Incident database
Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
| Incident date | Incident | Vendor | Sector | Agent | Root cause | Severity | Status |
|---|---|---|---|---|---|---|---|
| 25 Aug 2026 | CVE-2026-55529: PraisonAI Origin Validation Bypass | MervinPraison | technology | workflow | misconfiguration | resolved | |
| 24 Aug 2026 | Continue CLI incomplete denylist allows destructive commands | Continue | technology | workflow | prompt injection | reported | |
| 21 Aug 2026 | Spring AI MCP Streamable HTTP server memory exhaustion DoS | Spring | technology | other | misconfiguration | reported | |
| 21 Aug 2026 | Infracost symlink traversal and token disclosure vulnerabilities | Infracost | technology | coding | tool misuse | resolved | |
| 20 Aug 2026 | LangBot MCP Server RCE via Insufficient Authorization | LangBot | technology | coding | excessive permissions | reported | |
| 20 Aug 2026 | AI Agent by SiteGround WordPress plugin authorization bypass | SiteGround | technology | coding | excessive permissions | reported | |
| 20 Aug 2026 | Neo.mjs command injection in FileSystemService.mjs | Neo.mjs | technology | coding | tool misuse | resolved | |
| 20 Aug 2026 | LangChain SitemapLoader SSRF bypass via nested sitemap entries | LangChain | technology | other | excessive permissions | reported | |
| 19 Aug 2026 | marimo Code Injection via MCP Server Configuration | marimo-team | technology | coding | prompt injection | confirmed | |
| 19 Aug 2026 | Splunk AI Toolkit privilege escalation and MCP Server command execution | Splunk | technology | coding | excessive permissions | reported | |
| 19 Aug 2026 | Agno PythonTools path traversal vulnerability CVE-2026-76832 | Agno | technology | coding | prompt injection | reported | |
| 18 Aug 2026 | CodeWhale Multiple Vulnerabilities in Versions 0.8.41-0.8.63 | CodeWhale | technology | coding | prompt injection | resolved | |
| 18 Aug 2026 | CVE-2026-75130: Context7 prompt injection via Custom AI Instructions | Context7 | technology | coding | prompt injection | reported | |
| 18 Aug 2026 | Command Injection and SSRF Vulnerabilities in Microsoft Copilot | Microsoft | technology | coding | prompt injection | reported | |
| 18 Aug 2026 | Apify MCP Server API Token Exposure via URL Redirection | Apify | technology | coding | prompt injection | resolved | |
| 18 Aug 2026 | ArcadeDB authorization bypass in set_server_setting MCP tool | ArcadeData | technology | other | excessive permissions | resolved | |
| 17 Aug 2026 | MemOS Authentication Bypass via Unset Internal Service Secret | MemTensor | technology | other | misconfiguration | reported | |
| 17 Aug 2026 | CVE-2026-19984: SSRF in jkawamoto mcp-florence2 | jkawamoto | technology | other | tool misuse | confirmed | |
| 17 Aug 2026 | MLflow multiple vulnerabilities in versions prior to 3.15.0 | MLflow | technology | other | excessive permissions | resolved | |
| 14 Aug 2026 | CVE-2026-49986: Cortex MCP Arbitrary Code Execution via Environment Variable | Cortex | technology | coding | misconfiguration | confirmed | |
| 14 Aug 2026 | mcp-memory-service authentication bypass in document endpoints | mcp-memory-service | technology | other | misconfiguration | confirmed | |
| 14 Aug 2026 | MindsDB Minds Platform unauthenticated RCE via scratchpad tool | MindsDB | technology | coding | excessive permissions | reported | |
| 14 Aug 2026 | Multiple vulnerabilities in CKAN MCP Server prior to 0.4.112 | ondata | technology | other | misconfiguration | resolved | |
| 13 Aug 2026 | AgenticSeek unauthenticated remote code execution vulnerability | Fosowl | technology | other | excessive permissions | reported | |
| 13 Aug 2026 | CVE-2026-19753: SSRF in mcp-rdf-explorer | Model Context Protocol | technology | other | tool misuse | reported | |
| 13 Aug 2026 | Flowise code injection vulnerabilities in Agent nodes | Flowise | technology | workflow | prompt injection | confirmed | |
| 13 Aug 2026 | @jshookmcp/jshook SSRF bypass via ICMP and traceroute tools | jshookmcp | technology | other | excessive permissions | resolved | |
| 13 Aug 2026 | auth-fetch-mcp SSRF Protection Bypass via IPv6 Loopback | ymw0407 | technology | other | misconfiguration | resolved | |
| 13 Aug 2026 | Server-Side Request Forgery in mcp-dominican-layer | EnzoVezzaro | technology | other | tool misuse | reported | |
| 13 Aug 2026 | Multiple vulnerabilities in Trigger.dev platform | Trigger.dev | technology | workflow | misconfiguration | resolved | |
| 13 Aug 2026 | HCL AION Indirect Prompt Injection Leading to HTML Injection | HCL | technology | other | prompt injection | confirmed | |
| 12 Aug 2026 | MCP Atlassian arbitrary file read vulnerability | Atlassian | technology | other | excessive permissions | resolved | |
| 11 Aug 2026 | CVE-2026-19516: Server-side request forgery in mcp-grafana | Grafana | technology | coding | misconfiguration | confirmed | |
| 11 Aug 2026 | PapersGPT for Zotero RCE via unsanitized LLM response | PapersGPT | technology | other | prompt injection | reported | |
| 11 Aug 2026 | OS Command Injection in GitHub Copilot and Visual Studio Code | Microsoft | technology | coding | tool misuse | reported | |
| 11 Aug 2026 | ToolJet authorization bypass allows cross-organization data access | ToolJet | technology | workflow | excessive permissions | resolved | |
| 11 Aug 2026 | Cursor IDE macOS sandbox escapes in Auto-Run mode | Cursor | technology | coding | excessive permissions | resolved | |
| 11 Aug 2026 | n8n MCP Client SSRF Protection Bypass | n8n | technology | workflow | misconfiguration | confirmed | |
| 10 Aug 2026 | CVE-2026-72718: Goose AI agent arbitrary command execution via Git config | AAIF | technology | coding | misconfiguration | resolved | |
| 9 Aug 2026 | CVE-2026-19337: Server-side request forgery in mcp-google-search | adenot | technology | other | tool misuse | confirmed | |
| 8 Aug 2026 | CVE-2026-19263: Command injection in INQUIRELAB mcp-bridge-api | INQUIRELAB | technology | other | tool misuse | reported | |
| 8 Aug 2026 | AI Copilot Content Generator WordPress Plugin Authorization Bypass | AI Copilot | technology | workflow | excessive permissions | reported | |
| 7 Aug 2026 | Meta Ads MCP Authentication Bypass and Token Leakage | Meta | technology | workflow | misconfiguration | resolved | |
| 6 Aug 2026 | CVE-2026-19040: Server-side request forgery in MissionSquad mcp-api | MissionSquad | technology | other | tool misuse | resolved | |
| 6 Aug 2026 | CVE-2026-19039: Command injection in Kino-Kafkaesque ssh-mcp-server | Kino-Kafkaesque | technology | workflow | tool misuse | disputed | |
| 6 Aug 2026 | Multiple authorization vulnerabilities in Microsoft Copilot products | Microsoft | technology | coding | excessive permissions | reported | |
| 5 Aug 2026 | FrontMCP Sandbox Escape via Zod Schema Proxy Invariant | AgentFront | technology | coding | excessive permissions | confirmed | |
| 5 Aug 2026 | IBM Langflow OSS Multiple Vulnerabilities CVE-2026-17623 et al. | IBM | technology | coding | excessive permissions | reported | |
| 4 Aug 2026 | Flowise supply chain and prompt injection vulnerabilities | FlowiseAI | technology | workflow | supply chain | resolved | |
| 3 Aug 2026 | Ouroboros AI coding agent local code execution via .env loading | Q00 | technology | coding | misconfiguration | resolved |