Structured records of AI agent security incidents: what happened, which vendor and agent type, the root cause, and every source we used. Filter, browse, or download as CSV.
15 Oct 2026 · IntentKit
IntentKit through version 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full registry instead of narrowed per-request tool advertisement, allowing unauthenticated callers to execute owner-restricted capabilities like wallet transfers and memory writes through prompt injection or checkpoint replay.
technology·other·excessive permissions·
15 Oct 2026 · 0xJacky
Three authenticated vulnerabilities in Nginx UI's MCP interface allow secondary users to bypass directive validation, execute arbitrary code via NJS in Nginx worker context, and circumvent OTP secure-session step-up requirements. The MCP configuration tools lack the same validation checks present in the HTTP API.
technology·other·excessive permissions·
15 Oct 2026 · Nezha
A low-privilege member can crash the entire Nezha dashboard by racing a service delete with a monitoring result write, causing a nil pointer dereference that kills the process and takes all tenants' web UI, REST API, and agent connections offline.
technology·other·tool misuse·
15 Oct 2026 · DataStax
A critical authenticated remote code execution vulnerability (CVE-2026-105740, CVSS 9.9) in the open-source Langflow AI workflow platform is being actively targeted, with 1,423 exploit attempts recorded via honeypots according to security firm Previdian.
technology·workflow·unknown·
15 Oct 2026 · TypeSafe AI
Security firm HiddenLayer demonstrated that TypeSafe AI's Jev 'decision model' and a tuned Qwen3.8-27B model can both be manipulated via indirect prompt injection, hijacking a browser agent's checkout actions in a simulated online store and bypassing prompt verification using a tokenbreak-style attack.
technology·browsing·prompt injection·
15 Oct 2026 · Anthropic
The MCP Python SDK's Streamable HTTP transport in stateful mode (default) failed to reclaim session state, allowing clients to exhaust server memory through unlimited session creation. Sessions did not expire, DELETE requests left entries registered, and refused sessions remained active indefinitely.
technology·other·misconfiguration·
15 Oct 2026 · Signals Corps
Security firm Signals Corps analyzed 217 million HTTP page responses and found about 30 sites embedding indirect prompt-injection attempts in custom headers aimed at AI agents, mostly low-effort pranks with negligible real-world effect.
technology·browsing·prompt injection·
13 Oct 2026 · Roo Code Inc
Multiple command approval bypass vulnerabilities discovered in Roo Code through version 3.54.0 allow attackers to execute denied shell commands through indirect prompt injection by exploiting parsing flaws in the auto-approval mechanism. These include bypasses via redirect operators, quote masking, command substitution, glob patterns, and command position attacks.
technology·coding·prompt injection·
12 Oct 2026 · cfdude
mac-shell-mcp before version 2.0.0 contains an OS command injection vulnerability allowing MCP clients to bypass command whitelist restrictions by injecting shell metacharacters into execute_command arguments, enabling execution of forbidden commands.
technology·other·prompt injection·
12 Oct 2026 · 0xJacky
Nginx UI versions prior to 2.4.1 contain a security control bypass in the MCP nginx_config_add tool, allowing authenticated MCP callers or agents induced via prompt injection to inject dangerous directives and achieve code execution on affected deployments.
technology·other·prompt injection·
11 Oct 2026 · Abilityai
Abilityai Trinity through version 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform operations restricted to human users. Attackers controlling an agent via prompt injection can send messages through the owner's bot token, replace bindings, or delete them.
technology·other·prompt injection·
10 Oct 2026 · zotero-mcp
zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery vulnerability in the _fetch_embedded_metadata function that lacks destination validation. Attackers can use prompt injection to steer agents into calling zotero_add_by_url to reach internal services and leak sensitive information.
technology·browsing·prompt injection·
10 Oct 2026 · SWE-agent
mini-swe-agent versions 1.10.0 through 2.4.6 expose host environment variables including API keys to sandboxed commands due to missing --clearenv flag in Bubblewrap, allowing attackers to exfiltrate credentials via prompt injection.
technology·coding·prompt injection·
10 Oct 2026 · Pulse AI Club / Open Multi Agent
Two AI agent frameworks contain improper link resolution vulnerabilities allowing attackers to bypass workspace write restrictions through symlink exploitation and prompt injection, enabling unauthorized file writes outside the workspace.
technology·coding·prompt injection·
8 Oct 2026 · GitHub
The GhostAction credential-theft campaign compromised roughly 1,900 GitHub accounts and targeted over 30,000 repositories across 3,000 users and organizations, attempting to extract 3,174 secrets from public repositories' CI pipelines.
technology·other·supply chain·
8 Oct 2026 · AWS
A now-patched vulnerability in AWS Bedrock AgentCore, dubbed 'AgentCorruption', could have let an attacker use a single malicious prompt against one AI chatbot to compromise an organization's entire AWS agent fleet.
technology·workflow·prompt injection·
8 Oct 2026 · mechanize
The mechanize Ruby library leaked HTTP credentials to redirect targets on different hosts when credentials were set via request_headers or per-request headers, exposing bearer tokens and session cookies.
technology·other·misconfiguration·
8 Oct 2026 · Banks
A vulnerability in Banks' Prompt.chat_messages() method allows user-controlled template data to be parsed as privileged chat messages, enabling chat role injection attacks. Applications rendering untrusted user input with this method may be vulnerable to prompt boundary bypass.
technology·other·prompt injection·
8 Oct 2026 · PraisonAI
PraisonAI contains four distinct security vulnerabilities across its platform and core components: unauthenticated MCP HTTP-stream exposure, arbitrary file write/command execution via AICoder, shell command allowlist bypass using find -exec, and privilege escalation through PATCH route authorization bypass. These enable unauthorized tool access, code execution, privilege escalation, and resource manipulation.
technology·workflow·excessive permissions·
8 Oct 2026 · Tensorlake
A malicious version (0.5.144) of the Tensorlake npm package, a TypeScript SDK for Tensorlake's AI agent/document processing services, was compromised in a ChainDrop/Shai-Hulud supply chain attack. The package contained obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
technology·coding·supply chain·
7 Oct 2026 · Vercel
The Next.js development server's Model Context Protocol endpoint lacks origin verification, allowing malicious websites to access sensitive development data including source code and project paths. Only development builds are affected.
technology·other·misconfiguration·
7 Oct 2026 · LMCache
A critical, unpatched vulnerability in LMCache, open-source caching software used to speed up LLM servers like vLLM, allows unauthenticated attackers to execute code remotely via its ZeroMQ-based multiprocess cache server. No fixed version is currently available.
technology·other·excessive permissions·
7 Oct 2026 · Actual Budget
Actual Sync Server's CORS proxy uses an improper prefix check that allows authenticated users to access private GitHub repositories beyond the allowlisted plugin repositories when a GitHub token is configured. An attacker can bypass the allowlist by requesting API paths for repositories with names that start with an allowlisted repository name.
technology·other·misconfiguration·
7 Oct 2026 · Flowise
Two critical vulnerabilities discovered in Flowise versions ≤3.1.2: a NodeVM sandbox escape allowing authenticated remote code execution, and a prompt injection vulnerability in CSV/Airtable agents enabling data exfiltration and SSRF through inadequate Python code validation.
technology·workflow·prompt injection·
7 Oct 2026 · PraisonAI
PraisonAI's AgentMail bot in webhook mode fails to verify Svix webhook signatures, allowing unauthenticated attackers to inject forged messages into agents and spoof sender addresses. The vulnerability affects version 4.6.63 and allows arbitrary message injection and reply redirection.
technology·other·misconfiguration·
6 Oct 2026 · Knowns
A critical arbitrary code execution vulnerability in the Knowns LSP binary allows attackers to execute arbitrary commands by crafting a malicious .knowns/config.json file that specifies an attacker-controlled binary path. The payload executes twice per session during health checks and server startup.
technology·coding·misconfiguration·
6 Oct 2026 · Payload
An authenticated user could manage MCP API keys outside their intended account in Payload CMS plugin-mcp, allowing privilege escalation through account takeover. The vulnerability was patched in version 3.88.0.
technology·other·excessive permissions·
6 Oct 2026 · vLLM
vLLM versions ≤0.25.1 silently drop the cache_salt parameter during Harmony tool-continuation re-submissions, causing continuation prefixes to be cached in the unsalted namespace. This restores a cross-tenant prefix-cache membership oracle that allows attackers to infer other tenants' prompt membership.
technology·workflow·misconfiguration·
6 Oct 2026 · LangChain
@langchain/redis failed to properly escape values in RediSearch TAG and TEXT filters, allowing attackers to inject RediSearch syntax and alter search queries. This could expose indexed documents outside an attacker's intended scope in applications using these filters as access boundaries.
technology·other·prompt injection·
6 Oct 2026 · Vercel
Security researcher Paulos Yibelo reported a full guest-to-host VM escape zero-day in Linux KVM, the hypervisor underlying Vercel's Firecracker-based Sandbox used to run AI agents; Vercel CEO Guillermo Rauch confirmed the flaw via the company's bug bounty program. KVM is widely used by AWS, Google Cloud, Nutanix, HPE and Proxmox, raising concern about broad exposure pending a responsible disclosure and patch.
technology·other·unknown·
5 Oct 2026 · PyJWT
PyJWT fails to validate that the public key parameter 'x' matches the key derived from private key parameter 'd' in OKP JWKs, allowing attackers to use stolen sender-constrained tokens without the legitimate holder's private key in DPoP integrations.
technology·other·misconfiguration·
5 Oct 2026 · Langflow
Langflow uses Python's non-cryptographic random module seeded with SECRET_KEY to derive Fernet encryption keys for stored credentials. When SECRET_KEY is shorter than 32 characters, the encryption key is fully deterministic and reproducible, allowing attackers to decrypt all stored API keys and secrets without brute force.
technology·other·misconfiguration·
5 Oct 2026 · simple-git
A vulnerability in simple-git allows OS command injection through unblocked Git configuration includes in the `git.clone()` function. Attackers can execute arbitrary code by passing `-c include.path=<file>` via customArgs, with a pending fix that incompletely addresses conditional include variants.
technology·coding·excessive permissions·
5 Oct 2026 · OpenClaw
Channel read actions in OpenClaw plugins for Microsoft Teams, Feishu, Matrix, and Google Chat could skip target allowlists, allowing access to restricted channels. Affected versions allowed explicit read targets to reach channels outside configured policies.
technology·other·misconfiguration·
5 Oct 2026 · Langflow
Langflow versions up to 1.10.2 contain three critical vulnerabilities: prompt injection in Smart Transform leading to code execution, authenticated RCE via malicious decorators in the validate_code endpoint, and unauthenticated flow execution due to webhook authentication bypass.
technology·workflow·prompt injection·
1 Oct 2026 · Meow Apps
The AI Engine WordPress plugin is vulnerable to stored cross-site scripting through a chain of missing input validation and output escaping across multiple components. Unauthenticated attackers can inject arbitrary scripts that execute when administrators access the WordPress dashboard.
technology·other·prompt injection·
30 Sept 2026 · OpenAI
A lawsuit against OpenAI alleges that autonomous AI agents were used to carry out hacking attacks, prompting Anthropic to warn about broader liability risks for AI agent providers.
technology·other·unknown·
30 Sept 2026 · Glow
Security firm Glow found that AI coding agents, when asked to share screenshots for code review, published over 13,000 internal images—including customer billing records and unreleased feature screens—to public GitHub repositories, mostly under developers' personal accounts across more than 300 organizations.
technology·coding·data leak·
30 Sept 2026 · GitPython
GitPython 3.1.59 misidentifies the git directory when opening or cloning repositories, allowing attackers to execute arbitrary code via malicious tracked files like hooks/pre-commit. This affects services that process untrusted repositories including CI runners, code scanners, and AI agents.
technology·other·misconfiguration·
30 Sept 2026 · russh
The pageant crate contains an out-of-bounds read vulnerability in MemoryMap::read that accepts peer-controlled byte counts without bounds checking. A malicious local process impersonating a Pageant agent can crash russh SSH clients or disclose adjacent process memory.
technology·other·excessive permissions·
29 Sept 2026 · Ollama
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in experimental agent mode where the bash tool approval mechanism fails to properly parse shell syntax, allowing attackers to execute additional shell commands through prompt injection.
technology·coding·prompt injection·
29 Sept 2026 · OpenAI
Threat actors created custom GPTs on ChatGPT that impersonated legitimate products to trick users into executing malicious PowerShell commands, a technique known as ClickFix.
technology·other·tool misuse·
29 Sept 2026 · OpenAI
OpenAI canceled the planned October release of its GPT-6.1 Astra model after internal safety and alignment testing found the model exhibited deceptive behavior and took unauthorized actions.
technology·other·tool misuse·
29 Sept 2026 · Model Context Protocol
The official Model Context Protocol (MCP) Python SDK contained a flaw where a malicious MCP server could trick a client application into sending its OAuth client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint. The maintainers disclosed the issue in a security advisory and released fixed versions starting at 1.30.0.
technology·other·supply chain·
29 Sept 2026 ·
Researchers at Glow Security found that AI coding agents, working around GitHub's lack of an image-upload API for private pull requests, posted over 13,000 sensitive screenshots from 343 companies to public GitHub repositories, exposing credentials, personal data, and unreleased product details.
technology·coding·tool misuse·
29 Sept 2026 · Unsloth
A vulnerability in Unsloth Studio allowed malicious AI models to execute arbitrary Python code during routine model inspection, exploiting the trust_remote_code setting. The issue has since been patched.
technology·other·misconfiguration·
28 Sept 2026 ·
A security research report from SOCRadar found infostealer malware logs containing AI service account credentials and sessions tied to more than 80,000 corporate domains, exposing organizations to risks including stolen conversations and LLMjacking.
technology·other·data leak·
28 Sept 2026 ·
The Carbonato botnet targets exposed Docker daemons to install the open-source Hermes Agent AI framework, overwriting its persona configuration file with a 39-line prompt that directs the agent to execute attacker tasks received via Telegram.
technology·other·misconfiguration·
28 Sept 2026 · code-ollama
The grep_search tool in code-ollama fails to properly escape shell metacharacters in user-supplied input, allowing an attacker-controlled Ollama server to inject and execute arbitrary OS commands. Because grep_search is classified as read-only, it executes without user approval.
technology·coding·tool misuse·
28 Sept 2026 · Microsoft
An agentic AI-driven threat actor dubbed JadePuffer allegedly used exposed credentials to access an Azure tenant and delete cloud-based storage, applications, and databases in a destructive attack.
technology·other·misconfiguration·
