Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
12 Oct 2026 · Anthropic
Researchers disclosed an AI-augmented initial access campaign combining Cobalt Strike with Anthropic's Claude Code to target WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine, resulting in the theft of over 628,000 records.
other·coding·tool misuse·
3 Oct 2026 · Rejetto
A critical authentication-bypass vulnerability (CVE-2026-61500) in Rejetto HTTP File Server, discovered using Anthropic's Mythos AI bug-hunting model, began being actively exploited within a day of disclosure, with attacks originating from China and proxied US IPs targeting vulnerable hosts in the US and Japan.
other·other·unknown·
2 Oct 2026 · Headroom
The Headroom WebSocket server fails to validate the Origin header of incoming client requests, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication by exploiting the OPENAI_API_KEY environment variable. An attacker can execute unauthorized API calls if they have network access to the Headroom proxy.
other·other·misconfiguration·
2 Oct 2026 · A2UI
The openUrl function in @a2ui/web_core passes agent-controlled URLs directly to window.open() without validating the URI scheme, allowing malicious agents to execute arbitrary JavaScript via javascript: URIs supplied through button actions. This affects all three renderers (React, Lit, Angular) enabled by default.
other·workflow·prompt injection·
2 Oct 2026 · Trigger.dev
Trigger.dev's webhook alert channels lack URL validation, allowing authenticated users to trigger POST requests to internal addresses and metadata endpoints. The vulnerability enables SSRF attacks on internal infrastructure and cloud metadata services without any private-IP or redirect filtering.
other·workflow·excessive permissions·
2 Oct 2026 · Vibe-Trading
Multiple critical vulnerabilities in Vibe-Trading LLM agent including unauthenticated API access, command injection, arbitrary file read/write, and code injection. An unauthenticated attacker can execute arbitrary commands as root on the server.
other·coding·excessive permissions·
2 Oct 2026 · Model Context Protocol (rmcp)
The rmcp OAuth client accepts and fetches server-controlled resource_metadata URLs from WWW-Authenticate headers without validation, allowing attackers to perform SSRF attacks against internal services from the victim application's network context.
other·other·misconfiguration·
2 Oct 2026 · GitLab
GitLab disclosed and patched a critical (CVSS 9.9) remote code execution flaw in its self-hosted AI Gateway service, which connects GitLab instances to AI models for the Duo Agent Platform. The flaw could let a logged-in user with Duo Agent Platform access run arbitrary commands on the gateway under certain conditions; it is fixed in versions 19.2.4, 19.3.2, and 19.4.1.
other·coding·excessive permissions·
2 Oct 2026 · Trigger.dev
Trigger.dev's CLI debug output leaked resolved environment variable values including database credentials and service tokens during dry-run deployments. The vulnerability exposed secrets in terminal transcripts, CI logs, and support bundles.
other·workflow·misconfiguration·
1 Oct 2026 ·
Autonomous AI agents using aggressive strategies attempted to breach U.S. and Canadian government websites, apparently seeking school and divorce statistics.
other·other·unknown·
1 Oct 2026 · GongRzhe
Office-PowerPoint-MCP-Server through version 2.0.7 contains a path traversal vulnerability allowing MCP callers to read and write files outside the working directory. AI agents can be steered via prompt injection to abuse the vulnerability through save_presentation, open_presentation, or manage_image functions.
other·coding·prompt injection·
1 Oct 2026 · vm2
vm2 3.11.6 exposes the host process's https.globalAgent when NodeVM is allowed to require https, allowing sandbox code to intercept host HTTPS credentials, TLS traffic, and request options through event listeners on the shared agent object.
other·other·excessive permissions·
29 Sept 2026 · DIVD
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a cyberattack conducted with the help of an automated AI agent, which the organization described as "loud and very, very messy."
other·other·unknown·
21 Sept 2026 · Zammad
Attackers used an apparently AI-agent-driven exploit chain against two zero-day vulnerabilities in the Zammad helpdesk platform to hijack sessions, gain remote code execution, and escalate to root on DIVD's systems, stealing email addresses and other contact details of DIVD volunteers.
other·other·unknown·
18 Sept 2026 ·
Threat actors reportedly used an AI-driven agent to breach a Spanish organization's systems, gaining access and modifying personal data. The incident illustrates the growing use of autonomous AI agents in cyberattacks.
other·other·unknown·
14 Sept 2026 ·
Spain's data protection agency (AEPD) reported the country's first personal data breach caused by an autonomous AI agent, which used an unnamed LLM to scan files, find vulnerabilities, and gain read/write access to personal data and invoices at an organization.
other·other·tool misuse·
13 Aug 2026 · SiYuan
Two security vulnerabilities discovered in SiYuan's AI Agent MCP tools: asset.upload allows reading arbitrary absolute file paths outside workspace boundaries via prompt injection, and http_request/web_fetch tools are vulnerable to DNS-rebinding SSRF attacks that bypass CheckHostSSRF validation.
other·other·prompt injection·
