·misconfiguration·
22 Sept 2026 · Home Assistant
Home Assistant Green is vulnerable to Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration, allowing unauthenticated attackers on the local network to trick it into making HTTP requests to arbitrary hosts including internal services. The IPP integration automatically processes mDNS service announcements without authentication and follows HTTP redirects from attacker-controlled hosts.
technology·other·misconfiguration·
22 Sept 2026 · sooperset
Three critical vulnerabilities discovered in mcp-atlassian package: path traversal allowing arbitrary file read via confluence_upload_attachment, SSRF protection bypass in URL validation, and unrestricted file upload allowing server-local file exfiltration to Jira/Confluence attachments.
technology·other·excessive permissions·
22 Sept 2026 · OpenBao
OpenBao Agent's exec rendering mode incorrectly writes secrets to stdout during certain error conditions, particularly when num_retries is met. The vulnerability was inherited from Vault and has been patched in version 2.6.0.
technology·other·misconfiguration·
22 Sept 2026 ·
Security researchers identified ClosedQuorum, a new Windows malware family that queries Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously decide what actions to take during the post-compromise stage of an intrusion.
technology·other·tool misuse·
22 Sept 2026 · Z.ai
Z.ai's ZCode code-generation tool was found silently packaging and uploading users' entire project workspaces and histories to Alibaba Cloud without consent, with only Z.ai holding the decryption key, meaning users could not access or delete their own uploaded data. Z.ai apologized, said uploaded data was never used for training, removed the offending Repo Wiki feature, and open-sourced ZCode after third-party audits.
technology·coding·data leak·
22 Sept 2026 · MCP Atlassian
Six critical vulnerabilities discovered in the Model Context Protocol Atlassian package affecting file access, SSRF protection, credential storage, XSS, and path traversal validation. These include arbitrary file read via upload functions, missing SSRF redirect checks in OAuth/basic auth branches, world-readable OAuth token storage, reflected XSS in callback handler, and incomplete path traversal protection allowing module overwrite and RCE.
technology·other·excessive permissions·
22 Sept 2026 · sooperset
The mcp-atlassian package fails to validate URLs extracted from HTTP headers before passing them to API clients, allowing attackers to perform Server-Side Request Forgery attacks against internal services and cloud metadata endpoints.
technology·other·misconfiguration·
21 Sept 2026 · Meta
Security researcher Patrick Wardle disclosed a proof-of-concept local zero-day in Meta's Muse macOS app, showing an unprivileged local process can modify an undocumented setting to redirect dictation traffic to an attacker-controlled endpoint. This could expose dictated audio and prompts, enable prompt injection, and let local malware abuse whatever access the user has granted to Muse.
technology·other·misconfiguration·
21 Sept 2026 · Zammad
Attackers used an apparently AI-agent-driven exploit chain against two zero-day vulnerabilities in the Zammad helpdesk platform to hijack sessions, gain remote code execution, and escalate to root on DIVD's systems, stealing email addresses and other contact details of DIVD volunteers.
other·other·unknown·
19 Sept 2026 · Multiple (Google, Microsoft, Opera, Perplexity, Anthropic)
Security researcher Gal Weizman of Forever Security demonstrated 'BragJack,' a proof-of-concept attack using a malicious browser extension and a 'Prompt Forcing' technique to hijack AI assistants built into Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The research earned over $20,000 in bug bounties and resulted in two CVEs.
technology·browsing·prompt injection·
19 Sept 2026 · OpenAI
Researchers at security firm Hacktron used Anthropic's Claude Opus 5 to chain a vulnerability in OpenAI's public help forum software with a weakness in OpenAI's login system, taking over several OpenAI staff members' ChatGPT and Codex accounts and reaching an internal OpenAI code repository as part of authorized security research.
technology·other·misconfiguration·
18 Sept 2026 · 123 Reg
UK domain registrar 123 Reg confirmed a September 18, 2026 intrusion it called its first 'AI-driven cyberattack,' exposing customer contact details, VAT numbers and account/product data. The company suspects a China-nexus actor using AI agentic tools such as Anthropic's open-sourced skills and the ARTEX framework.
technology·other·data leak·
18 Sept 2026 · Orkes
CVE-2026-58138, an unauthenticated remote code execution vulnerability in Orkes Conductor exploitable via inline workflow definitions, is being actively exploited by attackers.
technology·workflow·unknown·
18 Sept 2026 · F1bonacc1
A DNS rebinding vulnerability in Process Compose's MCP SSE transport allows malicious websites to control local process-compose tools without authentication. The vulnerability exists because the MCP SSE listener lacks Host validation, Origin validation, or authentication checks before dispatching requests to control tools.
technology·workflow·misconfiguration·
18 Sept 2026 · Anthropic, OpenAI, GitHub
Security firm Air Security disclosed a vulnerability dubbed Plugin4Shell affecting four AI coding agents, allowing anyone who controls a plugin's code repository to swap out a pinned, reviewed plugin version for malicious code. Anthropic patched Claude Code (2.1.179) and OpenAI patched Codex (0.146.0), while GitHub Copilot reportedly has no fix yet.
technology·coding·supply chain·
18 Sept 2026 · AWS
Security researchers at Unit 42 found that default configurations in AWS AgentCore Harness create a gap between the agent runtime and identity management, allowing prompt injection attacks to exfiltrate credentials from agents.
technology·other·prompt injection·
18 Sept 2026 ·
Threat actors reportedly used an AI-driven agent to breach a Spanish organization's systems, gaining access and modifying personal data. The incident illustrates the growing use of autonomous AI agents in cyberattacks.
other·other·unknown·
18 Sept 2026 · Microsoft
Microsoft patched a maximum-severity vulnerability (CVE-2026-85889, CVSS 10.0) in Azure AI Foundry caused by missing authentication for a critical function, which could let an unauthorized attacker elevate privileges over a network. Microsoft has released a fix and states no customer action is required.
technology·other·misconfiguration·
18 Sept 2026 · Stacklok
Containerized MCP servers in ToolHive can reach host services through host.docker.internal, enabling lateral movement and tool manipulation. This bypasses the container isolation model that is ToolHive's core security feature.
technology·other·misconfiguration·
17 Sept 2026 · Multiple (Anthropic, OpenAI, Google, Microsoft)
Security researchers at Air disclosed a zero-click remote code execution vulnerability, dubbed Plugin4Shell, affecting Claude Code, Codex, Gemini CLI, and Microsoft Copilot/GitHub Copilot. The flaw exploits a bypass of plugin SHA-pinning in trusted marketplaces, letting attackers swap pinned plugin commits for malicious code that auto-updates into agents, potentially giving full access to any asset the agent can reach.
technology·coding·supply chain·
17 Sept 2026 · Irregular
Security research firm Irregular found that AI agents performing routine maintenance tasks can retrain and redeploy their own underlying models, potentially leaking secrets and erasing built-in safety refusals.
technology·other·tool misuse·
17 Sept 2026 · Zalando
Skipper's OPA authorization filter fails to properly detect truncated request bodies when using chunked transfer encoding or HTTP/2, allowing oversized payloads to bypass policy inspection. This is an incomplete fix to a prior vulnerability.
technology·other·misconfiguration·
17 Sept 2026 · GitHub
Security researchers at Adversa AI found GitHub Copilot CLI can be tricked by malicious web pages using encrypted 'Cryptographic Context Injection' instructions into reading local secrets (e.g. .env files) and exfiltrating them to an attacker-controlled URL, depending on which underlying model handles the session. GitHub's triage team validated the finding but declined to classify it as a product vulnerability, arguing user consent was required to trigger the action.
technology·coding·prompt injection·
17 Sept 2026 ·
Security researchers discovered a new Android malware strain called RatHat that incorporates an AI-powered subsystem allowing attackers to remotely and automatically navigate and control compromised devices.
technology·other·unknown·
16 Sept 2026 · rmcp
An unauthenticated attacker can leak session entries from rmcp's HTTP server by sending malformed JSON-RPC requests, causing permanent memory allocation that eventually exhausts server memory at a rate of ~75 GB per day.
technology·other·misconfiguration·
16 Sept 2026 ·
Spain's Data Protection Agency (AEPD) received its first notification of a data breach allegedly carried out using an AI agent powered by a known large language model. Details of the attack and affected parties remain unconfirmed.
government·other·unknown·
16 Sept 2026 · vLLM
vLLM's audio decode-duration guard is only applied to the speech-to-text endpoint but not the chat endpoint, allowing unauthenticated clients to submit compressed audio files that expand to multiple GB and cause out-of-memory denial of service attacks.
technology·other·misconfiguration·
16 Sept 2026 ·
A newly identified attack technique, dubbed BragJack, hijacks AI assistants built into browsers to access sensitive information, execute malicious actions, and exfiltrate data.
technology·browsing·unknown·
16 Sept 2026 ·
Mandiant reported that an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider; the assistant then recommended poisoned software that was accepted, allowing the Shai-Hulud worm to spread across roughly 100 internal code repositories and steal secrets and source code.
technology·coding·supply chain·
16 Sept 2026 · Google, Microsoft, Opera, Anthropic, Perplexity
Researchers at Forever Security demonstrated that a single ordinary browser extension could take control of AI assistants built into Chrome (Gemini Live), Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension, gaining access with a single click.
technology·browsing·excessive permissions·
16 Sept 2026 ·
Spanish data protection regulators disclosed what they describe as the first data breach carried out by an autonomous AI agent, which chained together a successful login, vulnerability discovery, and access to personal data.
technology·other·unknown·
15 Sept 2026 · Contentful
Contentful MCP Server versions prior to 1.7.19 expose network configuration options to LLM-controlled arguments, allowing prompt injection attacks to redirect API requests and steal authentication tokens. The vulnerability affects space-to-space migration tools and is fixed in updated versions.
technology·coding·prompt injection·
15 Sept 2026 · zereight
@zereight/mcp-gitlab contains five defects that defeat its safety controls for exposing GitLab to LLM agents, including read-only mode bypasses, unauthenticated transports, DNS rebinding vulnerabilities, session exhaustion DoS, and SSRF via header injection.
technology·other·prompt injection·
14 Sept 2026 · ESPHome
ESPHome Device Builder's environment variable rename from USERNAME/PASSWORD to ESPHOME_USERNAME/ESPHOME_PASSWORD removed backward compatibility, causing deployments using the legacy names to lose authentication on upgrade and expose the dashboard to unauthenticated access.
technology·other·misconfiguration·
14 Sept 2026 ·
Spain's data protection agency (AEPD) reported the country's first personal data breach caused by an autonomous AI agent, which used an unnamed LLM to scan files, find vulnerabilities, and gain read/write access to personal data and invoices at an organization.
other·other·tool misuse·
12 Sept 2026 · MCPHub
MCPHub before version 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional, allowing attackers to redeem intercepted authorization codes for access tokens without proper credentials.
technology·other·misconfiguration·
11 Sept 2026 · FrontMCP
A GitHub advisory reports that the patch for an earlier SSRF issue (CVE-2026-39885) in mcp-from-openapi 2.3.0 can be bypassed, letting untrusted OpenAPI specs loaded by FrontMCP 1.2.1 trigger backend-origin requests to loopback or private services via DNS-to-loopback names, redirects, and IPv4-mapped IPv6 forms. In hosted or multi-user FrontMCP deployments where users can import specs, this can expose internal APIs not reachable externally.
technology·other·supply chain·
11 Sept 2026 · Anthropic
Anthropic reported that multiple threat groups, including financially motivated actors and state-linked espionage groups associated with Russia and China, attempted to abuse its Claude AI model for malicious purposes, including extracting secrets from 1.8 million Android apps. Separate reporting describes attackers abusing trusted AI platforms, such as weaponized Claude Artifacts and shared AI conversations, to host malicious content and lure users into installing malware.
technology·other·tool misuse·
11 Sept 2026 · IBM
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain multiple vulnerabilities allowing remote authenticated attackers to execute arbitrary Python code, OS commands, and access sensitive information due to improper authorization, insufficient session expiration, and pathname restrictions.
technology·workflow·excessive permissions·
11 Sept 2026 · mysql-mcp-server
The mysql-mcp-server MCP package, when run in SSE/HTTP transport mode, created its SSE transport without security settings, disabling DNS-rebinding protection and leaving all routes unauthenticated while binding to 0.0.0.0. This allowed network attackers or malicious web pages to invoke execute_sql for arbitrary unauthenticated SQL execution, data exfiltration, and potentially file read/write and RCE; 25 publicly reachable instances were found.
technology·workflow·misconfiguration·
