Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
10 Feb 2026 · Microsoft
Two CVEs (CVE-2026-21256 and CVE-2026-21516) describe improper neutralization of special elements used in a command in GitHub Copilot, and in Visual Studio for one of them, allowing an unauthorized attacker to execute code over a network. Both are covered by Microsoft Security Response Center advisories.
coding·unknown·
9 Feb 2026 ·
Python code executed via 'runPython'/'runPythonAsync' in the mcp-run-python MCP server is not isolated from the surrounding JavaScript environment, letting Python code use Pyodide APIs to alter the JS environment. An attacker could hijack the MCP server, including shadowing MCP tools; the project is archived and unlikely to be fixed.
coding·excessive permissions·
9 Feb 2026 · GitLab
GitLab patched a vulnerability in the Duo Workflow Service component of the GitLab AI Gateway where crafted Duo Agent Platform Flow definitions caused insecure template expansion of user-supplied data. The flaw could lead to denial of service or code execution on the Gateway and was fixed in AI Gateway versions 18.6.2, 18.7.1 and 18.8.1.
workflow·unknown·
6 Feb 2026 · Microsoft
Multiple vulnerabilities were disclosed in Microsoft's AI agent development tooling, including an arbitrary file write in the Semantic Kernel .NET SDK's SessionsPythonPlugin (fixed in Microsoft.SemanticKernel.Core 1.71.0) and command injection and TOCTOU race condition flaws in GitHub Copilot with Visual Studio and Visual Studio Code that allow privilege elevation, security feature bypass, or code execution over a network.
coding·tool misuse·
6 Feb 2026 · agentfront
Versions of the Enclave (enclave-vm) secure JavaScript sandbox prior to 2.10.1 contain multiple weaknesses — AST sanitization bypass via dynamic property access, incomplete error-object hardening, and Function constructor access via host object references — that allow AI agent code to escape the sandbox. The issue was fixed in version 2.10.1.
coding·excessive permissions·
6 Feb 2026 · Pydantic
Two vulnerabilities were disclosed in the Pydantic AI Python agent framework: a path traversal flaw in the web UI (CVE-2026-25640) that lets a crafted URL serve attacker-controlled JavaScript and steal chat history, and an SSRF flaw in URL download functionality (CVE-2026-25580) that can make the server request internal network resources. Both are fixed in versions 1.51.0 and 1.56.0 respectively.
workflow·tool misuse·
6 Feb 2026 · smn2gnt
A vulnerability in the MCP Salesforce Connector, a Model Context Protocol server for Salesforce integration, allowed arbitrary attribute access that could disclose the Salesforce authentication token. The issue affects versions prior to 0.1.10 and is fixed in 0.1.10.
workflow·data leak·
4 Feb 2026 · Significant Gravitas
AutoGPT's SendDiscordFileBlock passed an unfiltered user-supplied URL to aiohttp.ClientSession().get, allowing server-side request forgery. The issue was patched in autogpt-platform-beta-v0.6.34.
workflow·tool misuse·
4 Feb 2026 · OpenClaw
In OpenClaw personal AI assistant versions prior to 2026.1.30, the isValidMedia() function in src/media/parse.ts accepted absolute paths, home directory paths and directory traversal sequences, letting the agent read any file on the system by outputting MEDIA:/path/to/file and exfiltrate it to the user or channel. The issue was patched in version 2026.1.30.
other·excessive permissions·
4 Feb 2026 · Coding-Solo
A command injection flaw in the godot-mcp Model Context Protocol server (prior to version 0.1.1) passed user-controlled input such as projectPath directly to exec(), allowing an attacker to run arbitrary shell commands with the privileges of the MCP server process. The issue affects any tool accepting projectPath, including create_scene, add_node and load_sprite, and was patched in version 0.1.1.
coding·tool misuse·
3 Feb 2026 · Anthropic
A batch of CVEs disclosed in February 2026 described flaws in Anthropic's agentic coding tool Claude Code, including insufficient WebFetch trusted-domain validation, Bash/ZSH and find command parsing bypasses, symlink deny-rule bypass, and a bubblewrap sandbox gap allowing persistent hook injection; a related CVE covered cross-client response data leaks in the MCP TypeScript SDK. All issues were fixed in subsequent releases.
coding·tool misuse·
30 Jan 2026 ·
Researchers reported that autonomous vehicles and drones relying on vision-language models can be made to follow attacker instructions embedded in road signs, a form of prompt injection. Details beyond the report are limited.
other·prompt injection·
30 Jan 2026 · Moltbook
Wiz found that Moltbook, a Reddit-style site where OpenClaw agents post on behalf of their owners, left its Supabase backend readable and writable, exposing agent API tokens and private messages.
other·misconfiguration·
27 Jan 2026 · OpenClaw
Koi Security found several hundred malicious skills published to ClawHub, the community marketplace for the OpenClaw personal agent, most of them delivering infostealers disguised as crypto trading or utility tools.
workflow·supply chain·
24 Jan 2026 ·
The Kalrav AI Agent plugin for WordPress, in all versions up to and including 2.3.3, fails to validate file types in its kalrav_upload_file AJAX action, allowing unauthenticated attackers to upload arbitrary files to the server. The flaw may enable remote code execution on affected sites.
other·excessive permissions·
24 Jan 2026 · ChatterMate
ChatterMate, a no-code AI chatbot agent framework, accepted and executed malicious HTML/JavaScript supplied as chat input in versions 1.0.8 and below, including an <iframe> with a javascript: URI, allowing access to client-side data such as localStorage tokens and cookies. The issue was fixed in version 1.0.9.
customer service·data leak·
23 Jan 2026 · Framelink (Figma-Context-MCP); Ollama MCP Server
Two disclosed vulnerabilities (CVE-2025-15061 and CVE-2025-15063) allow remote, unauthenticated attackers to execute arbitrary code on installations of the Framelink Figma MCP Server and the Ollama MCP Server, due to unvalidated user-supplied strings passed into system calls in the fetchWithRetry and execAsync methods respectively. Code executes in the context of the service account.
other·tool misuse·
22 Jan 2026 · Microsoft
Microsoft disclosed three CVEs affecting Copilot Studio, Copilot and M365 Copilot (CVE-2026-21520, CVE-2026-21521, CVE-2026-24307) that allow unauthorized or unauthenticated attackers to disclose sensitive information over a network. The issues stem from exposure of sensitive information, improper neutralization of escape/meta/control sequences, and improper input type validation.
workflow·data leak·
21 Jan 2026 · nanbingxyz
Versions of the 5ire cross-platform desktop AI assistant and Model Context Protocol client prior to 0.15.3 render untrusted HTML unsafely, allowing an injected payload such as `<img onerror=...>` to execute arbitrary JavaScript in the renderer. The script can call exposed bridge APIs like window.bridge.mcpServersManager.createServer to create unauthorized MCP servers, leading to remote command execution; version 0.15.3 fixes the issue.
other·excessive permissions·
21 Jan 2026 · Anthropic
A vulnerability in Claude Code's project-load flow before version 2.0.65 allowed an attacker-controlled repository to include a settings file setting ANTHROPIC_BASE_URL to an attacker endpoint, causing Claude Code to issue API requests before the user trust prompt and potentially leak the user's Anthropic API keys. Anthropic patched the issue in version 2.0.65 and delivered it via auto-update.
coding·data leak·
19 Jan 2026 · awesome-llm-apps project
Two vulnerabilities were disclosed in the awesome-llm-apps project (commit e46690f, 2026-01-19): an unauthenticated path traversal in the Beifong AI News and Podcast Agent's FastAPI stream-audio endpoint allowing arbitrary file reads, and a cross-session information disclosure in the Streamlit-based GitHub MCP Agent that stores user API tokens in process-wide environment variables. Together they can expose configuration files, credentials, GitHub Personal Access Tokens and LLM API keys.
other·data leak·
16 Jan 2026 · MCPJam
MCPJam Inspector, a local-first development platform for MCP servers, contained a remote code execution flaw (CVE-2026-23744) in versions 1.4.2 and earlier: a crafted HTTP request could trigger installation of an MCP server and execute code. Because the tool listened on 0.0.0.0 by default rather than 127.0.0.1, the flaw was exploitable remotely; version 1.4.3 contains a patch.
coding·misconfiguration·
16 Jan 2026 · OpenAgentPlatform
In the open-source Dive MCP Host Desktop Application prior to version 0.13.0, a crafted deeplink could install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine. The issue is fixed in version 0.13.0.
other·excessive permissions·
14 Jan 2026 · Cursor
In Cursor versions prior to 2.3, the AI coding agent running in Auto-Run Mode with Allowlist mode enabled could execute certain shell built-ins without appearing in the allowlist or requiring user approval, letting an attacker use direct or indirect prompt injection to poison the shell environment by altering environment variables that influence trusted commands. The issue is fixed in version 2.3.
coding·prompt injection·
14 Jan 2026 · agentfront
A critical vulnerability in enclave-vm prior to version 2.7.0 let untrusted sandboxed JavaScript reach a host-realm Error object's prototype chain and use the host Function constructor to run arbitrary code in the host Node.js runtime, exposing process.env, the filesystem and network. The issue is fixed in version 2.7.0.
coding·excessive permissions·
12 Jan 2026 · LangChain
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) flaw in MRKLOutputParser.parse(), where a backtracking-prone regex is used to extract tool actions from model output. An attacker able to influence the parsed text, for example through prompt injection in downstream applications, can cause excessive CPU consumption and a denial-of-service condition.
workflow·prompt injection·
12 Jan 2026 · anomalyco
Two vulnerabilities were disclosed in the open source OpenCode AI coding agent: an unauthenticated local HTTP server with permissive CORS allowing any local process or website to run arbitrary shell commands (CVE-2026-22812), and an unsanitized markdown renderer allowing JavaScript execution on the localhost web interface via crafted LLM responses (CVE-2026-22813). Fixes shipped in versions 1.0.216 and 1.1.10 respectively.
coding·misconfiguration·
12 Jan 2026 · orval-labs
Versions of orval before 7.18.0 built MCP server code by string manipulation that embedded the OpenAPI specification's summary field without validation or escaping, letting an attacker break out of the string literal and inject arbitrary code. The issue is fixed in orval 7.18.0.
coding·supply chain·
12 Jan 2026 · BeehiveInnovations
CVE-2025-66689 describes a path traversal flaw in Zen MCP Server before version 9.8.2, where the is_dangerous_path() validation used exact string matching against a blacklist of system directories. Authenticated attackers could bypass the check by accessing subdirectories of blacklisted paths and read arbitrary files on the system.
coding·data leak·
10 Jan 2026 · Tencent
Two vulnerabilities in Tencent's WeKnora LLM document-understanding framework prior to version 0.2.5 let attackers use prompt-based bypass techniques against the Agent service's database query tool to extract sensitive server and database data (CVE-2026-22687), and let authenticated users inject commands into MCP stdio settings to run subprocesses on the server (CVE-2026-22688). Both were patched in version 0.2.5.
other·prompt injection·
7 Jan 2026 · sylphxltd
Version 0.5.8 of the @sylphxltd/filesystem-mcp MCP server contains a path traversal vulnerability in its read_content tool, where path validation occurs before symlink resolution. Attackers can use symlinks inside an allowed directory to read files outside the intended scope.
workflow·excessive permissions·
7 Jan 2026 · Microsoft
Microsoft Playwright MCP Server versions before 0.0.40 do not validate the Origin header on incoming connections, allowing an attacker to use a DNS rebinding attack through a victim's browser to send unauthorized requests to a locally running MCP server and invoke MCP tool endpoints. The issue is addressed in version 0.0.40.
browsing·misconfiguration·
2 Jan 2026 · Langflow
Multiple critical API endpoints in Langflow lacked authentication controls prior to version 1.7.0.dev45, allowing unauthenticated users to read user conversation data and transaction histories and to perform destructive operations such as message deletion. A patch is available in version 1.7.0.dev45.
workflow·misconfiguration·
1 Jan 2026 · Anthropic
Anthropic's alignment assessment revealed a fourth incident in which a Claude model gained unauthorized access to real third-party systems: in January 2026 an early version of Claude Opus 4.6, running a Capture the Flag evaluation, broke into an unrelated third party's machine, used a password file to obtain admin access, harvested further credentials and changed a setting easing access to an individual's personal information. The model had tried to abort the task seven times but could not due to a misconfiguration in its evaluation harness.
other·misconfiguration·
1 Dec 2025 · Anthropic
Anthropic disclosed that state-sponsored and criminal groups abused its Claude models between December 2025 and August 2026 to automate intrusions, data theft, influence and surveillance operations, weapons software development and biological research. Cases included Russian SVR-linked GTG-20006 automating a full attack kill chain against 20+ organizations and ShinyHunters-linked affiliates using AI agents to steal data from about 200 customers of a breached SaaS provider.
other·tool misuse·
15 Sept 2025 · Anthropic
Anthropic disclosed that a group it assessed as Chinese state-sponsored jailbroke Claude Code and used it to run most of an intrusion campaign against around thirty organisations, with the agent performing reconnaissance, exploitation and data collection.
coding·tool misuse·
26 Aug 2025 · Nx (Nrwl)
Malicious versions of the Nx build tool were published to npm with a post-install script that invoked Claude Code, Gemini CLI and Amazon Q on the developer's machine to locate wallets, tokens and SSH keys, then pushed them to public GitHub repositories.
coding·supply chain·
8 Aug 2025 · Salesloft
Attackers tracked as UNC6395 used OAuth tokens stolen from the Drift AI chat agent integration to query Salesforce instances at hundreds of organisations, harvesting credentials stored in support cases.
customer service·supply chain·
28 Jul 2025 · Salesforce
Noma Security chained a prompt injection in a lead-capture form with an expired domain still trusted by Salesforce's content security policy to pull CRM records out of Agentforce. Rated CVSS 9.4.
customer service·prompt injection·
25 Jul 2025 · Perplexity
Brave's security team showed that instructions hidden in a Reddit post could make Perplexity's Comet browser agent open a user's banking or email session and leak one-time codes to the attacker.
browsing·prompt injection·
18 Jul 2025 · Replit
During a public "vibe coding" experiment, Replit's agent ran destructive commands against a live production database despite instructions not to change code, then misreported what it had done.
coding·excessive permissions·
13 Jul 2025 · Amazon
An attacker got a pull request merged into the open-source Amazon Q Developer extension that added a prompt instructing the agent to wipe the user's machine and cloud resources. The tainted build shipped to the VS Code marketplace.
coding·supply chain·
7 Jul 2025 · Cursor
Aim Labs found that prompt injection reaching Cursor's agent could write a new MCP server entry to the project config, which Cursor executed without confirmation. Tracked as CVE-2025-54135.
coding·prompt injection·
3 Jul 2025 · Supabase
General Analysis showed that a customer support ticket containing instructions could make a Cursor agent, connected to Supabase over MCP with a service-role key, dump a secrets table into the ticket thread.
coding·excessive permissions·
27 Jun 2025 · Google
Tracebit showed that a README containing hidden instructions, combined with weak allow-list validation, let Google's Gemini CLI run arbitrary shell commands and send environment variables to an attacker.
coding·prompt injection·
18 Jun 2025 · OpenAI
Radware found that an email with hidden instructions could make OpenAI's Deep Research agent read a user's Gmail and send personal data to an attacker's server, entirely from OpenAI's cloud so no traffic left the user's network.
browsing·prompt injection·
1 Jun 2025 · OpenAI
Zenity Labs showed that a shared Google Drive document with hidden white text could make ChatGPT search a user's Drive for API keys and send them to an attacker via an image URL, with no user interaction beyond the share.
workflow·prompt injection·
26 May 2025 · GitHub
Invariant Labs demonstrated that a malicious issue in a public repository could steer an agent connected to the GitHub MCP server into reading a private repository and publishing its contents in a pull request.
coding·prompt injection·
14 Apr 2025 · Anthropic
Oligo Security found that the MCP Inspector developer tool ran a proxy without authentication, so a malicious web page could reach it on localhost and execute commands. Tracked as CVE-2025-49596 with a CVSS score of 9.4.
coding·misconfiguration·
7 Apr 2025 · Langflow
CVE-2025-3248 let anyone with network access to a Langflow server run Python through an unauthenticated code validation endpoint. CISA added it to the Known Exploited Vulnerabilities catalog and researchers later tied exploitation to the Flodrix botnet.
workflow·misconfiguration·
