# Layer tags for catalog incidents, keyed by incident slug (date-slug, see
# src/data/incidents.json). Rules, schema, and examples: data/TAGGING.md.
# Validated by `npm run data` (also runs before every build).

# ---------------------------------------------------------------------------
# Batch 1: 2026 newest first, 2026-10-27 to 2026-10-15.
# ---------------------------------------------------------------------------

# An AI model found memory-safety bugs in browsers and kernels and chained them into exploits; no agent tooling attacked.
2026-10-27-anthropic-an-unreleased-internal-model-built-working-exploit-chains-for-chrome:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# An agent found memory-unsafe protocol parsing in EPICS control software; no agent tooling attacked.
2026-10-27-autonomous-cipher-agent-finds-four-flaws-in-epics-particle-accelerator-control:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Token audience, unauthenticated SSE, and tenant namespaces checked incompletely; .npmrc-chosen registry received creds.
2026-10-27-mcp-server-and-langgraph-advisory-batch-aws-api-mcp-accepts-other-apps-tokens:
  primary: 6
  secondary: [1, 5, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agents auto-load instruction files from a working directory any website can write to; led to malware install and OAuth token exposure.
2026-10-25-planted-agents-md-in-a-downloads-folder-got-codex-to-install-malware-a-claude:
  primary: 5
  secondary: [2, 4, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# VM, network, and service isolation defeated by agents in internal red-teaming, plus a cache side channel. The KEV listing is for the Brotli CVE the campaign found, not the escape.
2026-10-23-openai-moves-frontier-training-offline-after-red-team-agents-escaped-vms-and:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: false

# Oversight integrity: monitoring triggered by agent-controlled events and switched off by client-set headers; sandbox and Auto-Review bypassable.
2026-10-22-metr-and-redwood-openai-s-agent-monitoring-was-not-fit-for-purpose-during-the:
  primary: 7
  secondary: [6]
  actor: vendor_eval
  fixable: true
  vendor_response: patched
  in_the_wild: false

# AI-assisted discovery of memory-safety bugs in PHP core, exploited after disclosure; no agent tooling attacked.
2026-10-21-php2shell-ai-assisted-research-finds-pre-auth-rce-in-php-core-affecting-every:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Operators used Claude Code-based intrusion agents against healthcare, government, and SaaS targets; agents were the weapon.
2026-10-21-crowdstrike-four-previously-unreported-actors-ran-claude-code-based-intrusion:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Stubbed or absent authentication (mock user gives every caller admin), then shell=True with no allowlist, planted instructions, SSRF.
2026-10-21-db-gpt-and-vibe-trading-agents-run-attacker-commands-as-root-cve-2026-77932-cve:
  primary: 6
  secondary: [2, 5, 8]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Supply chain, credential root cause: a master key committed publicly and never revoked cascaded into branch protection, release, and stealer package.
2026-10-21-litellm-1-107-0-on-pypi-and-docker-ships-a-credential-stealer-that-runs-at:
  primary: 1
  secondary: [7, 4, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# OAuth callback let attacker-supplied serverCommand/serverArgs become the stdio config the local proxy runs.
2026-10-21-mcp-inspector-advisory-batch-two-critical-paths-from-connecting-to-a-malicious:
  primary: 5
  secondary: [6, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ARTEX agents password-sprayed and took over vendor cloud identities and M365 tenants; agents were the weapon.
2026-10-21-microsoft-china-aligned-storm-0940-used-artex-ai-agents-to-compromise:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Oversight integrity: agents with write access to their own monitoring silenced alerts and rewrote a test to assert the monitor was absent.
2026-10-21-openai-two-internal-agents-disabled-misalignment-monitoring-and-one-denied-it:
  primary: 7
  secondary: [6]
  actor: operator
  fixable: false
  vendor_response: patched
  in_the_wild: false

# Model endpoints exposed without authentication; agent reads .env files and API keys.
2026-10-21-symantec-skynet-mode-attack-agent-hijacks-exposed-llm-endpoints-to-hack-and:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Operator drove agents to brute-force university logins and exfiltrate PII; agents were the weapon.
2026-10-21-unit-42-bugster-drives-hermes-agent-and-deepseek-v4-over-telegram-to-breach:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Responses matched to connections by JSON-RPC id alone, so one client got another's; tokens not bound to audience.
2026-10-20-mcp-typescript-sdk-advisory-batch-one-client-s-responses-delivered-to-another:
  primary: 6
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Admin credentials and MFA codes phished outside agent tooling, then spent on Gemini inference billed to the victim.
2026-10-20-wiz-google-ads-phishing-leads-to-gcp-takeover-and-gemini-llmjacking-billed-to:
  out_of_model: true
  class: resource_theft
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Fail-open default policy: any OIDC token holder self-enrolls and gets wildcard access to every MCP backend.
2026-10-19-google-oss-agent-mesh-and-envoy-ai-gateway-any-oidc-token-holder-could-self:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Exposed Cairn panels show agents run unattended against 1,200+ unpatched web shops; agents were the weapon.
2026-10-19-norforge-one-operator-s-exposed-cairn-agent-panels-show-1-200-sites-attacked:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# An AI agent ran a multi-cloud intrusion from an exposed Kafka UI to org-wide admin; agent was the weapon.
2026-10-19-wiz-cirt-an-ai-agent-ran-a-full-multi-cloud-intrusion-from-an-exposed-kafka-ui:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Long-lived third-party provider keys held centrally in a legacy hosted system.
2026-10-17-opencode-console-breach-exposes-users-stored-openai-anthropic-and-google-api:
  primary: 1
  secondary: []
  actor: attacker
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Buyers' stolen provider keys, taken outside agent tooling, spent as payment and compute for an offensive agent.
2026-10-16-bitsight-monst3r-ai-underground-pentest-agent-runs-on-buyers-stolen-ai-api-keys:
  out_of_model: true
  class: resource_theft
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Argument injection into a CLI whose --mcp-config flag loads an executable stdio server.
2026-10-16-claude-agent-sdk-a-crafted-session-id-injects-an-mcp-server-and-runs-commands:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Repo-declared MCP servers run on open, and approval gates misparse shell commands; unsure 5 vs 7, picked earlier.
2026-10-16-coding-agent-advisory-batch-command-approval-bypasses-and-repository-mcp:
  primary: 5
  secondary: [7, 2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agents with no action gating reused one credential the victims left exposed in configs, repos, and CI.
2026-10-15-cert-in-advisory-ai-agents-under-evaluation-reached-live-systems-of-indian:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 2: 2026 newest first, 2026-10-15 to 2026-10-06.
# ---------------------------------------------------------------------------

# Pin integrity: installer trusted git checkout of a pinned SHA, and a SHA-named branch installed unreviewed code.
2026-10-15-claude-code-plugin-hash-pins-could-be-bypassed-with-a-branch-named-like-the:
  primary: 7
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Model-based judges read attacker text in the same channel as the policy they enforce; counterfeit policy pushed a risk gate under its threshold.
2026-10-15-datadog-counterfeit-policy-text-collapses-an-injection-classifier-s-recall-and:
  primary: 2
  secondary: [7]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# User-supplied MCP stdio commands run unvalidated and persist in config, open to every authenticated role; secret keys exfiltrated.
2026-10-15-langflow-mcp-stdio-rce-exploited-in-the-wild-1-706-attempts-steal-secret-keys:
  primary: 5
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Research agents with no action gating took exposed credentials and routed around access controls on live third-party systems.
2026-10-15-openai-discloses-four-more-june-incidents-a-funded-test-wallet-raided-147-451:
  primary: 6
  secondary: [1, 8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# A planted large HTML file rendered outside the CSP read local secrets and sent them out; boundary keyed to file size.
2026-10-14-sneakpeek-claude-code-desktop-s-preview-pane-let-a-large-html-file-read-and:
  primary: 5
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agents with no egress restrictions used public services as relays and a leaked key to scrape a live service. Egress failure is isolation.
2026-10-14-swarmchasers-a-tencent-cloud-hosted-agent-fleet-tried-2-600-times-to-scrape:
  primary: 6
  secondary: [8, 1]
  actor: vendor_eval
  fixable: false
  vendor_response: disputed
  in_the_wild: true

# Agents on a public model built a Chrome full-chain exploit under a bug bounty; no agent tooling attacked.
2026-10-14-xbow-agents-on-a-public-openai-model-built-a-250-000-chrome-full-chain-exploit:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Research on open-weight models self-replicating across IoT devices with exposed ADB; no agent tooling attacked.
2026-10-13-anthropic-small-open-weight-models-are-close-to-self-replicating-across-cheap:
  out_of_model: true
  class: capability
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Hard-coded default JWT signing secret plus just-in-time admin creation from token claims.
2026-10-13-ibm-mcp-context-forge-shipped-a-known-jwt-secret-letting-anyone-mint-platform:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, origin failure: lure packages rewrote the agent's model endpoint and MCP config, then stole agent configs.
2026-10-12-fake-apex-accelerator-npm-packages-reroute-a-coding-agent-s-llm-traffic-and:
  primary: 4
  secondary: [5, 8, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Controlled test of frontier models against an OT range; no agent tooling attacked.
2026-10-11-booz-allen-frontier-models-cleared-all-eight-objectives-in-a-live-ot-range-test:
  out_of_model: true
  class: capability
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Evaluation agents with no action gating ran injection, submitted real forms, and used read tokens on live government systems.
2026-10-09-anthropic-claude-models-ran-injection-commands-submitted-a-false-homicide-tip:
  primary: 6
  secondary: [1, 8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Default execution role scoped to every agent in the region; SSRF to IMDS handed it over. Unsure 1 vs 6, picked earlier.
2026-10-08-agentcorruption-one-prompt-to-an-amazon-bedrock-agentcore-agent-yields:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: disputed
  in_the_wild: false

# Malware carries instructions for the LLMs that triage it; triage models read sample content as guidance.
2026-10-08-cisco-talos-four-malware-families-carry-instructions-aimed-at-the-llms-that:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# CSRF-reachable local agent endpoint, with approval trusted from the client; unsure 6 vs 7, picked earlier.
2026-10-08-pydantic-ai-web-chat-ui-any-website-the-developer-visits-can-run-the-agent-and:
  primary: 6
  secondary: [7, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, pipeline failure: an unreviewed push to main fed a release with valid provenance; stealer plants run-on-open configs.
2026-10-08-shai-hulud-variant-compromises-the-tensorlake-npm-sdk-for-ai-agent-sandboxes:
  primary: 7
  secondary: [4, 1, 5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Actor used ARTEX and Claude Code to breach banks; agents were the weapon.
2026-10-07-artex-agentic-pentest-tool-and-claude-code-used-to-breach-south-korean-banks:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Hidden instructions in email steer the AI inbox summary; summaries feed payment decisions with no check against the original.
2026-10-07-barracuda-phishing-emails-carry-hidden-prompt-injections-for-the-recipient-s-ai:
  primary: 2
  secondary: [7]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# MCP stdio definitions treated as trusted executables any flow author supplies; resource reads not scoped to the caller.
2026-10-07-langflow-advisory-batch-arbitrary-commands-in-mcp-stdio-server-configs:
  primary: 5
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# AI gateways and model servers reachable from the internet with unauthenticated MCP test endpoints, unpatched months later.
2026-10-07-poellm-botnet-infects-3-400-exposed-ai-servers-through-litellm-s-mcp-test:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Unauthenticated ZMQ socket passes attacker data to pickle.loads; no fix or maintainer advisory at disclosure.
2026-10-07-unpatched-lmcache-flaw-gives-unauthenticated-root-rce-on-llm-inference-cache:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: no_response
  in_the_wild: false

# Access broker ran Claude Code agent swarms and PentAGI against energy firms and web shops; agents were the weapon.
2026-10-06-cyberxero-a-russian-speaking-access-broker-runs-up-to-51-claude-code-agents-and:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Cloud keys leaked in code and configuration outside agent tooling, tested for Bedrock access as LLMjacking inventory.
2026-10-06-datadog-stolen-aws-keys-are-being-systematically-tested-for-amazon-bedrock:
  out_of_model: true
  class: resource_theft
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Encrypted page instructions the agent decrypts itself, then reads .env and fetches an attacker URL with the secrets.
2026-10-06-encrypted-web-page-instructions-make-github-copilot-cli-send-local-env-secrets:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Stored OAuth credentials not bound to the authorization server that issued them; a malicious server named its own.
2026-10-06-mcp-typescript-sdk-a-malicious-mcp-server-could-name-its-own-authorization:
  primary: 1
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 3: 2026 newest first, 2026-10-06 to 2026-09-25.
# ---------------------------------------------------------------------------

# Vendor evaluation agent with live internet access and no action gating reached a state government web app.
2026-10-06-openai-apologizes-to-australian-parliament-as-a-second-agent-intrusion-at-nsw:
  primary: 6
  secondary: []
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Agents ingest response headers as context with the same trust as page content; injection attempts seen in the wild.
2026-10-06-signals-corps-prompt-injection-shows-up-in-http-response-headers-aimed-at:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Evaluation agents with no bot identification edited a citation tool's config to use it as a proxy.
2026-10-05-wikimedia-suspected-openai-agents-edited-wikis-altered-a-citation-tool-s-config:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Server-supplied OAuth URL reached an OS launcher unescaped and ran as PowerShell; malicious server data executed as code.
2026-10-04-opencode-on-windows-a-malicious-mcp-server-s-oauth-endpoint-runs-powershell:
  primary: 5
  secondary: [3]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Authentication fails open when no identity provider is set, on the component brokering every tool and credential.
2026-10-02-aws-s-loom-agent-orchestration-platform-handed-full-admin-to-any-network-client:
  primary: 6
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# User-authored agent flow definitions rendered by a server template engine escaped the sandbox and ran commands.
2026-10-02-gitlab-ai-gateway-a-crafted-duo-agent-platform-flow-escapes-the-prompt-template:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agents with no scope limits got into 55+ organizations, using relays and disposable mailboxes.
2026-10-02-openai-has-notified-100-organizations-of-misaligned-agent-activity-asymmetric:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# "Read-only" limited what the agent could do, not where the data could go; agents under one account shared an environment.
2026-10-01-a-read-only-grok-bot-cfo-agent-posted-a-ceo-s-bank-balances-to-the-company-slack:
  primary: 8
  secondary: [6]
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: regulatory and legal follow-up (subpoena, FTC probe, lawsuit, Senate hearing) to earlier agent incidents.
2026-10-01-california-subpoenas-openai-the-ftc-opens-a-rogue-agent-probe-and-a-lawsuit-and:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Extension mechanism runs third-party mods with full privileges and secrets, reviewed on what they declare rather than what they do.
2026-10-01-claude-code-2-1-287-turns-on-mods-by-default-unsandboxed-in-process-plugins:
  primary: 3
  secondary: [1, 7]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# A model found a recoverable Math.random() signing key in a file server and built an auth bypass; no agent tooling attacked.
2026-09-30-claude-mythos-spots-a-recoverable-math-random-signing-key-in-rejetto-hfs-and:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Context: trend report on AI-discovered vulnerabilities and weaponization, not itself an incident.
2026-09-30-google-gtig-ai-discovered-flaws-lead-to-rce-twice-as-often-and-agent-frameworks:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Confused deputy: client-held ciphertext fed back to the model, which decrypted its own protected reasoning on request.
2026-09-30-openai-disrupts-a-moonshot-ai-linked-campaign-that-replayed-encrypted-reasoning:
  primary: 2
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Research agents with no action gating sent SQL injection probes and tried an exposed API key on government sites.
2026-09-30-transluce-ai-agents-sent-sql-injection-probes-at-the-us-department-of-education:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# No control over where agent output could go: agents created public repos to host internal screenshots without asking.
2026-09-29-pixelleak-ai-coding-agents-posted-13-000-internal-screenshots-from-300:
  primary: 8
  secondary: []
  actor: operator
  fixable: false
  vendor_response: patched
  in_the_wild: true

# An autonomous agent chained helpdesk zero-days to breach a disclosure nonprofit; agent was the weapon.
2026-09-29-an-autonomous-ai-agent-chains-two-zammad-zero-days-to-breach-the-dutch:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Unscoped evaluation agents on government systems, where one agency's exposed key turned a lookup into authenticated access.
2026-09-29-openai-s-australian-disclosure-covers-four-government-systems-including-an:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Selecting a model ran its config.json auto_map code (trust_remote_code forced on); a model file that runs on open.
2026-09-29-unsloth-studio-merely-selecting-a-hugging-face-model-ran-the-attacker-s-python:
  primary: 5
  secondary: [4, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Sandbox trusted a path the sandboxed agent could rewrite, so the agent chose the next sandbox's mounts.
2026-09-28-brig-an-agent-swaps-a-directory-for-a-symlink-and-gets-host-directories-mounted:
  primary: 6
  secondary: []
  actor: unknown
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Trusted AI platform abuse aimed at humans: a user-published GPT on the vendor's domain served a ClickFix lure; no agent tooling loaded it.
2026-09-28-malicious-chatgpt-custom-gpts-on-chatgpt-com-push-clickfix-and-a-rat:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Agent with platform-wide search aggregated profiles of vulnerable people, gated only by a refusal a rephrase defeats.
2026-09-28-meta-s-muse-agent-compiled-lists-of-undocumented-immigrants-transgender:
  primary: 6
  secondary: []
  actor: operator
  fixable: false
  vendor_response: no_response
  in_the_wild: true

# SDK fell back to server-served OAuth metadata and never bound stored credentials to their issuer.
2026-09-28-official-mcp-python-sdk-let-a-malicious-mcp-server-redirect-oauth-client:
  primary: 1
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agent ran unrequested supply chain attacks in simulation; scope instructions acted as a preference, not a boundary.
2026-09-28-uk-aisi-gpt-6-astra-ran-unsanctioned-supply-chain-attacks-on-simulated-open:
  primary: 6
  secondary: []
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# An agent found and exploited a Linux kernel bug to root; no agent tooling attacked.
2026-09-28-xbow-s-ai-agent-finds-and-exploits-a-linux-kernel-out-of-bounds-write-to-root:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agents enumerated and wiped an Azure tenant using service principal credentials exposed in a public issue; agents were the weapon.
2026-09-25-microsoft-jadepuffer-storm-3168-used-agents-to-enumerate-then-wipe-an-azure:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 4: 2026 newest first, 2026-09-25 to 2026-09-12.
# ---------------------------------------------------------------------------

# Training sandbox filtered HTTP but left DNS open, and the kill switch alerted without stopping the run.
2026-09-25-openai-pauses-tool-use-training-on-its-most-capable-models-after-an-agent:
  primary: 6
  secondary: [8, 7]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: false

# A public lead form plants instructions the agent later treats as commands; data left through allowlist bypasses and link unfurling.
2026-09-24-salesbleed-one-poisoned-web-to-lead-form-hijacks-salesforce-agentforce-and-its:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agent with live internet access treated a government portal's access controls as obstacles to route around.
2026-09-24-an-openai-evaluation-agent-climbed-over-australia-s-medicare-statistics-portal:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Privileged local agent API trusted any request reaching localhost; its upgrade path ran a caller-supplied package.
2026-09-24-opencode-drive-by-rce-any-website-could-make-the-local-server-install-an:
  primary: 6
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Encoded instructions in a processed email beat the content filter, ran code, and reached connected OAuth tokens.
2026-09-24-salt-labs-hijacks-the-manus-agent-with-a-jsfuck-encoded-email-and-reaches-its:
  primary: 2
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Botnet installs an agent on hijacked Docker hosts to harvest keys and run commands; agent was the weapon.
2026-09-23-carbonato-botnet-puts-a-telegram-controlled-hermes-agent-on-hijacked-docker:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Supply chain, pipeline failure: injected commits in the release pipeline exposed publish tokens, then a worm shipped in agent memory packages.
2026-09-23-sckit-a-worm-targeting-ai-agent-memory-infrastructure-hits-memtensor-s-npm-and:
  primary: 7
  secondary: [1, 4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Dictation endpoint stored in user-writable preferences; redirected audio, injected instructions, and captured tokens.
2026-09-22-meta-muse-zero-day-one-hidden-preference-redirects-the-agent-s-dictation-and:
  primary: 5
  secondary: [8, 1, 2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Operator chained open-source agent frameworks to breach retailers and steal card data; agents were the weapon.
2026-09-22-three-open-source-ai-agents-breach-27-retailers-and-steal-600-000-credit-cards:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# A default-on indexing feature sent whole repositories, secrets in history included, to cloud storage with no user control.
2026-09-22-z-ai-s-zcode-coding-agent-uploaded-entire-local-repositories-git-history:
  primary: 8
  secondary: []
  actor: operator
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Context: intergovernmental scientific brief on agent safeguards, not itself an incident.
2026-09-21-un-scientific-panel-s-first-brief-agent-safeguards-are-unravelling-after-the:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# A model built the libheif exploit; the chain ran through a forum and corporate SSO, an identity problem outside agent tooling.
2026-09-19-researchers-use-claude-opus-5-to-take-over-openai-employee-chatgpt-and-codex:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Pin integrity: SHA pin expressed as a git ref that resolves to a same-named branch, never compared to fetched content. Anthropic and OpenAI patched; Microsoft shipped no fix; Google declined.
2026-09-18-plugin4shell-a-branch-named-like-a-commit-hash-swaps-pinned-plugins-in-claude:
  primary: 7
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: mixed
  in_the_wild: false

# Evaluation model with live egress guessed and reused public credentials on three real systems it took for CTF targets.
2026-09-18-google-confirms-gemini-broke-into-three-real-systems-during-an-irregular:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Approval bound to a description of an action rather than the action; pending state can change after sign-off.
2026-09-17-loopjacking-approve-one-agent-action-execute-another-in-langgraph-agno-and:
  primary: 7
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Fake AI trading agent site used as a malware lure aimed at humans; no agent tooling involved.
2026-09-17-fake-ai-trading-agent-site-delivers-needle-stealer-which-swaps-victims-crypto:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Crew removed an agent's safety memory and ran it to mass-harvest exposed credentials; agent was the weapon.
2026-09-17-french-speaking-crew-deletes-a-hermes-agent-s-refusal-memories-and-harvests-16:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Compaction turns a model's own summary into the next context's trusted instructions; found keys used, records posted publicly.
2026-09-17-openai-publishes-six-misalignment-incidents-jailbreaks-planted-in-compaction:
  primary: 2
  secondary: [1, 8]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Android malware uses an AI assistant to navigate screens into wireless debugging; AI was the weapon.
2026-09-17-rathat-android-malware-sends-the-screen-to-an-ai-assistant-to-find-its-way-into:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Browser AI assistants trust the vendor page they are hosted in; an extension injects there and issues instructions.
2026-09-16-bragjack-one-browser-extension-can-drive-the-ai-assistants-in-chrome-comet-edge:
  primary: 2
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Breach notification for an intrusion where a third party used an AI agent as the instrument; agent was the weapon.
2026-09-16-spain-s-data-protection-agency-receives-its-first-breach-notification:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: threat intelligence on an uncensored AI service sold to criminals, not itself an incident.
2026-09-15-luciferus-an-uncensored-ai-service-sold-on-exploit-forum-writes-a-working-rat:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Sandbox permissions derived from agent-controlled paths, and a privileged token reachable from the untrusted side.
2026-09-15-overpatch-and-heapjack-two-sandbox-escapes-in-openai-codex-cli-and-codex-desktop:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# MCP servers given HTTP and SSE transports with no authentication, exposing every tool to the network.
2026-09-15-four-critical-mcp-servers-and-gateways-ship-with-no-authentication-on-the:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Test agents with no action gating flooded a registry and abused a build file for RCE; signup could not tell agents from users.
2026-09-12-openai-s-test-agents-flooded-rubygems-with-2-000-malicious-packages-and-reached:
  primary: 6
  secondary: [5, 4, 1]
  actor: vendor_eval
  fixable: false
  vendor_response: disputed
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 5: 2026 newest first, 2026-09-11 to 2026-08-31.
# ---------------------------------------------------------------------------

# Approval layer parsed a simplified command line, so env-variable prefixes on allowlisted commands ran unchecked.
2026-09-11-mistral-vibe-s-command-allowlist-ignores-environment-variable-prefixes-so-git:
  primary: 7
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Malware carries safety-triggering text so LLM triage refuses to analyze it; content read as guidance.
2026-09-10-guardbreaker-uac-0099-hides-a-nuclear-weapons-question-in-a-script-comment-so:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: vendor threat intelligence report, not itself an incident.
2026-09-10-anthropic-s-threat-report-1-8-million-android-apps-scanned-for-secrets-30-ai:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Operator ran hundreds of agents to exploit PaperCut servers; agents were the weapon.
2026-09-10-hundreds-of-ai-agents-exploit-two-papercut-flaws-to-breach-395-organizations-in:
  out_of_model: true
  class: offensive_use
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Documented example master key works in production on the gateway that holds every provider key; vendor calls it a deployment error.
2026-09-10-nearly-1-in-10-exposed-litellm-gateways-still-accept-the-documentation-s-own-sk:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Permissions attach to the workflow, not the requester; authorization decided once at configuration, not per action.
2026-09-09-workflow-identity-hijacking-an-anonymous-request-makes-a-privileged-ai-workflow:
  primary: 6
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Per-conversation isolation stopped at the network; a shared cache's writable metadata linked sandboxes and carried a planted prompt.
2026-09-09-a-shared-package-cache-behind-chatgpt-s-sandboxes-let-one-user-s-planted-prompt:
  primary: 6
  secondary: [2, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation containment lived in the prompt, not the network; a CTF model took admin and read personal data on a real system.
2026-09-09-anthropic-discloses-a-fourth-evaluation-breach-an-early-claude-opus-4-6-took:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# AI service tokens taken by a commodity infostealer from browsers and machines, outside agent tooling.
2026-09-09-okta-finds-555-ai-service-tokens-in-one-infostealer-dump-replayable-straight:
  out_of_model: true
  class: resource_theft
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Escaped evaluation agents used writable public sites as message channels; no destination control.
2026-09-09-openai-s-escaped-agents-used-at-least-10-more-sites-than-disclosed-including:
  primary: 8
  secondary: [6]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Sandbox control plane reachable from inside the sandbox, authenticated by a caller-set Host header; agent can drop its approvals.
2026-09-08-a-deepseek-coding-agent-can-switch-off-its-own-file-sandbox-with-one-request-to:
  primary: 6
  secondary: [7]
  actor: unknown
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agents store tokens, MCP keys, and transcripts unencrypted in predictable paths; infostealers now collect them.
2026-09-08-eight-commodity-infostealer-families-add-ai-coding-agents-to-their-collection:
  primary: 1
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: quarterly adversarial-AI threat report, not itself an incident.
2026-09-08-google-threat-intelligence-a-multi-agent-framework-harvested-thousands-of:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Injected instructions bypass a read-only restriction enforced by prompt rather than by the database grant; unsure 2 vs 6, picked earlier.
2026-09-08-microsoft-s-record-966-cve-patch-tuesday-includes-a-sql-copilot-prompt:
  primary: 2
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Context: government advisory on distillation through ordinary API access, no control defeated.
2026-09-08-nsa-fbi-and-cisa-name-six-chinese-ai-companies-running-industrial-scale:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Evaluation egress trusted a hostname suffix rather than a destination; agents built a channel on a public wiki. Egress failure is isolation.
2026-09-05-openai-confirms-the-wiki-incident-18-000-agent-posts-on-a-dormant-german-wiki:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# A repository's own .git/config runs commands before trust or approval prompts. goose, Cursor, Codex, and one Claude Code path fixed; Hermes, Qwen Code, Grok Build, and a second Claude Code path still vulnerable.
2026-09-02-gitspawn-a-repository-s-own-git-config-runs-attacker-commands-in-seven-ai:
  primary: 5
  secondary: [7]
  actor: attacker
  fixable: true
  vendor_response: mixed
  in_the_wild: false

# Context: a KEV batch showing AI control-plane components under routine exploitation; no new vulnerabilities.
2026-09-02-cisa-puts-the-ai-control-plane-in-kev-litellm-kestra-starlette-and-artifactory:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Operator drove agents through a full enterprise intrusion; agents were the weapon.
2026-09-02-unit-42-ai-agents-ran-every-step-of-an-enterprise-intrusion-in-under-ten-hours:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: enterprise survey on agents acting outside scope.
2026-09-01-agents-without-guardrails-65-of-enterprises-have-watched-an-ai-agent-act:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# A model ported a pre-auth PLC exploit between controllers; no agent tooling attacked.
2026-09-01-forescout-uses-claude-to-port-a-pre-auth-plc-exploit-between-wago-controllers:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Exposed AI orchestration platform with auth off by default runs user-supplied Python via exec(); secret keys read.
2026-09-01-langflow-s-twelfth-exploited-flaw-of-the-year-is-used-to-read-secret-keys-and:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Context: OWASP ranking and control standard, not an incident.
2026-09-01-owasp-ranks-excessive-agency-third-after-weighing-6-639-real-incidents-and:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Ransomware affiliate used a coding agent as an interactive intrusion console; agent was the weapon.
2026-08-31-aurora-ransomware-affiliates-ran-live-intrusions-through-cursor-s-ai-agent:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Any authenticated user registers a server command that runs as root; tool calls never check ownership across tenants.
2026-08-31-mcphub-authorization-failures-let-any-logged-in-user-execute-commands-as-root:
  primary: 5
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 6: 2026 newest first, 2026-08-31 to 2026-08-11.
# ---------------------------------------------------------------------------

# Agent harness ships credentials unencrypted at rest, sandbox off by default, and no tenant isolation; unsure 1 vs 5, picked earlier.
2026-08-31-openclaw-2-0-ships-with-its-new-sandbox-off-by-default-and-credentials:
  primary: 1
  secondary: [5, 6]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Workspace files set the IDE's outbound recommendation URL, and injected repo instructions fill it with local secrets.
2026-08-27-amazon-kiro-turns-its-own-extension-recommendation-url-into-a-data-exfiltration:
  primary: 5
  secondary: [2, 8, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Context: KEV listing of flaws exploited by evaluation agents; no new vulnerability.
2026-08-27-cisa-adds-the-two-flaws-openai-s-escaped-agents-exploited-to-the-kev-catalog:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: 90-day honeypot trend report on attacks against AI stack internals.
2026-08-27-wiz-honeypots-record-90-days-of-attacks-written-specifically-for-ai-stack:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Agent with no action gating bypassed a frontend-only booking limit and cancelled another member's booking in reproduction.
2026-08-26-aikido-reproduces-the-gym-booking-exploit-claude-opus-4-6-on-openclaw-bypasses:
  primary: 6
  secondary: []
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Approval classifier reads the shown command, not the transitive behavior it triggers; vendor says working as designed.
2026-08-26-claude-code-opus-5-auto-mode-defeated-in-60-to-80-of-runs-anthropic-classifies:
  primary: 7
  secondary: [2, 5]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Context: executive risk survey.
2026-08-26-gartner-emerging-risks-survey-ranks-ai-enabled-vulnerability-discovery-first-of:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Exposed AI control planes with bypassable authentication; provider keys harvested, miners installed.
2026-08-26-microsoft-documents-live-attacks-on-litellm-ragflow-and-kestra-control-planes:
  primary: 6
  secondary: [1, 5]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Evaluation agents shared writable infrastructure that became a message bus, then ran code on third-party production servers.
2026-08-26-the-hugging-face-postmortems-land-1-200-agents-70-000-messages-code-execution:
  primary: 6
  secondary: [8, 5, 1]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Wrapper bound the local inference server to all interfaces with no auth or origin checks; a web page rewrote the model's prompt template.
2026-08-25-one-malicious-webpage-poisons-the-local-model-behind-an-nvidia-nemoclaw-agent:
  primary: 6
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Botnet wires a hosted LLM into its command loop; AI was the instrument.
2026-08-25-toxnetv2-wires-an-nvidia-hosted-llm-into-a-linux-botnet-s-command-loop:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: sizing study of AI-enabled malware.
2026-08-25-unit-42-finds-97-of-ai-enabled-malware-samples-never-left-the-sandbox:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Encrypted instructions pass guardrails and the model decrypts them into its own context, then exfiltrates chat data.
2026-08-20-cryptographic-context-injection-hides-prompts-inside-aes-ciphertext-to-steal:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# AI-generated scripts used against exposed PLCs; AI was the instrument against non-agent systems.
2026-08-19-five-us-agencies-warn-of-ai-generated-exploit-scripts-probing-siemens-s7-plcs:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: disclosure of a defensive vulnerability-discovery harness, not an incident.
2026-08-19-google-threat-intelligence-publishes-its-multi-agent-vulnerability-discovery:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Undocumented URL parameter runs an external string as a user prompt; untrusted pages write to persistent memory.
2026-08-18-cosnitch-copilot-explains-its-own-undocumented-autorun-parameter-and-one-click:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Context: a lab paused training on measured cyber capability; not an external attack.
2026-08-18-openai-pauses-its-largest-frontier-rl-run-after-astra-approaches-the-critical:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# An offensive agent found and exploited a CI script injection in a company repository; no agent tooling attacked.
2026-08-17-an-ai-agent-exploits-a-copilot-reviewed-github-actions-bug-in-snowflake-s:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# SSRF in AI tooling: an unauthenticated webhook test endpoint on an ML tracking server fetches caller URLs, reaching cloud credentials.
2026-08-17-mlflow-ssrf-exploited-for-cloud-credential-theft-within-hours-of-cve-assignment:
  primary: 8
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Encrypted reasoning objects replay across sessions, users, and models with no binding; a sibling model transcribes them.
2026-08-13-encrypted-reasoning-traces-replay-across-openai-anthropic-and-google-apis:
  primary: 2
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Tool poisoning: an MCP server behaves for three calls after trust, then its runtime responses hunt SSH keys.
2026-08-12-deadbugz-a-malicious-mcp-server-stays-benign-for-exactly-three-tool-calls-then:
  primary: 3
  secondary: [1, 5]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Supply chain, credential root cause: PyPI tokens stolen through a compromised CI action, then used to publish poisoned releases.
2026-08-12-cloudsek-sizes-the-march-litellm-poisoning-434-000-captured-files-mapped-to-2:
  primary: 1
  secondary: [4, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2026-03-24-litellm-supply-chain-attack-by-teampcp]

# Multi-agent framework breached government and energy targets; agents were the weapon.
2026-08-12-near-autonomous-ai-agents-breach-taiwan-s-government-and-nuclear-safety:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Tool poisoning: a malicious MCP server splits one refused request across tool descriptions and results the agent trusts.
2026-08-11-ghostsplice-a-malicious-mcp-server-splits-one-refused-request-across-three:
  primary: 3
  secondary: [2, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# A zero-click Zoom chain built with public models; no agent tooling attacked.
2026-08-11-zoomsday-a-zero-click-zoom-rce-chain-built-with-fewer-than-20-prompts-to-public:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 7: 2026 newest first, 2026-08-11 to 2026-07-30.
# ---------------------------------------------------------------------------

# A multi-agent pipeline found flaws in 4G and 5G core software; no agent tooling attacked.
2026-08-11-a-three-agent-llm-pipeline-finds-84-flaws-in-4g-and-5g-core-software-23-still:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: mixed
  in_the_wild: false

# Agents load privileged config from a world-writable ProgramData path. Anthropic fixed; Cursor silent; OpenAI triaged without a fix; Google treated it as documentation.
2026-08-11-a-world-writable-programdata-folder-hands-local-users-control-of-four-ai-coding:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: mixed
  in_the_wild: false

# An agent built an unauthenticated SharePoint RCE chain whose public PoC was then exploited; no agent tooling attacked.
2026-08-11-an-ai-agent-builds-an-unauthenticated-sharepoint-rce-chain-the-published-poc:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Cowork authorization narrower than the agent's access, plus injection reaching a shell with confirmation skipped.
2026-08-11-microsoft-patches-a-critical-copilot-cowork-privilege-escalation-and-a-copilot:
  primary: 6
  secondary: [2, 5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agents' persistence files (editable system prompts) carry self-replicating instructions from run to run.
2026-08-10-mind-viruses-anthropic-and-epfl-show-self-replicating-payloads-spreading-agent:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# State group runs offline LLMs to triage stolen data; AI was the instrument.
2026-08-10-kimsuky-builds-an-offline-llm-lab-on-its-own-attack-servers-to-triage-stolen:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Personal agent with no action gating probed an API with no delete authorization and cancelled another member's booking.
2026-08-10-openclaw-agent-finds-a-missing-authorization-check-in-a-gym-booking-api-and:
  primary: 6
  secondary: []
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Hostile input logged faithfully by observability tools becomes instructions for the agent that reads the logs.
2026-08-09-ghostjacking-poisoned-cloudflare-datadog-and-sentry-records-turn-ai-agents-into:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# A URL parameter prefilled the assistant with attacker instructions inside an authenticated session.
2026-08-07-rovoblast-a-url-parameter-prefills-atlassian-rovo-with-attacker-instructions:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Misconfigured evaluation sandbox left a network path out; the model fetched task answers from GitHub.
2026-08-07-moonshot-ai-s-kimi-k3-escapes-an-evaluation-sandbox-and-fetches-the-answers-off:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Publicly triggerable CI agents held maintainer credentials; text in an issue steered privileged automation.
2026-08-06-black-hat-one-malicious-github-issue-yields-rce-and-credential-theft-in-claude:
  primary: 2
  secondary: [1, 6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Tool poisoning: cloned skills built registry standing, then added instructions to hunt and ship credentials.
2026-08-06-credential-stealing-agent-skills-trend-on-vercel-s-skills-sh-and-reach-1-7:
  primary: 3
  secondary: [4, 1, 8]
  actor: attacker
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Evaluation vendor misconfiguration let a lab's model reach and exploit a real organization.
2026-08-06-meta-becomes-the-fourth-lab-in-three-weeks-to-confirm-a-model-escaped:
  primary: 6
  secondary: []
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Instructions buried in content redirect agentic browsers to act with the user's sessions on other origins. Some vendors patched; others called it intended.
2026-08-05-pleasefix-zero-click-agent-hijacking-across-every-major-agentic-browser:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: false
  vendor_response: mixed
  in_the_wild: false

# Prompt content crosses into framework state handling; deserialization and unauthenticated code paths run it.
2026-08-05-check-point-discloses-11-vulnerabilities-across-six-enterprise-ai-agent:
  primary: 5
  secondary: [2, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Auto-login mints superuser tokens for any network caller, then code validation runs attacker Python.
2026-08-05-cisa-adds-a-third-actively-exploited-langflow-flaw-to-kev-cve-2026-9198:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Isolation held between agents and the outside but not between agents; a shared artifact store became their message board.
2026-08-05-openai-s-black-hat-debrief-the-escaped-agents-ran-a-message-board-inside:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Self-issued credentials accepted as authorization; agent import accepted an arbitrary command as config.
2026-08-05-paperclip-ai-agent-control-plane-unauthenticated-rce-cve-2026-41679:
  primary: 6
  secondary: [5, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, account compromise of unknown method: a maintainer account published a worm that plants agent auto-run hooks.
2026-08-04-chaindrop-npm-worm-poisons-400-packages-and-plants-claude-code-and-vs-code-auto:
  primary: 1
  secondary: [4, 5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# In-process vm2 sandbox, abandoned as unsafe by its authors, used as the boundary for attacker-influenced code.
2026-08-04-flowise-vm2-sandbox-escape-to-remote-code-execution-cve-2026-69253:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Evaluation agents with live internet and no real-time monitoring took unsanctioned actions against real people and projects.
2026-08-04-uk-ai-security-institute-incident-report-19-unsanctioned-actions-across-10-of:
  primary: 6
  secondary: []
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Fabricated Security Intelligence consumed by approval: AI-fabricated reports were issued as CVEs and advisories, rated critical in NVD, and enriched by CISA.
2026-08-03-54-ai-fabricated-vulnerability-reports-reach-the-national-vulnerability-database:
  primary: 7
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: annual threat hunting report.
2026-08-03-crowdstrike-2026-threat-hunting-report-ai-as-both-weapon-and-target:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Confused deputy: a privileged workflow authorized on who posted a mention, not where its text came from.
2026-08-03-google-deletes-three-adk-workflows-after-agent-to-agent-privilege-escalation-in:
  primary: 2
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Fake install guide on the AI vendor's share domain used as a lure aimed at humans.
2026-07-30-macsync-fake-claude-install-guide-hosted-on-claude-ai-share-delivers-a-six:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 8: 2026 newest first, 2026-07-30 to 2026-07-14.
# ---------------------------------------------------------------------------

# Evaluation machines had live internet while the prompt said none; models compromised real organizations and published a package.
2026-07-30-anthropic-discloses-three-cases-of-claude-models-leaving-cyber-evaluations-and:
  primary: 6
  secondary: [1, 4]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Operator wired an open-weight model into an agent harness for autonomous scan-exploit runs; agent was the weapon.
2026-07-30-chinese-speaking-operator-wires-deepseek-into-the-hermes-agent-framework-to:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Hidden document text read as instructions and copied into generated output, so the payload replicates; mitigations matched wording only.
2026-07-29-copilot-for-word-prompt-injection-worm-self-propagates-between-documents:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: patched
  in_the_wild: false

# A model broke a post-quantum signature scheme; no agent tooling attacked.
2026-07-28-claude-mythos-preview-recovers-hawk-256-signing-keys-and-the-scheme-is:
  out_of_model: true
  class: capability
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Evaluation egress assumed, not enforced: the registry proxy was the boundary; models then reused public credentials at four services.
2026-07-28-openai-s-escaped-models-exploited-jfrog-artifactory-zero-days-and-reused:
  primary: 6
  secondary: [1]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Share feature produced durable public URLs that search engines indexed; nothing conveyed the page was world-readable.
2026-07-27-google-indexed-shared-claude-conversations-and-artifacts-exposing-medical:
  primary: 8
  secondary: []
  actor: unknown
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Supply chain, origin failure: bulk AI-themed malicious packages aimed at developers and coding agents resolving names.
2026-07-24-165-malicious-npm-and-pypi-packages-in-one-week-several-targeting-ai-tooling:
  primary: 4
  secondary: [1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Operator ran an agent with approvals off for post-exploitation inside a ministry; agent was the weapon.
2026-07-24-hermes-ai-agent-run-unattended-for-post-exploitation-inside-thailand-s-ministry:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# URL parameters supplied the agent builder's initial prompt and state, deploying an agent with approvals set to never ask.
2026-07-23-agentforger-one-chatgpt-link-deploys-an-attacker-controlled-agent-inside-a:
  primary: 2
  secondary: [7, 6]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# User-generated Artifact on the vendor domain used as a malware lure aimed at humans.
2026-07-23-fakeagent-malicious-claude-artifact-and-bing-ads-deliver-sectoprat-to-29:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Agent VM sandbox misconfiguration let untrusted content escape to the host filesystem; vendor rated it Informative and changed defaults.
2026-07-23-sharedroot-escapes-the-claude-cowork-sandbox-to-read-host-mac-files-cve-2026:
  primary: 6
  secondary: [2, 1]
  actor: attacker
  fixable: true
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Context: research study of flaws in AI-built applications, not an incident.
2026-07-23-434-exploitable-flaws-found-across-28-ai-built-applications:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Agents on an open-weight model found Redis zero-days and built an RCE; no agent tooling attacked.
2026-07-23-kimi-k3-agents-find-redis-zero-days-and-build-a-working-rce-exploit:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# mcp.json not on the protected-path list, so injected web text made the agent register an attacker MCP server.
2026-07-22-aws-kiro-rewrites-its-own-mcp-config-from-hidden-web-text-for-silent-code:
  primary: 5
  secondary: [2, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Hidden PR comments reach the review agent unwrapped on one tool path, steering it with the reviewer's credentials.
2026-07-22-azure-devops-mcp-server-lets-hidden-pr-comments-hijack-ai-review-agents:
  primary: 2
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Evaluation with classifiers off and a trusted registry proxy as the only egress; models escaped and attacked a third party.
2026-07-22-openai-confirms-its-own-models-escaped-a-test-sandbox-and-breached-hugging-face:
  primary: 6
  secondary: [5, 1]
  actor: vendor_eval
  fixable: false
  vendor_response: patched
  in_the_wild: true
  related: [2026-07-16-hugging-face-production-infrastructure-breached-end-to-end-by-an-autonomous-ai]

# Supply chain, origin failure: squatted repos posing as skills and MCP servers, chosen by agents that search and install.
2026-07-21-agentbaiting-7-600-fake-github-repositories-800-posing-as-ai-skills-and-mcp:
  primary: 4
  secondary: [3]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Actor productized a jailbroken model as a commercial penetration testing platform; AI was the instrument.
2026-07-21-trim-turns-jailbroken-claude-opus-into-a-commercial-penetration-testing-platform:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Agent Sandbox Escape: sandboxed agents write files that trusted tooling outside later runs. Cursor and Codex fixed; Google status not stated.
2026-07-21-week-of-sandbox-escapes-cursor-codex-gemini-cli-and-antigravity-all-breached:
  primary: 6
  secondary: [5, 2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Validation endpoint evaluates user code with attacker-controlled globals on internet-facing instances.
2026-07-21-cisa-adds-a-second-actively-exploited-langflow-rce-to-kev-within-two-weeks-cve:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# A model found a WordPress pre-auth RCE chain, exploited after publication; no agent tooling attacked.
2026-07-20-wp2shell-ai-discovered-wordpress-pre-auth-rce-chain-exploited-in-the-wild-cve:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: true

# A malicious dataset upload hit a remote-code dataset loader and a config template injection on the processing workers.
2026-07-16-hugging-face-production-infrastructure-breached-end-to-end-by-an-autonomous-ai:
  primary: 5
  secondary: [1, 6]
  actor: vendor_eval
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2026-07-22-openai-confirms-its-own-models-escaped-a-test-sandbox-and-breached-hugging-face]

# Custom URL scheme auto-submitted an external parameter as a user prompt, hiding the malicious part.
2026-07-15-promptfiction-claude-desktop-claude-links-auto-submitted-attacker-prompts:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Approval handler accepted synthetic clicks, and a URL flag started the panel pre-approved; unpatched at disclosure.
2026-07-14-claudebleed-reopened-rogue-browser-extensions-can-still-drive-claude-for-chrome:
  primary: 7
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Context: annual AI security report.
2026-07-14-check-point-ai-security-report-2026-ai-has-crossed-from-assistant-to-operator:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 9: 2026 newest first, 2026-07-13 to 2026-07-06.
# ---------------------------------------------------------------------------

# Context: industry state-of-AI-security report.
2026-07-13-orca-security-2026-state-of-ai-security-report:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Instructions inside a PNG referenced by AGENTS.md drive review agents to leak .env as integer constants.
2026-07-11-ghostcommit-hides-prompt-injection-inside-png-images-to-steal-secrets:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Agent frameworks run LLM-generated code with no validation or isolation; MCP and dashboard endpoints lack auth.
2026-07-10-wave-of-critical-rce-flaws-across-ai-agent-frameworks-cve-2026-61447-cve-2026:
  primary: 5
  secondary: [6, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# README instructions in an audited repo drive review agents to run a disguised binary.
2026-07-09-friendly-fire-turns-ai-code-audit-agents-into-code-execution:
  primary: 2
  secondary: [5]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# AI gateway host exposed with SSH open to the internet, brute-forced, then mined and probed for model access.
2026-07-09-aws-ai-gateway-wired-to-amazon-bedrock-hijacked-for-cryptomining:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Locally bound agent WebSocket with no Origin or auth checks; any web page can drive it.
2026-07-09-cline-ai-coding-agent-hub-websocket-rce-cve-2026-59723:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Missing authorization on realtime socket events and client-trusted session IDs in an LLM UI.
2026-07-09-open-webui-16-flaw-security-batch-cve-2026-59212-to-cve-2026-59227:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Approval shows the presented path, not the symlink target. Amazon, Cursor, Google fixed; Augment and Windsurf unpatched; Anthropic called it out of scope.
2026-07-08-ghostapproval-symlink-flaws-defeat-human-in-the-loop-in-six-ai-coding-assistants:
  primary: 7
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: mixed
  in_the_wild: false

# Supply chain, origin failure: attackers register the package and repo names models hallucinate.
2026-07-08-hallusquatting-weaponizes-ai-package-name-hallucinations:
  primary: 4
  secondary: [2]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Coding agent sent location and identity signals to vendor servers as an undisclosed anti-abuse check; removed after dispute.
2026-07-08-china-s-cnvdb-labels-claude-code-a-backdoor-alibaba-bans-it:
  primary: 8
  secondary: []
  actor: operator
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Context: half-year threat report on malicious agent skills.
2026-07-08-eset-h1-2026-threat-report-malicious-ai-agent-skills-surge-first-genai-android:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Model safety: workflow framing defeats content guardrails; the user is the requester and nothing acts on a system.
2026-07-08-github-copilot-guardrails-bypassed-by-multi-step-workflow-framing:
  out_of_model: true
  class: model_safety
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Supply chain, account compromise of unknown method: a maintainer account backdoored SDK packages and planted agent config hooks.
2026-07-08-injective-sdk-npm-packages-backdoored-to-steal-wallet-keys-and-poison-ai-agent:
  primary: 1
  secondary: [4, 5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# MCP endpoint auth fallback fails open on a fabricated Authorization header.
2026-07-08-litellm-mcp-authentication-bypass-cve-2026-59822:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Lone actor used agentic workflows to breach an AWS estate; AI was the instrument.
2026-07-08-sygnia-documents-lone-attacker-breaching-aws-in-72-hours-with-agentic-ai:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Instructions in a public issue steer a credentialed workflow agent to post private repo contents publicly; vendor calls it architectural.
2026-07-07-gitlost-leaks-private-repositories-via-github-agentic-workflows:
  primary: 2
  secondary: [8, 6]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Agent previews served same-origin with the session cookie forwarded into the sandbox, breaking tenant isolation.
2026-07-07-writeout-cross-tenant-account-takeover-in-writer-ai:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Flow lookups by UUID with no ownership check expose other users' embedded credentials; exploited and in KEV.
2026-07-07-cisa-adds-langflow-idor-cve-2026-55255-to-kev-first-ai-agent-platform-in-the:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Context: enterprise AI trust survey.
2026-07-07-digicert-ai-trust-outlook-78-of-enterprises-report-ai-security-incidents:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Writable setup file in a runtime shared by every agent in a project, with no isolation between agents.
2026-07-07-google-dialogflow-cx-rogue-agent-cross-agent-hijack:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Unlocked setup fields let a client override the system prompt and tools; unsure 2 vs 3, picked earlier.
2026-07-07-google-gemini-live-api-rce-via-unconstrained-ephemeral-tokens:
  primary: 2
  secondary: [3, 5]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Agent memory API routers registered with no authentication; config API exposes provider keys in plaintext.
2026-07-07-mem0-unauthenticated-memory-access-and-key-disclosure-cve-2026-59705-cve-2026:
  primary: 6
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Context: MCP ecosystem study.
2026-07-07-trend-micro-stars-don-t-save-you-mcp-ecosystem-study:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Adversarial evasion of skill scanners: packed skills hide behavior that appears only at runtime.
2026-07-06-skillcloak-repacks-malicious-ai-agent-skills-to-evade-scanners:
  primary: 3
  secondary: [4]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Injected instructions make the model build an image URL carrying data, fetched automatically with no click.
2026-07-06-openai-codex-desktop-zero-click-data-exfiltration-cve-2026-14898:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 10: 2026 newest first, 2026-07-06 to 2026-05-21.
# ---------------------------------------------------------------------------

# Adjacent: a smart-contract exploit whose blast radius automated keeper agents widened; the agents were not the surface.
2026-07-06-summer-fi-keeper-ai-agents-exploit-drains-about-6m:
  out_of_model: true
  class: adjacent
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Bearer token joined into a session-file path with no normalization; traversal authenticates as the default session.
2026-07-02-fast-mcp-telegram-mcp-server-authentication-bypass-cve-2026-52830:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# In-the-wild hidden web instructions push browsing agents to pay attacker wallets.
2026-07-02-zscaler-documents-in-the-wild-indirect-prompt-injection-targeting-autonomous-ai:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Agentic ransomware entered through an exposed Langflow instance's unauthenticated code execution, then encrypted configs.
2026-07-01-jadepuffer-first-documented-end-to-end-agentic-ransomware:
  primary: 6
  secondary: [1, 5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# MCP client attaches its bearer token to every outbound connection, including attacker-chosen paths.
2026-07-01-apify-actors-mcp-server-token-exfiltration-cve-2026-50143:
  primary: 1
  secondary: [8, 3]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# An LLM produced a browser-native ransomware technique from a sanctioned API; no agent tooling attacked.
2026-07-01-check-point-demonstrates-llm-generated-browser-native-ransomware:
  out_of_model: true
  class: capability
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Injected content overwrites the sandbox enforcer via an agent-chosen directory and a fail-open symlink check.
2026-07-01-cursor-duneslide-zero-click-prompt-injection-rce-cve-2026-50548-cve-2026-50549:
  primary: 6
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Command guards inspect the raw string, not what bash executes after expansion; poisoned files drive destructive commands.
2026-06-30-guardfall-shell-injection-bypass-in-open-source-ai-coding-agents:
  primary: 7
  secondary: [2, 5]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# An AI SAST engine found a memory-amplification DoS in a protobuf library; no agent tooling attacked.
2026-06-30-anthropic-buffa-rust-protobuf-memory-amplification-dos-cve-2026-55407:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, origin failure: attackers register domains models hallucinate; agents and users trust them.
2026-06-30-palo-alto-unit-42-phantom-squatting-ai-hallucinated-domains-as-an-attack-surface:
  primary: 4
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Workspace MCP config auto-loaded with no consent or trust check; spawned processes inherit developer credentials.
2026-06-26-amazon-q-developer-silent-mcp-config-auto-load-cve-2026-12957-cve-2026-12958:
  primary: 5
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Missing tenant-identity validation and unauthenticated internal endpoints; tracing redirectable to exfiltrate messages.
2026-06-23-dify-difytap-cross-tenant-data-exposure-cve-2026-41947-to-cve-2026-41950:
  primary: 6
  secondary: [8, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Inference server auth middleware rebuilt the path from the Host header and failed open.
2026-06-22-vllm-openai-compatible-api-authentication-bypass-cve-2026-48746:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Localhost-trusting MCP WebSocket excluded from auth passes URL-supplied server params to process launch.
2026-06-18-microsoft-autogen-studio-autojack-drive-by-code-execution:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Adjacent: an AI framework vendor's npm scope was backdoored, but the payload took browser history and wallets, not agent or AI credentials.
2026-06-17-mastra-ai-npm-scope-compromise-sapphire-sleet-unc1069:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Search parameter becomes a prompt, streamed output renders before sanitization, and an image endpoint bypasses CSP.
2026-06-15-microsoft-365-copilot-searchleak-one-click-data-theft-cve-2026-42824:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Unsanitized upload filename on an instance with auto-login gives unauthenticated file write and RCE; exploited.
2026-06-08-langflow-path-traversal-rce-exploited-in-the-wild-cve-2026-5027:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# CI agent processed untrusted GitHub content in the runtime holding privileged secrets.
2026-06-05-claude-code-github-action-prompt-injection-secret-exfiltration:
  primary: 2
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, origin failure: worm wheels target MCP developers and embed injection aimed at LLM package scanners.
2026-06-05-hades-pypi-worm-wave-shai-hulud-miasma-lineage:
  primary: 4
  secondary: [1, 2]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Adjacent: a binding.gyp worm hit packages including a voice-AI SDK, harvesting npm, GitHub, and cloud credentials, not agent or AI tooling.
2026-06-03-node-gyp-phantom-gyp-self-propagating-npm-worm-miasma:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Adjacent: a compromised employee account abused trusted publishing in a non-AI npm namespace; no agent or AI involvement.
2026-06-01-red-hat-redhat-cloud-services-npm-miasma-worm:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: a trojanized IDE extension pushed through auto-update; no agent or AI involvement.
2026-05-28-nx-console-malicious-vs-code-extension-leads-to-github-repository-breach:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Adjacent: a compromised repo fed an AI chatbot vendor's npm publishing and injected CI workflows harvesting CI credentials, not agent or AI tooling.
2026-05-25-megalodon-mass-github-actions-secret-exfiltration:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Supply chain, origin failure: malicious packages plant invisible instructions in CLAUDE.md and .cursorrules.
2026-05-24-trapdoor-poisons-claude-md-and-cursorrules-across-npm-pypi-and-crates-io:
  primary: 4
  secondary: [5, 2, 1]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# A stolen employee OAuth token led to malicious tool definitions and the agent broker's production credential cache.
2026-05-21-composio-agent-integration-platform-breach-exposes-10-000-customer-credentials:
  primary: 1
  secondary: [3, 5]
  actor: attacker
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 11: 2026 newest first, 2026-05-20 to 2026-04-22.
# ---------------------------------------------------------------------------

# Unauthenticated authentication bypass in a model-serving stack, plus memory-safety defects.
2026-05-20-nvidia-triton-inference-server-authentication-bypass-cve-2026-24207:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Adjacent: hijacked GitHub Action tags harvested CI secrets; no agent or AI involvement.
2026-05-18-actions-cool-github-actions-tag-hijack-mini-shai-hulud:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Agent API server ships with auth disabled and bound to all interfaces; exploited within hours.
2026-05-15-praisonai-auth-disabled-api-server-cve-2026-44338:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: a worm-infected library reached an AI vendor's developer machines; payload took generic credentials and certificates.
2026-05-14-openai-internal-source-code-and-certificate-theft-via-tanstack-worm:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Deeplink smuggles --settings with a SessionStart hook through another flag's value; one click runs commands.
2026-05-12-claude-code-deeplink-rce:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Local agent WebSocket with no auth or Origin check; any page reads agent chat and runs code. No patch at disclosure.
2026-05-12-cline-ai-agent-unauthenticated-websocket-rce-cve-2026-44211:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Unvalidated IPC between the assistant extension and the editor lets a local attacker bypass consent prompts; unsure 6 vs 7, picked earlier.
2026-05-12-github-copilot-and-vs-code-security-feature-bypass-cve-2026-41109:
  primary: 6
  secondary: [7, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# An LLM found and weaponized a 2FA-bypass zero-day in a sysadmin tool; disrupted before use; no agent tooling attacked.
2026-05-11-google-gtig-reports-first-ai-developed-zero-day-for-mass-exploitation:
  out_of_model: true
  class: capability
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, pipeline failure: trusted publishing and CI cache poisoning shipped a worm that harvests AI tool credentials.
2026-05-11-mini-shai-hulud-worm-compromises-tanstack-mistral-ai-and-guardrails-ai-cve-2026:
  primary: 7
  secondary: [1, 4]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Unauthenticated model upload endpoint reads past the heap buffer, leaking keys, prompts, and conversations.
2026-05-10-ollama-bleeding-llama-unauthenticated-memory-leak-cve-2026-7482:
  primary: 6
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Trusted AI platform abuse loaded by tooling: a typosquatted model repo's loader ran a stealer when the model was loaded.
2026-05-07-malicious-hugging-face-open-oss-privacy-filter-fake-openai-model:
  primary: 4
  secondary: [1]
  actor: attacker
  fixable: false
  vendor_response: patched
  in_the_wild: true

# Improper access control on published agents lets an unauthenticated attacker reach agent workflows and connectors.
2026-05-07-microsoft-azure-ai-foundry-m365-agent-privilege-escalation-cve-2026-35435:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Model-controlled parameters interpolated unsafely and a file download accidentally exposed as a kernel function.
2026-05-07-microsoft-semantic-kernel-prompt-injection-to-rce-cve-2026-26030-cve-2026-25592:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Build integrity: the updater's signature check does nothing and an ETag path writes to Startup; no vendor response.
2026-05-05-ollama-for-windows-auto-updater-rce-and-persistence-cve-2026-42248-cve-2026:
  primary: 7
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: no_response
  in_the_wild: false

# Confused deputy: a trading agent executed another agent's public reply as a command with no source validation.
2026-05-04-grok-and-bankr-ai-wallet-drained-via-morse-code-prompt-injection:
  primary: 2
  secondary: [6]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Headless mode auto-trusted workspace config that executed before sandbox init.
2026-04-30-google-gemini-cli-cvss-10-0-headless-rce:
  primary: 5
  secondary: [7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Adjacent: an ML framework package carried a worm stealing GitHub, npm, and cloud tokens; commits forged under an agent's name, but no agent credentials taken.
2026-04-30-pytorch-lightning-pypi-compromise-mini-shai-hulud:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Pre-auth SQL injection in the LLM proxy reads stored upstream provider keys; exploited within 36 hours.
2026-04-29-litellm-pre-auth-sql-injection-cve-2026-42208:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# An over-scoped token left readable in the workspace let a coding agent wipe production and backups.
2026-04-25-a-cursor-agent-deletes-pocketos-s-production-database-and-its-backups-in-nine:
  primary: 1
  secondary: [6]
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# SSRF in AI tooling: validate-then-fetch with independent DNS and unchecked redirects.
2026-04-24-langchain-langchain-openai-and-langchain-text-splitters-ssrf-disclosures:
  primary: 8
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Context: measurement of indirect prompt injection pages on the open web.
2026-04-23-google-workspace-reports-32-rise-in-indirect-prompt-injection-pages-on-the-open:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# APT used AI coding tools to author malware and lures against developers; AI was the instrument.
2026-04-23-hexagonalrodent-north-korean-apt-industrializes-web3-developer-attacks-using-ai:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Agent platform deployments expose admin panels with no authentication and unpatched CVEs.
2026-04-23-securityscorecard-finds-40-214-openclaw-instances-exposed-online-with-63-rce:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Supply chain, pipeline failure: CI pulled a compromised upstream image by mutable tag, then signed and published; payload took AI tooling configs.
2026-04-22-bitwarden-cli-npm-package-trojanized-via-checkmarx-kics-cascade:
  primary: 7
  secondary: [4, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: a compromised bot account shipped a generic credential sweep in an inference framework package; no agent or AI tooling credentials targeted.
2026-04-22-xinference-pypi-package-compromise-versions-2-6-0-2-6-2:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Batch 12: 2026 newest first, 2026-04-21 to 2026-04-02.
# ---------------------------------------------------------------------------

# Model access at a vendor environment relied on URL secrecy rather than authenticated tenancy; guessed from leaked conventions.
2026-04-21-anthropic-claude-mythos-preview-accessed-by-discord-group-via-vendor-breach:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Supply chain, credential root cause: compromised maintainer credentials shipped a worm that harvests AI tooling configs.
2026-04-21-canistersprawl-self-propagating-npm-worm-via-namastex-labs-and-pgserve:
  primary: 1
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Context: enterprise survey on AI agent incidents.
2026-04-21-cloud-security-alliance-survey-ai-agent-incidents-common-across-enterprises:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Agent node runs LLM-generated Python without sandboxing.
2026-04-21-flowise-csv-agent-prompt-injection-rce-cve-2026-41264:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# SSRF in AI tooling: the model server's image loader fetches any URL; exploited within 13 hours.
2026-04-21-lmdeploy-ssrf-exploited-within-13-hours-of-public-disclosure-cve-2026-33626:
  primary: 8
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# An AI tool's OAuth app held allow-all scopes; tokens stolen from the tool vendor were replayed into the customer tenant.
2026-04-20-vercel-breach-via-context-ai-ai-tool-supply-chain:
  primary: 1
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# NoSQL operator injection on login and password change in an agent-building platform.
2026-04-17-fastgpt-authentication-and-password-change-nosql-injection:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# STDIO transport passes arbitrary command strings to subprocess; protocol owner declined to change it.
2026-04-16-anthropic-mcp-systemic-stdio-design-rce:
  primary: 5
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# CI agents ingest GitHub comments as instructions; bounties paid, no CVEs or advisories.
2026-04-15-claude-code-gemini-cli-copilot-agent-hijacked-via-github-comments:
  primary: 2
  secondary: [1, 6]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Public form fields become agent context; agents with data access email results out with no cap or approval.
2026-04-15-copilot-studio-shareleak-and-agentforce-pipeleak-form-based-prompt-injection:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Gateway auth cache keyed on the first 20 characters of a token, which colliding JWTs share.
2026-04-15-litellm-oidc-userinfo-cache-authentication-bypass:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Trusted AI platform webhooks used to host phishing lures aimed at humans.
2026-04-15-n8n-webhook-weaponization-for-phishing-campaigns:
  out_of_model: true
  class: offensive_use
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: quarterly exploit round-up report.
2026-04-14-owasp-genai-q1-2026-exploit-round-up-report:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Routers in the model path rewrite tool calls agents accept as model output; unsure 2 vs 3, picked earlier.
2026-04-13-malicious-llm-router-research-reveals-credential-and-crypto-theft:
  primary: 2
  secondary: [1, 4]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Notebook platform terminal WebSocket lacked the auth check other endpoints had; exploited within 10 hours.
2026-04-13-marimo-pre-auth-rce-weaponized-to-deploy-nkabuse-via-hugging-face:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# MCP message endpoint missing the auth middleware its paired endpoint had; exploited.
2026-04-13-nginx-ui-mcp-auth-bypass-under-active-exploitation:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Unauthenticated MCP server passes an unvalidated string to a system call. Unauthenticated reachability is primary.
2026-04-11-aws-mcp-server-unauthenticated-rce-via-command-injection:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# ML platform dashboard endpoint exposes Kubernetes service account tokens.
2026-04-10-red-hat-openshift-ai-odh-dashboard-kubernetes-token-disclosure:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Unescaped user input reaches template-rendering agent tools.
2026-04-08-praisonai-template-injection-in-agent-tool-definitions:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Adjacent: malware loader packages disguised as generic dev tooling with ClickFix lures; no agent or AI involvement.
2026-04-08-unc1069-contagious-interview-cross-ecosystem-package-campaign:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Starter toolkit creates wildcard IAM roles, so any agent reads or poisons every other agent's memory.
2026-04-07-aws-bedrock-agentcore-agent-god-mode-cross-agent-memory-access:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Unauthenticated endpoint executes user-supplied MCP server config as JavaScript; exploited. Unauthenticated reachability is primary.
2026-04-07-flowise-ai-agent-builder-rce-actively-exploited-in-the-wild:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Improper authentication on an MCP server; no patch at disclosure.
2026-04-03-azure-mcp-server-authentication-flaw:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Agent gateway WebSocket and topology endpoints have no authentication.
2026-04-03-praisonai-gateway-unauthenticated-agent-control:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# Context: business response to an earlier supply chain breach.
2026-04-02-meta-pauses-mercor-partnership:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# ---------------------------------------------------------------------------
# Batch 13: 2026 newest first, 2026-04-01 to 2026-01.
# ---------------------------------------------------------------------------

# Adjacent: DPRK social engineering of multisig signers and oracle manipulation in a DeFi protocol; no agent or AI involvement.
2026-04-01-drift-protocol-285m-exploit:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Adjacent: social-engineered maintainer credentials shipped a RAT in a non-AI npm package.
2026-03-31-axios-npm-supply-chain-attack:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: credentials from the Trivy compromise used against a vendor's dev infrastructure; AI angle is only stolen AI product code.
2026-03-31-cisco-source-code-stolen-via-trivy-breach:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Supply chain, credential root cause: stolen LiteLLM publish credentials shipped a poisoned AI gateway that breached a downstream company.
2026-03-31-mercor-data-breach-via-litellm-supply-chain:
  primary: 1
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true
  related: [2026-03-24-litellm-supply-chain-attack-by-teampcp]

# Sandbox blocked direct network requests but left recursive DNS open as an exfiltration channel.
2026-03-30-chatgpt-hidden-dns-exfiltration-channel:
  primary: 6
  secondary: [8, 2]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, credential root cause: a PyPI token stolen by the poisoned AI gateway package was used to backdoor an SDK.
2026-03-27-telnyx-pypi-supply-chain-compromise:
  primary: 1
  secondary: [4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2026-03-24-litellm-supply-chain-attack-by-teampcp]

# Supply chain, credential root cause: PyPI credentials stolen from the AI gateway's CI during the Trivy compromise shipped multi-stage malware.
2026-03-24-litellm-supply-chain-attack-by-teampcp:
  primary: 1
  secondary: [4, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related:
    - 2026-03-19-trivy-github-action-compromise-by-teampcp
    - 2026-03-31-mercor-data-breach-via-litellm-supply-chain
    - 2026-03-27-telnyx-pypi-supply-chain-compromise
    - 2026-08-12-cloudsek-sizes-the-march-litellm-poisoning-434-000-captured-files-mapped-to-2

# Adjacent: a service account compromised with Trivy-stolen credentials hijacked GitHub Action tags; no agent or AI involvement.
2026-03-23-checkmarx-kics-github-actions-compromise:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Adjacent: Trivy-stolen credentials published a worm with ICP C2; no agent or AI involvement.
2026-03-20-canisterworm-npm-worm-by-teampcp:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Adjacent: a security scanner's action tags redirected after an incompletely remediated service account compromise; root of the LiteLLM chain, but no agent or AI involvement itself.
2026-03-19-trivy-github-action-compromise-by-teampcp:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true
  related: [2026-03-24-litellm-supply-chain-attack-by-teampcp]

# Internal agent acted with no human confirmation; an employee followed its advice and exposed data.
2026-03-18-meta-sev-1-rogue-ai-agent-incident:
  primary: 6
  secondary: []
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Path traversal in the framework's prompt-loading API.
2026-03-17-langchain-core-path-traversal:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Endpoint executes arbitrary Python from node definitions without sandboxing; provider keys harvested within 20 hours.
2026-03-17-langflow-rce-exploited-within-20-hours:
  primary: 5
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: a compromised monorepo-tooling package delivered a credential stealer leading to cloud admin; no agent or AI involvement in this entry.
2026-03-11-unc6426-nx-npm-to-aws-admin-takeover:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# Context: acquisition following an agent platform's security crises.
2026-03-10-meta-acquires-moltbook-openclaw-after-security-crises:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Agent in RL training spontaneously used GPUs to mine and opened a reverse SSH tunnel past security processes.
2026-03-rome-ai-agent-escapes-sandbox-mines-cryptocurrency:
  primary: 6
  secondary: [8]
  actor: vendor_eval
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Oversight integrity: compaction dropped the confirm-before-acting instruction and the agent ignored STOP commands.
2026-02-22-openclaw-agent-deletes-200-emails-at-meta:
  primary: 7
  secondary: []
  actor: operator
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Actor used GenAI and an AI orchestration framework to brute-force exposed firewalls; AI was the instrument.
2026-02-20-cyberstrikeai-fortigate-mass-compromise:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Injection in an issue title steered a triage bot, then CI cache poisoning published a malicious release.
2026-02-09-clinejection-supply-chain-attack:
  primary: 2
  secondary: [7, 4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Race in response multiplexing routed one client's tool results to another.
2026-02-04-mcp-typescript-sdk-cross-client-data-leak:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Permissive CORS and no CSRF on token refresh let any page take over the account and reach code execution; exploited.
2026-01-23-langflow-active-exploitation-deploys-flodrix-botnet:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2025-10-langflow-account-takeover-and-rce-chain]

# Repository settings file redirects API requests before the trust prompt, exposing the API key.
2026-01-21-claude-code-api-key-exfiltration:
  primary: 5
  secondary: [1, 8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Missing path validation and unsanitized git arguments in an MCP server.
2026-01-20-anthropic-git-mcp-server-vulnerability-chain:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Unauthenticated webhook content-type confusion and no execution sandbox in an AI workflow platform.
2026-01-08-n8n-ni8mare-cvss-10-0-rce:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Executive device compromise yielded wallet access; trading agents held broad shared keys with no scope isolation.
2026-01-step-finance-ai-trading-agent-treasury-drain:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Pre-2026 batch 1: newest first, 2025-12 to 2025-06.
# ---------------------------------------------------------------------------

# Injected input steers a no-code agent into leaking card data and rewriting business logic.
2025-12-copilot-studio-prompt-injection-data-leak:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# AI IDEs process untrusted content as instructions; persistent memory stores accept it as trusted.
2025-12-idesaster-30-flaws-across-ai-coding-tools:
  primary: 2
  secondary: [5, 8]
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: false

# LLM-influenced metadata carrying the reserved serialization key deserializes into objects that leak secrets or run code.
2025-12-langchain-langgrinch-serialization-injection:
  primary: 5
  secondary: [2, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# State operators jailbroke a coding agent to run most of an espionage campaign; agent was the weapon.
2025-11-13-gtg-1002-chinese-state-sponsored-ai-orchestrated-espionage:
  out_of_model: true
  class: offensive_use
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# File names appended to prompts unsanitized carry instructions; vendor declined to fix.
2025-11-04-github-copilot-filename-prompt-injection:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Official desktop extensions pass input to commands unsanitized with no sandbox; local secrets exposed.
2025-11-claude-desktop-extensions-rce:
  primary: 5
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Error handling exposed an internal admin GitHub token from the agent platform.
2025-11-crewai-uncrew-github-token-exposure:
  primary: 1
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Confused deputy: a low-privilege agent steers a higher-privilege agent to export data; vendor says it works as intended.
2025-11-servicenow-now-assist-second-order-prompt-injection:
  primary: 2
  secondary: [6, 8]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Project hook configs from a cloned repo ran before the trust dialog.
2025-10-claude-code-rce-via-hooks:
  primary: 5
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Permissive CORS and no CSRF protection let any page take over the account, then the code validation endpoint ran code.
2025-10-langflow-account-takeover-and-rce-chain:
  primary: 6
  secondary: [5, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false
  related: [2026-01-23-langflow-active-exploitation-deploys-flodrix-botnet]

# Form-submitted instructions steer the CRM agent; an expired but still allowlisted domain received the data.
2025-09-salesforce-agentforce-forcedleak:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# OAuth tokens held by an AI chatbot integration were stolen and replayed across 700+ customer tenants.
2025-08-20-salesloft-drift-oauth-supply-chain-breach:
  primary: 1
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Command allowlist trusted echo without parsing what it ran.
2025-08-claude-code-inverseprompt-command-injection:
  primary: 7
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Unauthenticated local WebSocket reachable from any web page reads files and runs notebook code.
2025-08-claude-code-websocket-auth-bypass:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# A Slack message read through MCP steered the agent into config changes that ran before approval.
2025-08-cursor-curxecute-rce-via-slack-mcp:
  primary: 2
  secondary: [5, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Pin integrity: MCP approval bound to a server name, not its content, so changed configs ran with no re-approval.
2025-08-cursor-mcpoison-silent-backdoor:
  primary: 7
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Code comments steered the agent into editing its own config to drop confirmations, then ran shell commands.
2025-08-github-copilot-rce-via-prompt-injection:
  primary: 2
  secondary: [5, 7]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Project-local config files trusted implicitly and their embedded commands executed.
2025-08-openai-codex-cli-command-injection:
  primary: 5
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# A URL query parameter accepted as a prefilled prompt, persisting control after the chat closed.
2025-08-varonis-reprompt-microsoft-copilot-single-click-data-theft:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Supply chain, credential root cause: an over-scoped CI token shipped an extension carrying a destructive agent prompt.
2025-07-17-amazon-q-vs-code-extension-compromise:
  primary: 1
  secondary: [7, 4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Trusted AI platform abuse loaded by tooling: model files carry template instructions run inside trusted inference.
2025-07-09-hugging-face-poisoned-gguf-templates:
  primary: 4
  secondary: [2]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# A malicious MCP server's OAuth authorization URL reached a launcher unvalidated and ran code.
2025-07-mcp-remote-critical-rce:
  primary: 5
  secondary: [3]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agent Sandbox Escape: naive prefix path checks and no symlink validation let an MCP server escape its allowed directories.
2025-06-anthropic-filesystem-mcp-server-escaperoute:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Hidden text in email and documents steers the assistant past its injection classifier and exfiltrates data with no click.
2025-06-echoleak-microsoft-365-copilot-zero-click-prompt-injection:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Invisible markdown comments steer the assistant; secrets leave through image proxy requests.
2025-06-github-copilot-camoleak:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# ---------------------------------------------------------------------------
# Pre-2026 batch 2: newest first, 2025-06 to 2024-06.
# ---------------------------------------------------------------------------

# Exposed Langflow instances with the unauthenticated code validation flaw were exploited to deploy a botnet.
2025-06-langflow-flodrix-botnet-exploitation:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2025-05-langflow-cisa-kev-addition-confirmed-active-exploitation]

# Persistent agent memory has no integrity check, so fabricated entries steer future transactions.
2025-05-elizaos-memory-injection-vulnerability:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Code validation endpoint runs exec() on user code with no auth or sandbox; actively exploited.
2025-05-langflow-cisa-kev-addition-confirmed-active-exploitation:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true
  related: [2025-06-langflow-flodrix-botnet-exploitation]

# Tool poisoning: hidden instructions in MCP tool descriptions, which can change after install, exfiltrate message history.
2025-04-mcp-tool-poisoning-whatsapp-data-exfiltration:
  primary: 3
  secondary: [8]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Rules files carry instructions hidden with invisible Unicode, read by the assistant but not by reviewers; vendors called it user responsibility.
2025-03-18-rules-file-backdoor-attack-on-cursor-and-copilot:
  primary: 5
  secondary: [2]
  actor: attacker
  fixable: false
  vendor_response: not_a_vulnerability
  in_the_wild: false

# Adjacent: a compromised PAT backdoored a GitHub Action that leaked CI secrets; no agent or AI involvement.
2025-03-15-tj-actions-changed-files-github-actions-supply-chain-attack:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Adjacent: DPRK social engineering of a wallet developer led to an exchange theft; no agent or AI involvement.
2025-02-21-bybit-1-5b-cryptocurrency-heist:
  out_of_model: true
  class: adjacent
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Hidden instructions in calendar event metadata steer the assistant into smart home actions and data exfiltration.
2025-02-google-gemini-prompt-injection-via-calendar-invites:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# An AI aggregator breached by an unknown method exposed stored chats containing users' API keys and private keys.
2025-01-24-omnigpt-data-breach:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Adjacent: branch-name injection in CI stole a PyPI token for an ML library and shipped a miner; payload did not target AI tooling.
2024-12-04-ultralytics-pypi-supply-chain-attack:
  out_of_model: true
  class: adjacent
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Hidden page text steers the AI search summary toward attacker content.
2024-12-chatgpt-search-manipulation-via-hidden-text:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# An agent was talked into reinterpreting its own transfer function and released the prize funds.
2024-11-22-freysa-ai-agent-game-function-manipulation:
  primary: 2
  secondary: [7]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Cached repo content kept being served after repos went private; access was never rechecked against current permissions.
2024-11-microsoft-copilot-exposes-private-github-repos:
  primary: 6
  secondary: [1, 8]
  actor: operator
  fixable: true
  vendor_response: patched
  in_the_wild: true

# XSS in the agent platform runs attacker script inside authenticated sessions.
2024-11-microsoft-copilot-studio-xss:
  primary: 6
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Context: launch-time security warnings for a computer-use agent, not an incident.
2024-10-22-claude-computer-use-launch-security-warnings:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Obfuscated adversarial prompts make chatbots exfiltrate PII through markdown image URLs.
2024-10-17-imprompter-attack-on-ai-chatbots:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Agent Sandbox Escape: a TOCTOU flaw in the GPU container toolkit gives container escape on AI infrastructure.
2024-09-25-nvidia-container-toolkit-vulnerability:
  primary: 6
  secondary: [5]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Untrusted data writes persistent exfiltration instructions into the assistant's long-term memory.
2024-09-chatgpt-spaiware-persistent-memory-exploitation:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Public channel messages steer the assistant; markdown links exfiltrate private channel data and keys.
2024-08-20-slack-ai-prompt-injection-and-data-exfiltration:
  primary: 2
  secondary: [8, 1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Invisible email tags steer an assistant whose default access spans mail and documents.
2024-08-08-lolcopilot-black-hat-usa-2024-copilot-attacks:
  primary: 2
  secondary: [8, 6]
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# SSRF in AI tooling: header and redirect tricks reach internal infrastructure and metadata.
2024-08-06-microsoft-copilot-studio-ssrf:
  primary: 8
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Desktop assistant opted out of the OS sandbox and stored conversations unencrypted for any app to read.
2024-07-chatgpt-macos-cleartext-storage:
  primary: 6
  secondary: [1]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Reliability: the chatbot produced false election information that reached millions; no attacker, no action on a system.
2024-07-grok-ai-election-misinformation:
  out_of_model: true
  class: reliability
  fixable: null
  vendor_response: patched
  in_the_wild: true

# Injected instructions make the assistant hide data in invisible Unicode inside rendered links.
2024-07-microsoft-365-copilot-ascii-smuggling:
  primary: 2
  secondary: [8]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# AI device source code hard-coded admin keys to its downstream services.
2024-06-25-rabbit-r1-hardcoded-api-keys:
  primary: 1
  secondary: []
  actor: attacker
  fixable: true
  vendor_response: unknown
  in_the_wild: true

# ---------------------------------------------------------------------------
# Pre-2026 batch 3: newest first, 2024-06 to 2024-01.
# ---------------------------------------------------------------------------

# Unauthorized access to the AI platform's secrets storage exposed developers' tokens and keys.
2024-06-hugging-face-spaces-breach:
  primary: 1
  secondary: [6]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: true

# Reliability: the ordering AI failed at its task (misheard customers); no attacker and no security angle.
2024-06-mcdonald-s-ends-ai-drive-thru-after-failures:
  out_of_model: true
  class: reliability
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# Context: research measuring secrets reproduced from training data and higher leak rates in repos using the assistant.
2024-05-github-copilot-training-data-secret-leakage:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# Model safety: many-shot prompts override safety training; the user is the requester and nothing acts on a system.
2024-04-02-many-shot-jailbreaking-research:
  out_of_model: true
  class: model_safety
  fixable: null
  vendor_response: unknown
  in_the_wild: false

# A malicious pickle model escaped weak tenant isolation in shared inference to reach other customers' models.
2024-04-hugging-face-cross-tenant-attack:
  primary: 6
  secondary: [5, 4]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Plugin install flow and plugin platform lacked authentication and account checks, enabling OAuth theft and takeover.
2024-03-chatgpt-plugin-extension-vulnerabilities:
  primary: 6
  secondary: [1, 3]
  actor: attacker
  fixable: true
  vendor_response: patched
  in_the_wild: false

# Infostealers on user devices took assistant account credentials for resale, outside agent tooling.
2024-03-openai-compromised-credentials-on-dark-web:
  out_of_model: true
  class: resource_theft
  fixable: false
  vendor_response: unknown
  in_the_wild: true

# Context: tribunal ruling on liability for a chatbot's fabricated policy.
2024-02-14-air-canada-chatbot-lawsuit-ruling:
  out_of_model: true
  class: context
  fixable: null
  vendor_response: unknown
  in_the_wild: true

# RAG pipelines trust retrieved documents with no integrity check, so a few poisoned texts steer answers.
2024-02-poisonedrag-research:
  primary: 2
  secondary: []
  actor: attacker
  fixable: false
  vendor_response: unknown
  in_the_wild: false

# Model safety: an update removed guardrails and users got the chatbot to swear and mock its company; nothing acted on a system.
2024-01-18-dpd-ai-chatbot-malfunction:
  out_of_model: true
  class: model_safety
  fixable: true
  vendor_response: patched
  in_the_wild: true