Incidents

All 385 incidents from the public catalog, newest first. Each row shows its primary layer, with secondary layers counted as +n, or the class of an incident outside the model.

2026-10-27Anthropic: An Unreleased Internal Model Built Working Exploit Chains for Chrome, Safari, Android, Windows, and LinuxChrome on macOS, Safari, Google Pixel 9 (Android), the Windows kernel QUIC stack, and Linux kernel multipath TCPcveAI capability
2026-10-27Autonomous "Cipher" Agent Finds Four Flaws in EPICS Particle-Accelerator Control Software in Under Four Hours (CVE-2026-114595)EPICS Base 7.0.10 and earlier, an open-source SCADA toolkit used at about 90 scientific and industrial facilities, including Argonne's Advanced Photon Source and ITER's fusion reactor controlscveAI capability
2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)`awslabs.aws-api-mcp-server` 1.3.0 to before 1.6.0, `zereight/gitlab-mcp`, Basic Memory before 0.24.0, the official MCP reference servers (filesystem, fetch, everything), and LangGraph Postgres and SQLite storescveL6Identity / Run+3
2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenOpenAI Codex, Claude Code, and other coding agents launched with `~/Downloads` as the working directorywildL5Config+3
2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)OpenAI's frontier RL training and evaluation sandboxes, plus Google Brotli as embedded in libbrotli, Python, C++, Node.js, Bun, Envoy, and IstiocveL6Identity / Run+1
2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InOpenAI's internal misalignment monitoring for Codex agents, as it existed on and before July 21, 2026L7Build / Approval+1
2026-10-21"PHP2Shell": AI-Assisted Research Finds Pre-Auth RCE in PHP Core Affecting Every Version Back to 5.4, Added to CISA KEV in Five Days (CVE-2026-109618, CVE-2026-109619)PHP core (nearly every release back to PHP 5.4), with demonstrated unauthenticated RCE against default latest container images of WordPress, Drupal, and JoomlawildcveAI capability
2026-10-21CrowdStrike: Four Previously Unreported Actors Ran Claude Code-Based Intrusion Agents Against Healthcare, Government, and SaaS TargetsAt least 15 Argentine healthcare entities, government domains in Indonesia and other countries, private firms in Brazil and the US, and a US CRM vendorwildOffensive use
2026-10-21DB-GPT and Vibe-Trading Agents Run Attacker Commands as Root (CVE-2026-77932, CVE-2026-114107)DB-GPT through 0.8.2 and HKUDS Vibe-Trading, an AI trading agent, 0.1.0 before 0.1.7cveL6Identity / Run+3
2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupBerriAI LiteLLM: all PyPI `litellm` 1.107.0 wheels and the `v1.107.0`, `latest`, `main-latest`, and `main-stable` images on GHCR and Docker Hub (about 23 million weekly PyPI downloads)wildL1Credential+3
2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command Execution`@modelcontextprotocol/inspector` and `inspector-client` 0.13.0 through 1.0.2 and the 2.x line before 2.12.0, the official MCP developer debugging toolcveL5Config+2
2026-10-21Microsoft: China-Aligned Storm-0940 Used ARTEX AI Agents to Compromise ConnectWise Cloud Backup and Hit 2,250+ Microsoft 365 TenantsConnectWise Cloud Backup and its downstream managed service provider customers' Microsoft 365 tenants; identity providers (Okta, Entra ID, AWS Cognito) at other IT and software vendorswildOffensive use
2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedOpenAI's internal misalignment monitoring for GPT-6.1 Sol and GPT-6 Astra agent deploymentsL7Build / Approval+1
2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseUnauthenticated self-hosted model servers, AI gateways fronting paid model accounts, internal test deployments, and MCP serverswildL6Identity / Run+1
2026-10-21Unit 42: "BUGSTER" Drives Hermes Agent and DeepSeek V4 Over Telegram to Breach Indian UniversitiesTwo Indian public universities, an Indian e-commerce site, and large Ethereum holderswildOffensive use
2026-10-20MCP TypeScript SDK Advisory Batch: One Client's Responses Delivered to Another, Unbound Tasks, and Bearer Tokens for Other Services Accepted (CVE-2026-111770)`@modelcontextprotocol/sdk` before 1.32.0 and `@modelcontextprotocol/server`, `client`, and `express` 2.x before the October 20, 2026 fixescveL6Identity / Run+1
2026-10-20Wiz: Google Ads Phishing Leads to GCP Takeover and Gemini LLMjacking Billed to the VictimGoogle Cloud organizations whose administrators clicked search ads for "google cloud" or "gcp"wildResource theft
2026-10-19Google OSS Agent Mesh and Envoy AI Gateway: Any OIDC Token Holder Could Self-Enroll and Call Every MCP Tool (CVE-2026-103091)Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through alpha.8 and Envoy AI Gateway 0.4.0-rc1 before 1.2.0-rc1cveL6Identity / Run
2026-10-19NorForge: One Operator's Exposed "Cairn" Agent Panels Show 1,200+ Sites Attacked and 100+ Companies Reached for About $5,000Web properties in the US, Canada, Australia, and Japan, including sites of Deere, SharkNinja, and Cummins, a large US retailer, and a hardware-parts vendorwildOffensive use
2026-10-19Wiz CIRT: An AI Agent Ran a Full Multi-Cloud Intrusion From an Exposed Kafka UI to Org-Wide AdminAn unnamed organization running GCP and AWS with Kubernetes, GitOps, an identity provider, and data warehouseswildOffensive use
2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysOpenCode Console, the hosted gateway for the open-source OpenCode coding agentwildL1Credential
2026-10-16Bitsight: "MONST3R-AI" Underground Pentest Agent Runs on Buyers' Stolen AI API KeysOwners of stolen OpenAI, Anthropic, and Google API keys, and the hosts scanned with themwildResource theft
2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)`claude-agent-sdk` (Python) before 0.2.121cveL5Config
2026-10-16Coding Agent Advisory Batch: Command Approval Bypasses and Repository MCP Configs That Run on OpenMistral Vibe before 2.25.4, Roo Code through 3.54.0, JetBrains Junie CLI before 26.8.3, Z.ai ZCode 3.11.2.6792, and DeepSeek HarnesscveL5Config+2
2026-10-15CERT-In Advisory: AI Agents Under Evaluation Reached Live Systems of Indian Organizations, and None NoticedIndian organizations' ICT assets, including business records with personal and confidential datawildL6Identity / Run+1
2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)Claude Code before 2.1.179 and Claude Desktop plugin installscveL7Build / Approval+1
2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdTypeSafe's Jev decision model used as an injection judge, and LangChain-style tool-risk gatingL2Instruction+1
2026-10-15Langflow MCP stdio RCE Exploited in the Wild: 1,706 Attempts Steal Secret Keys and Superuser Passwords (CVE-2026-105740)Langflow versions before 1.9.0wildcveL5Config+2
2026-10-15OpenAI Discloses Four More June Incidents: A Funded Test Wallet Raided, 147,451 Non-Public Rows Pulled, and Government Data Taken Past Access ControlsAn unnamed government statistics website, an unnamed organization's internal systems, and a third party's Sepolia test walletwildL6Identity / Run+2
2026-10-14"SneakPeek": Claude Code Desktop's Preview Pane Let a Large HTML File Read and Exfiltrate Local SecretsClaude Code in Claude Desktop before 1.30096.1L5Config+2
2026-10-14"Swarmchasers": A Tencent Cloud-Hosted Agent Fleet Tried 2,600+ Times to Scrape Alibaba's Amap Through Public RelaysAmap (Gaode), Alibaba's mapping service, and the public services the agents used as relayswildL6Identity / Run+2
2026-10-14XBOW Agents on a Public OpenAI Model Built a $250,000 Chrome Full-Chain Exploit in Six DaysGoogle Chrome on Windows (about 1 billion users, per Google's estimate)cveAI capability
2026-10-13Anthropic: Small Open-Weight Models Are Close to Self-Replicating Across Cheap IoT DevicesConsumer IoT devices with unauthenticated ADB access, tested on emulated networks and 15 off-brand Android TV boxesAI capability
2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)IBM MCP Context Forge, an MCP gateway and admin platform, before 1.0.2cveL1Credential+1
2026-10-12Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP ServerWeb3 developers lured to install `@apexacc/cli` (a repackaged Oh My Pi coding agent) and `@apexacc/audit` (an "18-tool" security MCP server)wildL4Code / Package+3
2026-10-11Booz Allen: Frontier Models Cleared All Eight Objectives in a Live OT Range Test, Including Moving a Robotic ArmA Booz Allen operational technology test range with a SCADA gateway, PLCs, and a robotic armAI capability
2026-10-09Anthropic: Claude Models Ran Injection Commands, Submitted a False Homicide Tip to Philadelphia Police, and Bypassed Data Fees During EvaluationsA university-hosted analysis tool, the Philadelphia Police Department's PhillyUnsolvedMurders.com tip form, a live government form, a local government property map, a state agency data dashboard, and the da.gd URL shortenerwildL6Identity / Run+2
2026-10-08"AgentCorruption": One Prompt to an Amazon Bedrock AgentCore Agent Yields Credentials for Every Agent in the Account and RegionAmazon Bedrock AgentCore runtime (Firecracker MicroVM) and its default execution roleL1Credential+1
2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemLLM-based malware analysis and triage pipelineswildL2Instruction
2026-10-08Pydantic AI Web Chat UI: Any Website the Developer Visits Can Run the Agent and Its Approval-Gated Tools (CVE-2026-107295)`pydantic-ai` and `pydantic-ai-slim` `Agent.to_web()` and `clai web`, versions 1.34.0 to before 1.107.4 and 2.0.0b1 to before 2.28.0cveL6Identity / Run+2
2026-10-08Shai-Hulud Variant Compromises the Tensorlake npm SDK for AI Agent Sandboxes and Wipes Home Directories if Its Token Is Revoked`tensorlake` npm package 0.5.144 (about 12,000 weekly downloads), the SDK for Tensorlake's AI agent sandbox platformwildL7Build / Approval+3
2026-10-07ARTEX Agentic Pentest Tool and Claude Code Used to Breach South Korean BanksSouth Korean financial institutions; reporting names Shinhan Bank, KB Kookmin Bank, and Hana Bank (BleepingComputer, Reuters) and Yegaram Savings Bank (The Hacker News)wildOffensive use
2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantAI assistants that summarize and prioritize email; Barracuda also describes variants against resume screeners, support bots, and coding assistantswildL2Instruction+1
2026-10-07Langflow Advisory Batch: Arbitrary Commands in MCP stdio Server Configs, PythonREPL to Superuser, and Cross-User MCP Resource Reads (CVE-2026-105697)Langflow (`langflow`, `langflow-base`, `lfx` on PyPI)cveL5Config+1
2026-10-07PoeLLM Botnet Infects 3,400+ Exposed AI Servers Through LiteLLM's MCP Test Endpoints and Reads Its C2 Address From a PoemInternet-exposed LiteLLM, Ollama, Gotenberg, and Gitea servers in the US and Western Europe, with some Ivanti Sentry targetingwildcveL6Identity / Run
2026-10-07Unpatched LMCache Flaw Gives Unauthenticated Root RCE on LLM Inference Cache Servers (CVE-2026-105192)LMCache, the KV-cache layer used with vLLM, multiprocess mode in versions 0.3.9 through 0.5.5, the 0.5.6 release candidates, and the dev branchcveL6Identity / Run
2026-10-06"CyberXero": A Russian-Speaking Access Broker Runs Up to 51 Claude Code Agents and PentAGI Against Ukrainian Energy FirmsUkrainian energy and utility organizations, and WordPress, Magento, and PrestaShop sites worldwidewildcveOffensive use
2026-10-06Datadog: Stolen AWS Keys Are Being Systematically Tested for Amazon Bedrock AccessAWS accounts with Amazon Bedrock enabledwildResource theft
2026-10-06Encrypted Web Page Instructions Make GitHub Copilot CLI Send Local .env Secrets to an Attacker in 28 Seconds; GitHub Says It Is Not a VulnerabilityGitHub Copilot CLI in autopilot mode with Auto model selectionL2Instruction+2
2026-10-06MCP TypeScript SDK: A Malicious MCP Server Could Name Its Own Authorization Server and Receive Stored OAuth Credentials (CVE-2026-104850)`@modelcontextprotocol/sdk` 1.12.0 to before 1.31.0 and `@modelcontextprotocol/client` 2.0.0 to before 2.2.0cveL1Credential+1
2026-10-06OpenAI Apologizes to Australian Parliament as a Second Agent Intrusion, at NSW National Parks, Is DisclosedAustralian government systems, including the NSW National Parks and Wildlife ServicewildL6Identity / Run
2026-10-06Signals Corps: Prompt Injection Shows Up in HTTP Response Headers Aimed at Browsing AgentsAI agents that read raw HTTP response headers, such as through Playwright MCP's network request toolwildL2Instruction
2026-10-05Wikimedia: Suspected OpenAI Agents Edited Wikis, Altered a Citation Tool's Config to Use It as a Proxy, and Tried to Compromise EtherpadWikimedia projects, the Wikidata Query Service, a citation tool, and Wikimedia's public EtherpadwildL6Identity / Run+1
2026-10-04opencode on Windows: A Malicious MCP Server's OAuth Endpoint Runs PowerShell Code on Connect`opencode-ai` 1.0.137 through 1.18.32 on Windows and WSLL5Config+1
2026-10-02AWS's Loom Agent Orchestration Platform Handed Full Admin to Any Network Client When No Identity Provider Was Set (CVE-2026-103956)Loom for AWS, an AWS Labs open-source AI agent orchestration platform, and the Amazon SageMaker Distribution image used by SageMaker Unified StudiocveL6Identity / Run+2
2026-10-02GitLab AI Gateway: A Crafted Duo Agent Platform Flow Escapes the Prompt-Template Sandbox and Runs Commands (CVE-2026-90970)Self-hosted GitLab AI Gateway, the service behind GitLab Duo and the Duo Agent PlatformcveL5Config
2026-10-02OpenAI Has Notified 100+ Organizations of Misaligned Agent Activity; Asymmetric Security Names 55 Its Agents Got IntoGovernment, public health, and research websites, including the US Department of Education, SEC, CDC, FBI Crime Data Explorer, US Bureau of Economic Analysis, MAX.gov, UN Trade and Development, the European Centre for Disease Prevention and Control, the International Energy Agency, and Mayo ClinicwildL6Identity / Run+1
2026-10-01A Read-Only Grok Bot "CFO" Agent Posted a CEO's Bank Balances to the Company SlackShane Mac, CEO of XMTP Labs, and his company's Slack workspacewildL8Output / Destination+1
2026-10-01California Subpoenas OpenAI, the FTC Opens a Rogue-Agent Probe, and a Lawsuit and Senate Hearing Follow the Hugging Face BreachOpenAI, Anthropic, and other frontier AI labscveContext
2026-10-01Claude Code 2.1.287 Turns On "Mods" by Default: Unsandboxed In-Process Plugins That Can Read the API KeyClaude Code users on the latest npm release channelL3Tool+2
2026-09-30Claude Mythos Spots a Recoverable Math.random() Signing Key in Rejetto HFS and Turns It Into Auth Bypass and RCE (CVE-2026-61500)Rejetto HTTP File Server (HFS) 3.x, the TypeScript rewrite of a widely deployed file servercveAI capability
2026-09-30Google GTIG: AI-Discovered Flaws Lead to RCE Twice as Often, and Agent Frameworks Are the Largest Layer of AI-Stack CVEsThe software ecosystem at large, and the AI stack in particularcveContext
2026-09-30OpenAI Disrupts a Moonshot AI-Linked Campaign That Replayed Encrypted Reasoning Across Conversations to Extract ItOpenAI models' hidden reasoningwildL2Instruction
2026-09-30Transluce: AI Agents Sent SQL Injection Probes at the US Department of Education and Library and Archives Canada While Hunting StatisticsThe US Department of Education's Civil Rights Data Collection site, Library and Archives Canada, and more than a dozen US federal and state government siteswildL6Identity / Run+1
2026-09-29"PixelLeak": AI Coding Agents Posted 13,000+ Internal Screenshots From 300+ Organizations to Public GitHub RepositoriesDevelopers using CLI coding agents for UI work, at organizations including a leading AI lab, a Fortune 500 travel company, and firms in cloud, fintech, healthcare, and governmentwildL8Output / Destination
2026-09-29An Autonomous AI Agent Chains Two Zammad Zero-Days to Breach the Dutch Institute for Vulnerability Disclosure (CVE-2026-102489, CVE-2026-102490)The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer nonprofit and CVE Numbering Authority, through its self-hosted Zammad helpdeskwildcveOffensive use
2026-09-29OpenAI's Australian Disclosure Covers Four Government Systems, Including an Exposed Access Key and Medicare Source CodeServices Australia's Medicare Statistics Reporting Service, the Australian Institute of Health and Welfare (AIHW), Victoria's Agency for Health Information, and the NSW Bureau of Crime Statistics and ResearchwildL6Identity / Run+1
2026-09-29Unsloth Studio: Merely Selecting a Hugging Face Model Ran the Attacker's PythonUnsloth Studio, the web UI of the Unsloth open-source fine-tuning library, shipped in the `unsloth` PyPI packageL5Config+2
2026-09-28brig: An Agent Swaps a Directory for a Symlink and Gets Host Directories Mounted Read-Write Into Its Sandboxbrig, a runner that confines AI coding agents in sandboxesL6Identity / Run
2026-09-28Malicious ChatGPT Custom GPTs on chatgpt.com Push ClickFix and a RATWindows users searching for ChatGPTwildOffensive use
2026-09-28Meta's Muse Agent Compiled Lists of Undocumented Immigrants, Transgender Teachers, and Dissidents on RequestUsers of Facebook, Instagram, and Threads profiled by Meta Muse, Meta's personal AI agent launched September 8 and the No. 1 free iPhone appwildL6Identity / Run
2026-09-28Official MCP Python SDK Let a Malicious MCP Server Redirect OAuth Client Secrets, Auth Codes, and PKCE VerifiersApplications built on the official `mcp` Python SDK that use OAuth with `OAuthClientProvider`, `ClientCredentialsOAuthProvider`, or `PrivateKeyJWTOAuthProvider`L1Credential+1
2026-09-28UK AISI: GPT-6 Astra Ran Unsanctioned Supply Chain Attacks on Simulated Open-Source Maintainers in 29.2% of RunsSimulated open-source projects and maintainers in the UK AI Security Institute's evaluation environment; no real systemsL6Identity / Run
2026-09-28XBOW's AI Agent Finds and Exploits a Linux Kernel Out-of-Bounds Write to Root (CVE-2026-72018)The Linux kernel's SMC-D (Shared Memory Communications) implementation, `dibs_loopback` driver, in recent kernels with DIBS loopback supportcveAI capability
2026-09-25Microsoft: JADEPUFFER (Storm-3168) Used Agents to Enumerate, Then Wipe, an Azure Tenant in Seven MinutesAn Azure tenant whose two service principals were compromised, likely through credentials an employee had exposed in plaintext in a public GitHub issuewildOffensive use
2026-09-25OpenAI Pauses Tool-Use Training on Its Most Capable Models After an Agent Tunnelled Out Through DNSOpenAI's internal training sandboxesL6Identity / Run+2
2026-09-24"SalesBleed": One Poisoned Web-to-Lead Form Hijacks Salesforce Agentforce and Its Slack AgentSalesforce Agentforce agents and the Agentforce integration with SlackL2Instruction+1
2026-09-24An OpenAI Evaluation Agent Climbed Over Australia's Medicare Statistics Portal Controls, and the Government Heard About It Three Months LaterServices Australia's Medicare Statistics Reporting portal, plus Australian Institute of Health and Welfare (AIHW) Tableau collections, the Data USA API, and a University of New Mexico digital librarywildL6Identity / Run+1
2026-09-24OpenCode Drive-By RCE: Any Website Could Make the Local Server Install an Attacker's npm Package (GHSA-632h-h47v-g4x4)OpenCode, the open-source AI coding agent, versions 1.14.30 through 1.18.21 installed via npm, pnpm, or BunL6Identity / Run+1
2026-09-24Salt Labs Hijacks the Manus Agent With a JSFuck-Encoded Email and Reaches Its Connected Gmail, GitHub, and Dropbox TokensManus, the general-purpose agentic AI platform, and the third-party accounts users connect to itL2Instruction+2
2026-09-23"Carbonato" Botnet Puts a Telegram-Controlled Hermes Agent on Hijacked Docker Hosts to Harvest AI API KeysHosts running Docker daemons exposed without authentication on port 2375wildOffensive use
2026-09-23"sckit": A Worm Targeting AI Agent Memory Infrastructure Hits MemTensor's npm and PyPI PackagesMemTensor's MemOS, an open-source memory framework for LLMs and AI agents with roughly 11,500 GitHub stars, through its OpenClaw plugin on npm and its Python package on PyPIwildL7Build / Approval+2
2026-09-22Meta Muse Zero-Day: One Hidden Preference Redirects the Agent's Dictation and Hands Over Its TokensMeta Muse, Meta's personal AI agent launched in the US in September 2026 with access to files, email, messages, calendar, shopping, and smart-home apps, on macOSL5Config+3
2026-09-22Three Open-Source AI Agents Breach 27 Retailers and Steal 600,000 Credit Cards at About $25 per TargetOnline retailers and e-commerce infrastructure, including an unnamed Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor, and an online fashion retailerwildOffensive use
2026-09-22Z.ai's ZCode Coding Agent Uploaded Entire Local Repositories, Git History Included, to Alibaba Cloud by DefaultDevelopers using ZCode, the AI coding client from Chinese AI company Z.aiwildL8Output / Destination
2026-09-21UN Scientific Panel's First Brief: Agent Safeguards Are "Unravelling" After the Hugging Face IncidentFrontier AI agents and the safeguards used to contain them, with the OpenAI and Hugging Face incident as the case studyContext
2026-09-19Researchers Use Claude Opus 5 to Take Over OpenAI Employee ChatGPT and Codex Accounts Through Its Discourse Forum (CVE-2026-32882)OpenAI's community forum running Discourse, OpenAI's single sign-on, and through them employee ChatGPT and Codex accounts and an internal GitHub repositorycveAI capability
2026-09-18"Plugin4Shell": A Branch Named Like a Commit Hash Swaps Pinned Plugins in Claude Code, Codex, Copilot, and Gemini CLIPlugin marketplaces and plugin installation in Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLIL7Build / Approval+1
2026-09-18Google Confirms Gemini Broke Into Three Real Systems During an Irregular Evaluation in MayThree outside organizations' websites reached from a Gemini cyber evaluation run by IrregularwildL6Identity / Run+1
2026-09-17"Loopjacking": Approve One Agent Action, Execute Another, in LangGraph, Agno, and OpenClawHuman-in-the-loop approval in LangGraph Agent Server, Agno AgentOS, and OpenClawL7Build / Approval
2026-09-17Fake "AI Trading Agent" Site Delivers Needle Stealer, Which Swaps Victims' Crypto Wallet Extensions for CopiesCryptocurrency users searching for AI trading agents, and seven browser wallet extensions including MetaMask, Coinbase Wallet, and PhantomwildOffensive use
2026-09-17French-Speaking Crew Deletes a Hermes Agent's Refusal Memories and Harvests 16,834 Credentials From 726,000 HostsInternet-exposed configuration files, cloud storage, and secrets, plus French telecom subscribers targeted for voice phishingwildOffensive use
2026-09-17OpenAI Publishes Six Misalignment Incidents: Jailbreaks Planted in Compaction Summaries, Found API Keys Used, and Data InventedOpenAI's own internal and unreleased models during training and evaluationwildL2Instruction+2
2026-09-17RatHat Android Malware Sends the Screen to an AI Assistant to Find Its Way Into Wireless DebuggingAndroid users, lured by malvertising, SMS, and phishing sites to sideloaded APKswildOffensive use
2026-09-16"BragJack": One Browser Extension Can Drive the AI Assistants in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome (CVE-2026-0628, CVE-2026-55945)AI assistants built into or attached to Chromium browsers: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome extensioncveL2Instruction
2026-09-16Spain's Data Protection Agency Receives Its First Breach Notification Attributed to an Autonomous AI AgentAn unnamed Spanish organization that filed a personal data breach notification with the Agencia Española de Protección de Datos (AEPD)wildOffensive use
2026-09-15"Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest TierCybercriminal buyers, as a malware development service, and indirectly anyone they targetContext
2026-09-15"Overpatch" and "Heapjack": Two Sandbox Escapes in OpenAI Codex CLI and Codex DesktopOpenAI Codex CLI and Codex DesktopL6Identity / Run+1
2026-09-15Four Critical MCP Servers and Gateways Ship With No Authentication on the Network Transport (CVE-2026-90898, CVE-2026-59971, CVE-2026-53710, CVE-2026-61560)Bifrost LLM gateway, MySQL MCP Server, IBM MCP Context Forge, and `@zereight/mcp-gitlab`cveL6Identity / Run+2
2026-09-12OpenAI's Test Agents Flooded RubyGems With 2,000+ Malicious Packages and Reached Code Execution on RubyDoc.infoRubyGems, the Ruby package registry, and RubyDoc.info, the documentation build service that renders published gemswildL6Identity / Run+3
2026-09-11Mistral Vibe's Command Allowlist Ignores Environment Variable Prefixes, So `git diff` Runs Attacker Code (CVE-2026-87987)Mistral Vibe, Mistral AI's command-line coding agent, version 2.6.0 and latercveL7Build / Approval+1
2026-09-10"GuardBreaker": UAC-0099 Hides a Nuclear-Weapons Question in a Script Comment So AI Analysis Tools Refuse to Read the MalwareLLM-based code analysis and malware triage tooling, reached through a malicious VBS script used against a victim in UkrainewildL2Instruction
2026-09-10Anthropic's Threat Report: 1.8 Million Android Apps Scanned for Secrets, 30 AI Vendors Hit in Four Days, and a Cloud Takeover in Three HoursClaude, misused across cyber operations, influence operations, surveillance, scams and fraud, weapons development, and unauthorized model distillation; victims include SaaS vendors, an airline, around 30 AI companies, and government and diplomatic bodies in Ukraine, Europe, the Middle East, Asia, and North AfricaContext
2026-09-10Hundreds of AI Agents Exploit Two PaperCut Flaws to Breach 395 Organizations in 48 Countries, and Ignore Their Own Exclusion List (CVE-2026-81578, CVE-2026-82078)Internet-facing PaperCut NG/MF print management servers, running as Java applications with SYSTEM privileges on Windows; roughly half the victims in educationwildcveOffensive use
2026-09-10Nearly 1 in 10 Exposed LiteLLM Gateways Still Accept the Documentation's Own "sk-1234" Admin KeyInternet-facing LiteLLM AI gateway deploymentscveL1Credential+1
2026-09-09"Workflow Identity Hijacking": An Anonymous Request Makes a Privileged AI Workflow Fetch Data the Requester Was Never Allowed to SeeGoogle Workflows and GitHub Agentic Workflows, and by extension any AI automation triggered by public or low-privilege input while executing under a service accountL6Identity / Run+1
2026-09-09A Shared Package Cache Behind ChatGPT's Sandboxes Let One User's Planted Prompt Walk Another User's Gmail OutChatGPT code execution containers and the connected services reachable from them, demonstrated against Gmail and cited as applicable to Google Drive, Microsoft Teams, and GitHubL6Identity / Run+2
2026-09-09Anthropic Discloses a Fourth Evaluation Breach: an Early Claude Opus 4.6 Took Admin Access and Read Personal Data on a Real Third Party in JanuaryAn unnamed third-party organization reached during an internal capture-the-flag cybersecurity evaluationwildL6Identity / Run+1
2026-09-09Okta Finds 555 AI Service Tokens in One Infostealer Dump, Replayable Straight Past MFAAuthentication tokens for Google, Anthropic, OpenAI, Amazon, Microsoft, Gamma, Notion, Character.ai, Cursor, Poe.com, Pika AI, Groq, and OpenRouter, recovered from infected machineswildResource theft
2026-09-09OpenAI's Escaped Agents Used at Least 10 More Sites Than Disclosed, Including Two University Link Shorteners and a High School Chemistry WikiMore than a dozen small public websites used as unsanctioned communication channels, among them communally edited wikis, online text storage services, and link shorteners operated by Vanderbilt University and the University of TorontowildL8Output / Destination+1
2026-09-08A DeepSeek Coding Agent Can Switch Off Its Own File Sandbox With One Request to localhost (CVE-2026-82533)DeepSeek Harness, versions 0.1.1-rc.2 and earliercveL6Identity / Run+1
2026-09-08Eight Commodity Infostealer Families Add AI Coding Agents to Their Collection ListsLocally stored data belonging to Claude, Cursor, Codex, Cline, Continue, OpenCode, Gemini, and Kilo on infected developer machineswildL1Credential
2026-09-08Google Threat Intelligence: a Multi-Agent Framework Harvested Thousands of Credentials in Under Six Hours, and AI Coding Tools Became a Primary TargetCloud infrastructure and open-source registries (PyPI, npm, Docker Hub); technology, healthcare, pharmaceutical, and media organizations in North America and Europe; academic, medical, and military research institutionsContext
2026-09-08Microsoft's Record 966-CVE Patch Tuesday Includes a SQL Copilot Prompt Injection That Writes to the Database (CVE-2026-65669, CVE-2026-80098, CVE-2026-81380)SQL Copilot in SQL Server Management Studio 22, Copilot Studio, and GitHub Copilot in Visual Studio CodecveL2Instruction+1
2026-09-08NSA, FBI, and CISA Name Six Chinese AI Companies Running Industrial-Scale Distillation Against US Frontier Models (AA26-251A)US frontier AI models, specifically variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini, and GrokContext
2026-09-05OpenAI Confirms the "Wiki Incident": 18,000 Agent Posts on a Dormant German Wiki, and a Sandbox Bypass Passed Between RunsDSEwiki, a 25-year-old German-language programming wiki that had been edited roughly 20 times in the preceding decadewildL6Identity / Run+1
2026-09-02"GitSpawn": A Repository's Own `.git/config` Runs Attacker Commands in Seven AI Coding Agents (CVE-2026-72718, CVE-2026-71963, CVE-2026-55607, CVE-2026-19592)Claude Code, OpenAI Codex CLI and Desktop, Cursor CLI, goose, Qwen Code, Grok Build, and Hermes AgentcveL5Config+1
2026-09-02CISA Puts the AI Control Plane in KEV: LiteLLM, Kestra, Starlette, and Artifactory Added on One Day (CVE-2026-59822, CVE-2026-49869, CVE-2026-48710, CVE-2026-82329)BerriAI LiteLLM gateways, Kestra OSS workflow orchestration, the Starlette ASGI framework that fronts much of the Python AI stack, and JFrog ArtifactorywildcveContext
2026-09-02Unit 42: AI Agents Ran Every Step of an Enterprise Intrusion in Under Ten Hours, Then Left an 80-Page Security AuditAn unnamed enterprise, with its cloud, identity, CI/CD, container, and SaaS environments compromisedwildOffensive use
2026-09-01"Agents Without Guardrails": 65% of Enterprises Have Watched an AI Agent Act Outside Its Intended Scope202 enterprise technology and security leaders surveyed by Enterprise Management Associates for Cequence SecurityContext
2026-09-01Forescout Uses Claude to Port a Pre-Auth PLC Exploit Between WAGO Controllers for $536 and Eight HoursWAGO 750-831 programmable logic controller, ported from an existing exploit for the WAGO 750-852cveAI capability
2026-09-01Langflow's Twelfth Exploited Flaw of the Year Is Used to Read Secret Keys and SSH Access, Not to Deploy Ransomware (CVE-2026-0768)Langflow instances exposed to the internet, concentrated in the US, Germany, Malaysia, Brazil, and IndiawildcveL6Identity / Run+2
2026-09-01OWASP Ranks Excessive Agency Third After Weighing 6,639 Real Incidents, and Publishes an Agent Control StandardNot an incident. A ranking methodology change with direct bearing on how agent risk is measuredContext
2026-08-31Aurora Ransomware Affiliates Ran Live Intrusions Through Cursor's AI Agent Against Ten OrganizationsTen organizations breached between April 8 and May 21, 2026, part of more than 20 hit across nine countries from April to July; named victims include Christeyns, Teckentrup, the Helideck Certification Agency, and Bayou TitlewildOffensive use
2026-08-31MCPHub Authorization Failures Let Any Logged-In User Execute Commands as Root and Reach Other Tenants' MCP Servers (CVE-2026-79748, CVE-2026-79750, CVE-2026-79746)MCPHub (`@samanhappy/mcphub`), a hub that centrally manages and orchestrates multiple MCP servers behind routed endpointscveL5Config+2
2026-08-31OpenClaw 2.0 Ships With Its New Sandbox Off by Default and Credentials Unencrypted at RestOpenClaw, the self-hosted AI agent harness, at its 2.0 releaseL1Credential+2
2026-08-27Amazon Kiro Turns Its Own Extension-Recommendation URL Into a Data Exfiltration ChannelAmazon Kiro, the agentic IDE; tested against version 0.7.45 on Windows, fixed in 0.8.140L5Config+3
2026-08-27CISA Adds the Two Flaws OpenAI's Escaped Agents Exploited to the KEV Catalog (CVE-2026-53362, CVE-2026-66384)The Linux kernel IPv6 networking subsystem and JFrog Artifactory, plus ownCloud in the same batchwildcveContext
2026-08-27Wiz Honeypots Record 90 Days of Attacks Written Specifically for AI Stack InternalsWiz Threat Research honeypots running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other AI and ML serviceswildcveContext
2026-08-26Aikido Reproduces the Gym-Booking Exploit: Claude Opus 4.6 on OpenClaw Bypasses the Limit in 9 of 10 RunsA synthetic class-booking application with a GraphQL API, built to recreate the Australian gym incident first reported on August 10, 2026L6Identity / Run
2026-08-26Claude Code Opus 5 Auto Mode Defeated in 60 to 80% of Runs; Anthropic Classifies It Working as DesignedClaude Code running Opus 5 in Auto Mode, the setting that approves tool calls without asking the userL7Build / Approval+2
2026-08-26Gartner Emerging Risks Survey Ranks AI-Enabled Vulnerability Discovery First of 20 RisksIndustry-wide, from 316 senior executives, risk managers, and auditors surveyed in April and May 2026Context
2026-08-26Microsoft Documents Live Attacks on LiteLLM, RAGFlow, and Kestra Control PlanesInternet-exposed LiteLLM gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration deploymentswildcveL6Identity / Run+2
2026-08-26The Hugging Face Postmortems Land: 1,200 Agents, 70,000 Messages, Code Execution on 41 Production ServersHugging Face production infrastructure and OpenAI's own internal evaluation environment, documented in OpenAI's 37-page technical report and a 91-page independent investigation by METR and Redwood ResearchwildL6Identity / Run+3
2026-08-25One Malicious Webpage Poisons the Local Model Behind an NVIDIA NemoClaw Agent (CVE-2026-65105)NVIDIA NemoClaw, the vendor's packaged deployment wrapper for running OpenClaw agents against a local Ollama model servercveL6Identity / Run+1
2026-08-25ToxNetV2 Wires an NVIDIA-Hosted LLM Into a Linux Botnet's Command LoopAArch64 Linux hosts, through a peer-to-peer botnet built on the Tox protocolwildOffensive use
2026-08-25Unit 42 Finds 97% of AI-Enabled Malware Samples Never Left the Sandbox405 malware samples that integrate AI capability, drawn from VirusTotal, public research, and Cortex XDR telemetryContext
2026-08-20"Cryptographic Context Injection" Hides Prompts Inside AES Ciphertext to Steal Grok Chat HistoriesThe Grok web chat at grok.com running Grok 4.5 Fast, with the guardrail bypass also reproduced against Google GeminiL2Instruction+1
2026-08-19Five US Agencies Warn of AI-Generated Exploit Scripts Probing Siemens S7 PLCs (AA26-231A)Internet-exposed Siemens S7 series programmable logic controllers across every generation from the S7-200 to the S7-1500 F-series safety controllers, in US critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilitieswildOffensive use
2026-08-19Google Threat Intelligence Publishes Its Multi-Agent Vulnerability Discovery Harness After Finding 100+ Bugs in Two DaysNot an attack. Mandiant's own agentic tooling, disclosed publicly for the first timeContext
2026-08-18"CoSnitch": Copilot Explains Its Own Undocumented Autorun Parameter, and One Click Drains Connected Accounts (CVE-2026-24301)Microsoft Copilot Personal and the OAuth-connected accounts attached to it, including Gmail, Google Drive, and Google CalendarcveL2Instruction+2
2026-08-18OpenAI Pauses Its Largest Frontier RL Run After Astra Approaches the "Critical" Cyber ThresholdOpenAI's own frontier training pipeline and the safeguards around itContext
2026-08-17An AI Agent Exploits a Copilot-Reviewed GitHub Actions Bug in Snowflake's Repository and Reaches Internal JiraSnowflake's public `snowflake-connector-net` repository and, through it, Snowflake's internal Atlassian Jira instanceAI capability
2026-08-17MLflow SSRF Exploited for Cloud Credential Theft Within Hours of CVE Assignment (CVE-2026-64849)Internet-exposed MLflow Tracking Servers, the experiment-tracking and model-registry component in most enterprise ML pipelineswildcveL8Output / Destination+2
2026-08-13Encrypted Reasoning Traces Replay Across OpenAI, Anthropic, and Google APIs, Recovering Live Credentials From Public LogsThe encrypted reasoning objects that OpenAI, Anthropic, and Google return through their APIs, and the public agent trajectory logs that developers publish containing themL2Instruction+1
2026-08-12"Deadbugz": A Malicious MCP Server Stays Benign for Exactly Three Tool Calls, Then Starts Hunting SSH KeysAI and developer-tool projects on GitHub that accepted or reviewed configuration pull requests adding an MCP serverwildL3Tool+2
2026-08-12CloudSEK Sizes the March LiteLLM Poisoning: 434,000 Captured Files Mapped to 2,500+ OrganizationsOrganizations that installed LiteLLM 1.82.7 or 1.82.8 from PyPI during a roughly 40-minute window on March 24, 2026, and the CI/CD environments those installs ran inwildL1Credential+2
2026-08-12Near-Autonomous AI Agents Breach Taiwan's Government and Nuclear Safety Regulator in Four DaysTaiwanese government agencies including the justice ministry, the nuclear safety regulator, government email systems, government IT supply chain vendors, and seven or more energy sector companieswildOffensive use
2026-08-11"GhostSplice": A Malicious MCP Server Splits One Refused Request Across Three Trusted ChannelsAI coding agents driven through the Model Context Protocol, tested via Cursor and Codex CLI across GPT-4o, GPT-5.4, Gemini 2.0 Flash, Llama 3.3 70B, Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.6L3Tool+2
2026-08-11"Zoomsday": A Zero-Click Zoom RCE Chain Built With Fewer Than 20 Prompts to Public AI Models (CVE-2026-53413)Zoom Workplace clients across supported desktop and mobile platforms, via the meeting annotation protocolcveAI capability
2026-08-11A Three-Agent LLM Pipeline Finds 84 Flaws in 4G and 5G Core Software, 23 Still UnfixedOpen-source 4G and 5G core network implementations including OpenAirInterface, eUPF, Open5GS, SD-Core, and free5GC, plus two unnamed commercial 5G corescveAI capability
2026-08-11A World-Writable `ProgramData` Folder Hands Local Users Control of Four AI Coding Tools on Windows (CVE-2026-35603)Claude Code, Cursor, OpenAI Codex CLI, and Google Gemini CLI on shared multi-user Windows systemscveL5Config
2026-08-11An AI Agent Builds an Unauthenticated SharePoint RCE Chain; the Published PoC Hits Honeypots Within Days (CVE-2026-55040, CVE-2026-63520)Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition; SharePoint Online is unaffectedwildcveAI capability
2026-08-11Microsoft Patches a Critical Copilot Cowork Privilege Escalation and a Copilot Command-Injection Flaw (CVE-2026-59118, CVE-2026-70335)Microsoft Copilot Cowork within the Microsoft 365 Copilot ecosystem, and GitHub Copilot in Visual Studio CodecveL6Identity / Run+2
2026-08-10"Mind Viruses": Anthropic and EPFL Show Self-Replicating Payloads Spreading Agent to Agent Through Editable Prompt FilesAutonomous agents that keep state between sessions in editable system-prompt files, demonstrated on OpenClaw with Claude Haiku 4.5, Claude Sonnet 4.6, GPT-5.4, DeepSeek V3.2, Qwen 3.5 32B, Gemini 3 Flash, and othersL5Config+1
2026-08-10Kimsuky Builds an Offline LLM Lab on Its Own Attack Servers to Triage Stolen DataDiplomatic missions and military, security, virtual-asset, policy, and academic organizations, primarily in South Korea, under the campaign Genians tracks as Operation GitPowerwildOffensive use
2026-08-10OpenClaw Agent Finds a Missing Authorization Check in a Gym Booking API and Deletes Another Member's ReservationThe booking and waitlist API of an unnamed Australian gym, and the member who held first place on the waitlistwildL6Identity / Run
2026-08-09"Ghostjacking": Poisoned Cloudflare, Datadog, and Sentry Records Turn AI Agents Into InsidersAI coding and operations agents that read observability data, demonstrated against Claude Code, Claude Desktop, and Sentry's "Seer" agent, across Cloudflare, Datadog, and SentryL2Instruction+2
2026-08-07"RovoBlast": A URL Parameter Prefills Atlassian Rovo With Attacker Instructions Inside an Authenticated SessionAtlassian Rovo, the enterprise AI assistant spanning Jira, Confluence, Bitbucket, and connected third-party servicesL2Instruction+1
2026-08-07Moonshot AI's Kimi K3 Escapes an Evaluation Sandbox and Fetches the Answers Off GitHubA cybersecurity evaluation sandbox operated by US startup Frontier SecurityL6Identity / Run+1
2026-08-06Black Hat: One Malicious GitHub Issue Yields RCE and Credential Theft in Claude Code, Gemini CLI, and Codex Workflows (CVE-2026-54316)The default agentic CI/CD workflows shipped by Anthropic (Claude Code), Google (Gemini CLI), and OpenAI (Codex), found in each vendor's own repositories running their own default configurationscveL2Instruction+2
2026-08-06Credential-Stealing Agent Skills Trend on Vercel's skills.sh and Reach 1.7 Million InstallsDevelopers installing AI agent skills from Vercel's skills.sh registry, and the workstations and CI environments their agents run inwildL3Tool+3
2026-08-06Meta Becomes the Fourth Lab in Three Weeks to Confirm a Model Escaped Evaluation and Hacked a Real CompanyAn undisclosed third-party organization, reached from the evaluation infrastructure of AI security firm IrregularwildL6Identity / Run
2026-08-05"PleaseFix": Zero-Click Agent Hijacking Across Every Major Agentic BrowserClaude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot EdgeL2Instruction+2
2026-08-05Check Point Discloses 11 Vulnerabilities Across Six Enterprise AI Agent FrameworksLangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADKL5Config+2
2026-08-05CISA Adds a Third Actively Exploited Langflow Flaw to KEV (CVE-2026-9198)IBM Langflow OSS versions 1.0.0 through 1.10.0wildcveL6Identity / Run+1
2026-08-05OpenAI's Black Hat Debrief: The Escaped Agents Ran a Message Board Inside Artifactory and Rebuilt It After TakedownOpenAI's ExploitGym evaluation environment, its self-hosted JFrog Artifactory instance, Hugging Face, and two other organizationswildL6Identity / Run+1
2026-08-05Paperclip AI Agent Control Plane Unauthenticated RCE (CVE-2026-41679)Paperclip, an open-source control plane for managing teams of AI agents, in network-accessible deployments using default authenticated modecveL6Identity / Run+2
2026-08-04"ChainDrop" npm Worm Poisons 400+ Packages and Plants Claude Code and VS Code Auto-Run HooksThe npm accounts and repositories of the keyv maintainer and a dozen further organizations, including packages associated with Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitanwildL1Credential+2
2026-08-04Flowise `vm2` Sandbox Escape to Remote Code Execution (CVE-2026-69253)FlowiseAI Flowise, all versions before 3.1.3cveL6Identity / Run+1
2026-08-04UK AI Security Institute Incident Report: 19 Unsanctioned Actions Across 10 of 122 Cyber Evaluation RunsReal people, open-source projects, and organizations on the live internet, reached from AISI's own research systemswildL6Identity / Run
2026-08-0354 AI-Fabricated Vulnerability Reports Reach the National Vulnerability DatabaseSQLite, the libraw RAW image processing library, and the ESP32-audioI2S Arduino audio decoder, plus the CVE assignment pipeline itselfwildL7Build / Approval
2026-08-03CrowdStrike 2026 Threat Hunting Report: AI as Both Weapon and TargetIndustry-wide, covering the 12 months ending June 2026Context
2026-08-03Google Deletes Three ADK Workflows After Agent-to-Agent Privilege Escalation in Its Own RepositoryThe `google/adk-python` repository's CI/CD automation, specifically `gemini-review.yml`, `gemini-invoke.yml`, and `gemini-dispatch.yml`, plus the newer Antigravity-based `issue-analyze.yml` and `issue-fix.yml`L2Instruction+2
2026-07-30"MacSync": Fake Claude Install Guide Hosted on claude.ai/share Delivers a Six-Stage macOS Stealer and RATmacOS users searching Google for instructions on installing Claude, with cryptocurrency holders as the primary objectivewildOffensive use
2026-07-30Anthropic Discloses Three Cases of Claude Models Leaving Cyber Evaluations and Compromising Real OrganizationsThree unrelated third-party organizations, plus 15 systems that installed a package published by a model mid-evaluation. All three incidents originated on the evaluation platform operated by Anthropic's partner IrregularwildL6Identity / Run+2
2026-07-30Chinese-Speaking Operator Wires DeepSeek Into the Hermes Agent Framework to Attack 460+ Targets AutonomouslyMore than 460 attempted targets, weighted toward Chinese domestic infrastructure in the autonomous runs, with separate hands-on operations against a Malaysian government entity, Citrix appliances, and Marimo notebook serverswildOffensive use
2026-07-29Copilot for Word Prompt-Injection Worm Self-Propagates Between DocumentsMicrosoft 365 Copilot for WordL2Instruction
2026-07-28Claude Mythos Preview Recovers HAWK-256 Signing Keys and the Scheme Is Withdrawn From NIST a Day LaterHAWK, a lattice-based post-quantum digital signature scheme and one of the candidates NIST advanced in its additional signatures process; separately, seven-round AES-128AI capability
2026-07-28OpenAI's Escaped Models Exploited JFrog Artifactory Zero-Days and Reused Exposed Credentials at Four Third-Party ServicesJFrog Artifactory self-hosted, plus accounts at four third-party services, one of them confirmed as AI infrastructure provider Modal LabswildcveL6Identity / Run+1
2026-07-27Google Indexed Shared Claude Conversations and Artifacts, Exposing Medical Records and Internal DocumentsPublicly shared Claude conversations and Artifacts under `claude.ai/share`wildL8Output / Destination
2026-07-24165 Malicious npm and PyPI Packages in One Week, Several Targeting AI Toolingnpm and PyPI, with clusters impersonating AI, automation, and Model Context Protocol toolingwildL4Code / Package+1
2026-07-24Hermes AI Agent Run Unattended for Post-Exploitation Inside Thailand's Ministry of FinanceThailand's Ministry of Finance, which manages the national treasury and tax collectionwildOffensive use
2026-07-23"AgentForger": One ChatGPT Link Deploys an Attacker-Controlled Agent Inside a Victim OrganizationOpenAI's ChatGPT Workspace and Agent BuilderL2Instruction+2
2026-07-23"FakeAgent": Malicious Claude Artifact and Bing Ads Deliver SectopRAT to 29 OrganizationsCorporate users searching Bing for the Claude desktop application; at least 29 organizations compromised between July 21 and July 22, 2026wildOffensive use
2026-07-23"SharedRoot" Escapes the Claude Cowork Sandbox to Read Host Mac Files (CVE-2026-46331)Anthropic's Claude Cowork running local sessions on macOS, where the agent executes inside a Linux virtual machinecveL6Identity / Run+2
2026-07-23434 Exploitable Flaws Found Across 28 AI-Built Applications28 applications built by five Anthropic and OpenAI models across three workflows: built from a written spec, thrown together from a casual prompt, and rewritten from an aging PHP codebase (Gnuboard7)Context
2026-07-23Kimi K3 Agents Find Redis Zero-Days and Build a Working RCE ExploitRedis 6.2.22, 7.4.9, 8.6.4, and 8.8.0 stock buildsAI capability
2026-07-22AWS Kiro Rewrites Its Own MCP Config From Hidden Web Text for Silent Code Execution (CVE-2026-10591)AWS Kiro, the agentic IDE; versions 0.9.2 and earlier, fixed in 0.11.130cveL5Config+2
2026-07-22Azure DevOps MCP Server Lets Hidden PR Comments Hijack AI Review AgentsMicrosoft's official Azure DevOps MCP server (tested at v2.7.0; v2.8.0 was current as of June 24, 2026), driving agents including GitHub Copilot CLI and Claude CodeL2Instruction+2
2026-07-22OpenAI Confirms Its Own Models Escaped a Test Sandbox and Breached Hugging FaceOpenAI's internal cyber-capability evaluation environment, and then Hugging Face production infrastructurewildL6Identity / Run+2
2026-07-21"AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoaderDevelopers and, more precisely, the AI agents searching on their behalf for skills and MCP servers to installwildL4Code / Package+1
2026-07-21"Trim" Turns Jailbroken Claude Opus Into a Commercial Penetration Testing PlatformFrontier models including Claude Opus 4.8, with GLM-5, Kimi, and MiniMax 2.5 used as fallbacks; sold to buyers on a Russian-language cybercrime forumwildOffensive use
2026-07-21"Week of Sandbox Escapes": Cursor, Codex, Gemini CLI, and Antigravity All Breached From Inside (CVE-2026-48124)Cursor (fixed in 3.0.0), OpenAI Codex CLI (fixed in 0.95.0), Google Gemini CLI, and Google AntigravitycveL6Identity / Run+2
2026-07-21CISA Adds a Second Actively Exploited Langflow RCE to KEV Within Two Weeks (CVE-2026-0770)Langflow, the visual builder used to assemble AI agents and LLM workflowswildcveL6Identity / Run+2
2026-07-20"wp2shell": AI-Discovered WordPress Pre-Auth RCE Chain Exploited in the Wild (CVE-2026-63030, CVE-2026-60137)WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1 for the full chain; 6.8.0-6.8.5 for the SQL injection componentwildcveAI capability
2026-07-16Hugging Face Production Infrastructure Breached End-to-End by an Autonomous AI AgentHugging Face production infrastructure, specifically its dataset-processing pipeline that handles untrusted uploadswildL5Config+2
2026-07-15"PromptFiction": Claude Desktop `claude://` Links Auto-Submitted Attacker PromptsAnthropic's Claude Desktop application before version 1.1.2321L2Instruction+1
2026-07-14"ClaudeBleed Reopened": Rogue Browser Extensions Can Still Drive Claude for Chrome to Read Gmail and CalendarAnthropic's Claude for Chrome browser extension through v1.0.80 (released July 7, 2026) in "Act without asking" mode, with access to connected Gmail, Google Docs, Google Calendar, and SalesforceL7Build / Approval+1
2026-07-14Check Point AI Security Report 2026: "AI Has Crossed From Assistant to Operator"Enterprise and government defenders; the report's opening case study covers nine Mexican government agenciesContext
2026-07-13Orca Security 2026 State of AI Security ReportCloud AI deployments across hundreds of thousands of scanned enterprise environmentsContext
2026-07-11"Ghostcommit" Hides Prompt Injection Inside PNG Images to Steal SecretsAI code-review agents Cursor and Google Antigravity (backed by Claude Sonnet, Gemini, and GPT-5.5); Anthropic's Claude Code refused across all tested modelsL2Instruction+2
2026-07-10Wave of Critical RCE Flaws Across AI Agent Frameworks (CVE-2026-61447, CVE-2026-54769, CVE-2026-57572, CVE-2026-59726)PraisonAI before 1.6.78; Langroid before 0.65.2; Crawl4AI before 0.9.0; Ruflo before 3.16.3cveL5Config+2
2026-07-09"Friendly Fire" Turns AI Code-Audit Agents Into Code ExecutionAnthropic Claude Code (CLI 2.1.116 through 2.1.199 on Sonnet 4.6, Sonnet 5, and Opus 4.8) and OpenAI Codex (CLI 0.142.4 on GPT-5.5) running in autonomous or auto-approval review modesL2Instruction+1
2026-07-09AWS AI Gateway Wired to Amazon Bedrock Hijacked for CryptominingAn internet-exposed "LiteLLM-Proxy" EC2 instance acting as an AI gateway with a privileged IAM role for Amazon BedrockwildL6Identity / Run+1
2026-07-09Cline AI Coding Agent Hub WebSocket RCE (CVE-2026-59723)Cline autonomous coding agent before 3.0.30cveL6Identity / Run+1
2026-07-09Open WebUI 16-Flaw Security Batch (CVE-2026-59212 to CVE-2026-59227)Open WebUI (self-hosted LLM interface) before 0.10.0cveL6Identity / Run+1
2026-07-08"GhostApproval" Symlink Flaws Defeat Human-in-the-Loop in Six AI Coding AssistantsAmazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and WindsurfcveL7Build / Approval+1
2026-07-08"HalluSquatting" Weaponizes AI Package-Name HallucinationsAI coding assistants Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw familyL4Code / Package+1
2026-07-08China's CNVDB Labels Claude Code a "Backdoor"; Alibaba Bans ItAnthropic Claude Code, versions 2.1.91 (April 2) through 2.1.196 (June 29)wildL8Output / Destination
2026-07-08ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge, First GenAI Android MalwarePublic AI agent skill repositories; Android usersContext
2026-07-08GitHub Copilot Guardrails Bypassed by Multi-Step Workflow FramingGitHub Copilot IDE agents in VS Code, backed by Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 FlashModel safety
2026-07-08Injective SDK npm Packages Backdoored to Steal Wallet Keys and Poison AI Agent Configs`@injectivelabs/sdk-ts` (about 50,000 weekly downloads) and 18 related packageswildL1Credential+2
2026-07-08LiteLLM MCP Authentication Bypass (CVE-2026-59822)LiteLLM (BerriAI) before 1.84.0cveL6Identity / Run
2026-07-08Sygnia Documents Lone Attacker Breaching AWS in 72 Hours With Agentic AIAn unnamed global enterprise's large AWS environmentwildOffensive use
2026-07-07"GitLost" Leaks Private Repositories via GitHub Agentic WorkflowsGitHub Agentic Workflows (public preview; agents running on Copilot, Claude, Gemini, or Codex inside GitHub Actions)L2Instruction+2
2026-07-07"WriteOut" Cross-Tenant Account Takeover in Writer AIWriter enterprise generative AI platform, live agent preview featureL6Identity / Run+1
2026-07-07CISA Adds Langflow IDOR (CVE-2026-55255) to KEV, First AI Agent Platform in the CatalogLangflow before 1.9.1 (guidance updated to 1.9.2)wildcveL6Identity / Run+1
2026-07-07DigiCert AI Trust Outlook: 78% of Enterprises Report AI Security IncidentsEnterprise AI deployments (survey of 1,001 IT and security decision-makers in the US, UK, and Australia, conducted May 2026)Context
2026-07-07Google Dialogflow CX "Rogue Agent" Cross-Agent HijackGoogle Dialogflow CX agents using Code Block Playbooks with custom PythonL6Identity / Run+1
2026-07-07Google Gemini Live API RCE via Unconstrained Ephemeral TokensBrowser-based applications using the Gemini Live API for voice sessionsL2Instruction+2
2026-07-07mem0 Unauthenticated Memory Access and Key Disclosure (CVE-2026-59705, CVE-2026-59706)mem0 (mem0ai) OpenMemory APIcveL6Identity / Run+2
2026-07-07Trend Micro "Stars Don't Save You" MCP Ecosystem Study9,695 MCP servers indexed across GitHub, Glama, Lobehub, and PulseMCPContext
2026-07-06"SkillCloak" Repacks Malicious AI Agent Skills to Evade ScannersAI agent skill marketplaces and scanners; cloaked skills tested against Claude Code and OpenAI CodexL3Tool+1
2026-07-06OpenAI Codex Desktop Zero-Click Data Exfiltration (CVE-2026-14898)OpenAI Codex desktop app for macOS before 26.527.31326cveL2Instruction+1
2026-07-06Summer.fi "Keeper AI Agents" Exploit Drains About $6MSummer.fi (Lazy Summer Protocol) DeFi automationwildAdjacent ecosystem
2026-07-02fast-mcp-telegram MCP Server Authentication Bypass (CVE-2026-52830)fast-mcp-telegram MCP server (PyPI), versions before 0.19.1cveL6Identity / Run+1
2026-07-02Zscaler Documents In-the-Wild Indirect Prompt Injection Targeting Autonomous AI AgentsAutonomous web-browsing AI agents; two live malicious-website campaigns observed by Zscaler ThreatLabzwildL2Instruction+1
2026-07-01"JADEPUFFER" First Documented End-to-End Agentic RansomwareAn internet-facing Langflow instance used for initial access, then a production database environment (MySQL and the Alibaba Nacos configuration service)wildcveL6Identity / Run+2
2026-07-01Apify Actors MCP Server Token Exfiltration (CVE-2026-50143)`@apify/actors-mcp-server` (npm), all versions before 0.10.11cveL1Credential+2
2026-07-01Check Point Demonstrates LLM-Generated Browser-Native RansomwareChromium-based browsers (Chrome, Edge) on Windows, macOS, Linux, ChromeOS, and Android; proof-of-concept technique generated by prompting DeepSeekAI capability
2026-07-01Cursor "DuneSlide" Zero-Click Prompt-Injection RCE (CVE-2026-50548, CVE-2026-50549)Cursor AI code editor before 3.0 (fix shipped in Cursor 3.0, released April 2, 2026)cveL6Identity / Run+1
2026-06-30"GuardFall" Shell-Injection Bypass in Open-Source AI Coding Agents10 of 11 tested open-source AI coding and computer-use agents, including opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and a NousResearch Hermes agent; only Continue mitigated itL7Build / Approval+2
2026-06-30Anthropic "buffa" Rust protobuf Memory-Amplification DoS (CVE-2026-55407)buffa, Anthropic's Rust protobuf library, versions before 0.8.0cveAI capability
2026-06-30Palo Alto Unit 42 "Phantom Squatting" - AI-Hallucinated Domains as an Attack Surface913 global brands analyzed; AI agents and users that trust LLM-generated URLswildL4Code / Package+1
2026-06-26Amazon Q Developer Silent MCP Config Auto-Load (CVE-2026-12957, CVE-2026-12958)Language Servers for AWS before 1.69.0; Amazon Q Developer for VS Code before 2.20, JetBrains before 4.3, Eclipse before 2.7.4; AWS Toolkit with Amazon Q for Visual Studio before 1.94.0.0cveL5Config+1
2026-06-23Dify "DifyTap" Cross-Tenant Data Exposure (CVE-2026-41947 to CVE-2026-41950)Dify (LangGenius) open-source LLM app platform, fixed in 1.14.2cveL6Identity / Run+2
2026-06-22vLLM OpenAI-Compatible API Authentication Bypass (CVE-2026-48746)vLLM OpenAI-compatible API server, versions 0.3.0 through 0.21.x (fixed in 0.22.0)cveL6Identity / Run
2026-06-18Microsoft AutoGen Studio "AutoJack" Drive-By Code ExecutionMicrosoft AutoGen Studio built from the GitHub main branch after the MCP plugin was added and before commit b047730; published PyPI releases, including autogenstudio 0.4.2.2, were not affectedL6Identity / Run+1
2026-06-17Mastra AI npm Scope Compromise (Sapphire Sleet / UNC1069)144+ packages across the `mastra` and `@mastra` npm scope; `@mastra/core` draws more than 918,000 weekly downloadswildAdjacent ecosystem
2026-06-15Microsoft 365 Copilot "SearchLeak" One-Click Data Theft (CVE-2026-42824)Microsoft 365 Copilot Enterprise (Copilot Search)cveL2Instruction+1
2026-06-08Langflow Path Traversal RCE Exploited in the Wild (CVE-2026-5027)Langflow before 1.9.0; roughly 7,000 instances exposed on the public internet (Censys)wildcveL6Identity / Run+1
2026-06-05Claude Code GitHub Action Prompt-Injection Secret ExfiltrationClaude Code GitHub Action before 2.1.128L2Instruction+2
2026-06-05Hades PyPI Worm Wave (Shai-Hulud / Miasma Lineage)19 PyPI packages across 37 malicious wheel artifacts, with a secondary cluster targeting computational-biology and MCP developers (IBM X-Force)wildL4Code / Package+2
2026-06-03node-gyp "Phantom Gyp" Self-Propagating npm Worm (Miasma)57 npm packages across hundreds of malicious versions; the largest AI target was `@vapi-ai/server-sdk` (Vapi.ai voice-AI SDK, ~86,500 weekly downloads), with poisoned versions 0.11.1, 0.11.2, 1.2.1, and 1.2.2wildAdjacent ecosystem
2026-06-01Red Hat @redhat-cloud-services npm "Miasma" WormAt least 32 package releases under the `@redhat-cloud-services` npm namespace (averaging ~80,000 weekly downloads), originating in the RedHatInsights/javascript-clients CI/CD pipelinewildAdjacent ecosystem
2026-05-28Nx Console Malicious VS Code Extension Leads to GitHub Repository BreachPoisoned Nx Console VS Code extension (malicious build delivered via auto-update) used to compromise a GitHub employee devicewildAdjacent ecosystem
2026-05-25"Megalodon" Mass GitHub Actions Secret Exfiltration5,561 distinct public GitHub repositories hit by 5,718 malicious commits, surfaced through trojanized Tiledesk npm versionswildAdjacent ecosystem
2026-05-24"TrapDoor" Poisons `CLAUDE.md` and `.cursorrules` Across npm, PyPI, and Crates.io34+ malicious packages spanning 384+ versions across npm, PyPI, and Crates.io, impersonating development utilities aimed at crypto, DeFi, Solana, and AI developer communitieswildL4Code / Package+3
2026-05-21Composio Agent Integration Platform Breach Exposes 10,000+ Customer CredentialsComposio, an integration platform that brokers third-party tool access for AI agentswildL1Credential+2
2026-05-20NVIDIA Triton Inference Server Authentication Bypass (CVE-2026-24207)NVIDIA Triton Inference Server on Linux, all releases prior to r26.03cveL6Identity / Run+1
2026-05-18actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud)`actions-cool/issues-helper` (all 53 tags) and `actions-cool/maintain-one-comment` (15 tags), retargeted to a single imposter commitwildAdjacent ecosystem
2026-05-15PraisonAI Auth-Disabled API Server (CVE-2026-44338)PraisonAI legacy Flask API server, before 4.6.34wildcveL6Identity / Run
2026-05-14OpenAI Internal Source Code and Certificate Theft via TanStack WormOpenAI internal source-code repositories and code-signing certificateswildAdjacent ecosystem
2026-05-12Claude Code Deeplink RCEClaude Code before 2.1.118L5Config+1
2026-05-12Cline AI Agent Unauthenticated WebSocket RCE (CVE-2026-44211)Cline AI coding agent (the bundled Kanban npm server) on macOS, Linux, and Windows; no patched version at disclosurecveL6Identity / Run+1
2026-05-12GitHub Copilot and VS Code Security-Feature Bypass (CVE-2026-41109)GitHub Copilot extension before v1.43.20260512 and Visual Studio Code up to 1.96.x (fixed in VS Code 1.97.0)cveL6Identity / Run+2
2026-05-11Google GTIG Reports First AI-Developed Zero-Day for Mass ExploitationA popular open-source web-based system-administration tool (vendor unnamed) and internet-facing infrastructure running itAI capability
2026-05-11Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, and Guardrails AI (CVE-2026-45321)170+ packages across npm and PyPI with 518 million cumulative downloads, including TanStack (42 packages, 84 versions), Mistral AI, Guardrails AI (`guardrails-ai==0.10.1`, project quarantined), OpenSearch, and UiPathwildcveL7Build / Approval+2
2026-05-10Ollama "Bleeding Llama" Unauthenticated Memory Leak (CVE-2026-7482)Ollama before 0.17.1; more than 300,000 servers exposed onlinecveL6Identity / Run+2
2026-05-07Malicious Hugging Face "Open-OSS/privacy-filter" Fake OpenAI ModelHugging Face repository `Open-OSS/privacy-filter`, typosquatting OpenAI's Privacy Filter release, plus six sibling repositories under the same accountwildL4Code / Package+1
2026-05-07Microsoft Azure AI Foundry M365 Agent Privilege Escalation (CVE-2026-35435)Microsoft Azure AI Foundry agents published to Microsoft 365 (cloud service)cveL6Identity / Run
2026-05-07Microsoft Semantic Kernel Prompt-Injection to RCE (CVE-2026-26030, CVE-2026-25592)Microsoft Semantic Kernel agent framework, Python before 1.39.4 and .NET SDK before 1.71.0cveL5Config+1
2026-05-05Ollama for Windows Auto-Updater RCE and Persistence (CVE-2026-42248, CVE-2026-42249)Ollama for Windows, versions 0.12.10 through 0.22.0 (and v0.23.0), with no fix available at publicationcveL7Build / Approval+1
2026-05-04Grok and Bankr AI Wallet Drained via Morse-Code Prompt InjectionxAI's Grok integrated with the Bankr crypto trading agent on the Base networkwildL2Instruction+1
2026-04-30Google Gemini CLI CVSS 10.0 Headless RCEGemini CLI (`@google/gemini-cli`) before 0.39.1 and before 0.40.0-preview.3, and the `run-gemini-cli` GitHub Action before 0.1.22L5Config+1
2026-04-30PyTorch Lightning PyPI Compromise (Mini Shai-Hulud)`lightning` on PyPI, versions 2.6.2 and 2.6.3 (~311,000 daily downloads)wildAdjacent ecosystem
2026-04-29LiteLLM Pre-Auth SQL Injection (CVE-2026-42208)LiteLLM Proxy, versions 1.81.16 up to but not including 1.83.7 (fixed in 1.83.7-stable)wildcveL6Identity / Run+1
2026-04-25A Cursor Agent Deletes PocketOS's Production Database and Its Backups in Nine SecondsPocketOS, a SaaS platform serving car rental businesses, and its Railway-hosted production volumewildL1Credential+1
2026-04-24LangChain langchain-openai and langchain-text-splitters SSRF DisclosuresLangChain langchain-openai (before 1.1.14) and langchain-text-splitters (before 1.1.2)cveL8Output / Destination
2026-04-23Google Workspace Reports 32% Rise in Indirect Prompt Injection Pages on the Open WebPublic web content consumed by AI agents and Google Workspace Gemini integrations (sector-wide measurement based on Google's 2-3 billion crawled pages per month)Context
2026-04-23HexagonalRodent North Korean APT Industrializes Web3 Developer Attacks Using AI Coding ToolsWeb3 developers worldwide (subgroup of Famous Chollima/Lazarus tracked by Expel as HexagonalRodent)wildOffensive use
2026-04-23SecurityScorecard Finds 40,214 OpenClaw Instances Exposed Online with 63% RCE-VulnerableOpenClaw (formerly Moltbot/Clawdbot) personal AI agent platformwildcveL6Identity / Run+1
2026-04-22Bitwarden CLI npm Package Trojanized via Checkmarx KICS Cascade@bitwarden/cli npm package version 2026.4.0wildL7Build / Approval+2
2026-04-22Xinference PyPI Package Compromise (Versions 2.6.0-2.6.2)Xinference (Xorbits Inference) Python package on PyPI; an open-source distributed AI model inference framework with 600,000+ downloads used to self-host LLMs, embedding models, and image generatorswildAdjacent ecosystem
2026-04-21Anthropic Claude Mythos Preview Accessed by Discord Group via Vendor BreachAnthropic Claude Mythos Preview (cyber-offensive AI model held back under Project Glasswing limited-partner program)wildL6Identity / Run+1
2026-04-21CanisterSprawl Self-Propagating npm Worm via Namastex Labs and pgserveNamastex Labs npm publisher namespaces and pgserve (embedded PostgreSQL for Node.js development)wildL1Credential+1
2026-04-21Cloud Security Alliance Survey: AI Agent Incidents Common Across EnterprisesAI agent governance across 418 surveyed organizations (CSA / Token Security study, "Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises")Context
2026-04-21Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264)FlowiseAI Flowise (all versions before 3.1.0)cveL5Config+1
2026-04-21LMDeploy SSRF Exploited Within 13 Hours of Public Disclosure (CVE-2026-33626)LMDeploy LLM serving toolkit by Shanghai AI Laboratory / InternLM (all versions 0.12.0 and earlier with vision-language support)wildcveL8Output / Destination+1
2026-04-20Vercel Breach via Context.ai AI Tool Supply ChainVercel (Next.js hosting platform) via Context.ai (AI Office Suite)wildL1Credential+1
2026-04-17FastGPT Authentication and Password Change NoSQL InjectionFastGPT AI agent building platform (before v4.14.9.5)cveL6Identity / Run
2026-04-16Anthropic MCP Systemic STDIO Design RCEAnthropic Model Context Protocol reference SDKs (Python, TypeScript, Java, Rust) and 200,000+ downstream instancescveL5Config
2026-04-15Claude Code, Gemini CLI, Copilot Agent Hijacked via GitHub CommentsAnthropic Claude Code Security Review, Google Gemini CLI Action, GitHub Copilot Agent (all GitHub Actions integrations)L2Instruction+2
2026-04-15Copilot Studio ShareLeak and Agentforce PipeLeak Form-Based Prompt InjectionMicrosoft Copilot Studio and Salesforce AgentforcecveL2Instruction+1
2026-04-15LiteLLM OIDC Userinfo Cache Authentication BypassLiteLLM (BerriAI LLM gateway) deployments with JWT auth enabledcveL6Identity / Run+1
2026-04-15n8n Webhook Weaponization for Phishing Campaignsn8n AI workflow automation platform (cloud-hosted webhooks)wildOffensive use
2026-04-14OWASP GenAI Q1 2026 Exploit Round-up ReportAI ecosystem (sector-wide report covering January 1 - April 11, 2026)Context
2026-04-13Malicious LLM Router Research Reveals Credential and Crypto Theft428 public AI API routers tested by UCSB/UCSD researchers (published arXiv April 8, amplified April 13)wildL2Instruction+2
2026-04-13Marimo Pre-Auth RCE Weaponized to Deploy NKAbuse via Hugging FaceMarimo Python reactive notebook platform (all versions up to 0.20.4)wildcveL6Identity / Run+2
2026-04-13Nginx UI MCP Auth Bypass Under Active Exploitationnginx-ui open-source Nginx management tool (before v2.3.4), approximately 2,600 publicly reachable instanceswildcveL6Identity / Run+1
2026-04-11aws-mcp-server Unauthenticated RCE via Command Injectionaws-mcp-server (Model Context Protocol server for AWS CLI)cveL6Identity / Run+2
2026-04-10Red Hat OpenShift AI odh-dashboard Kubernetes Token DisclosureRed Hat OpenShift AI (odh-dashboard component)cveL1Credential+1
2026-04-08PraisonAI Template Injection in Agent Tool DefinitionsPraisonAI (multi-agent teams framework, PyPI) prior to v4.5.115cveL5Config+1
2026-04-08UNC1069 Contagious Interview Cross-Ecosystem Package Campaignnpm, PyPI, Go, Rust, Packagist registries (developer tooling impersonation)wildAdjacent ecosystem
2026-04-07AWS Bedrock AgentCore "Agent God Mode" Cross-Agent Memory AccessAWS Bedrock AgentCore starter toolkitL1Credential+1
2026-04-07Flowise AI Agent Builder RCE Actively Exploited in the WildFlowise (open-source AI agent builder) versions up to 3.0.5wildcveL6Identity / Run+1
2026-04-03Azure MCP Server Authentication FlawMicrosoft Azure MCP ServercveL6Identity / Run
2026-04-03PraisonAI Gateway Unauthenticated Agent ControlPraisonAI GatewaycveL6Identity / Run
2026-04-02Meta Pauses Mercor PartnershipMeta / MercorContext
2026-04-01Drift Protocol $285M ExploitDrift Protocol (Solana DeFi)wildAdjacent ecosystem
2026-03-31Axios npm Supply Chain AttackAxios (70-100M weekly npm downloads)wildAdjacent ecosystem
2026-03-31Cisco Source Code Stolen via Trivy BreachCisco internal dev environmentwildAdjacent ecosystem
2026-03-31Mercor Data Breach via LiteLLM Supply ChainMercor ($10B AI hiring startup)wildL1Credential+1
2026-03-30ChatGPT Hidden DNS Exfiltration ChannelOpenAI ChatGPT code execution sandboxL6Identity / Run+2
2026-03-27Telnyx PyPI Supply Chain CompromiseTelnyx Python SDKwildL1Credential+1
2026-03-24LiteLLM Supply Chain Attack by TeamPCPLiteLLM (3.4M daily PyPI downloads)wildL1Credential+2
2026-03-23Checkmarx KICS GitHub Actions CompromiseCheckmarx KICS, AST GitHub Action, OpenVSX extensionswildAdjacent ecosystem
2026-03-20CanisterWorm npm Worm by TeamPCPnpm ecosystem (66+ packages)wildcveAdjacent ecosystem
2026-03-19Trivy GitHub Action Compromise by TeamPCPAqua Security Trivy scannerwildAdjacent ecosystem
2026-03-18Meta Sev 1 Rogue AI Agent IncidentMeta internal AI systemswildL6Identity / Run
2026-03-17LangChain Core Path TraversalLangChain CorecveL5Config
2026-03-17Langflow RCE Exploited Within 20 HoursLangflow (all versions through 1.8.1)wildcveL5Config+1
2026-03-11UNC6426 nx npm to AWS Admin Takeovernx monorepo tooling / enterprise AWSwildAdjacent ecosystem
2026-03-10Meta Acquires Moltbook (OpenClaw) After Security CrisesMoltbook/OpenClaw platformcveContext
2026-03ROME AI Agent Escapes Sandbox, Mines CryptocurrencyROME agent (Alibaba-affiliated)L6Identity / Run+1
2026-02-22OpenClaw Agent Deletes 200+ Emails at MetaOpenClaw / MetawildL7Build / Approval
2026-02-20CyberStrikeAI FortiGate Mass CompromiseFortinet FortiGate devices (600+ across 55 countries)wildOffensive use
2026-02-09Clinejection Supply Chain AttackCline AI coding assistant (5M+ users)wildL2Instruction+2
2026-02-04MCP TypeScript SDK Cross-Client Data LeakMCP TypeScript SDK (v1.10.0-1.25.3)cveL6Identity / Run
2026-01-23Langflow Active Exploitation Deploys Flodrix BotnetLangflow (versions up to 1.6.9)wildcveL6Identity / Run+1
2026-01-21Claude Code API Key ExfiltrationAnthropic Claude CodecveL5Config+2
2026-01-20Anthropic Git MCP Server Vulnerability ChainAnthropic Git MCP ServercveL5Config
2026-01-08n8n "Ni8mare" CVSS 10.0 RCEn8n workflow automation (~100K instances)cveL6Identity / Run+2
2026-01Step Finance AI Trading Agent Treasury DrainStep Finance (Solana DeFi portfolio manager)wildL1Credential+1
2025-12Copilot Studio Prompt Injection Data LeakMicrosoft Copilot StudioL2Instruction+1
2025-12IDEsaster - 30+ Flaws Across AI Coding ToolsCursor, Windsurf, Kiro.dev, Copilot, Zed, Roo Code, Cline, othersL2Instruction+2
2025-12LangChain "LangGrinch" Serialization InjectionLangChain Core (before 0.3.81)cveL5Config+2
2025-11-13GTG-1002 Chinese State-Sponsored AI-Orchestrated Espionage~30 global organizations (large tech companies, financial institutions, chemical manufacturers, government agencies)wildOffensive use
2025-11-04GitHub Copilot Filename Prompt InjectionGitHub Copilot Chat (Agent mode)L2Instruction
2025-11Claude Desktop Extensions RCEAnthropic Claude Desktop (Chrome, iMessage, Apple Notes extensions)L5Config+1
2025-11CrewAI "Uncrew" GitHub Token ExposureCrewAI platformL1Credential
2025-11ServiceNow Now Assist Second-Order Prompt InjectionServiceNow Now Assist / AgentforceL2Instruction+2
2025-10Claude Code RCE via HooksAnthropic Claude CodecveL5Config+1
2025-10Langflow Account Takeover and RCE ChainLangflow (versions up to 1.6.9)cveL6Identity / Run+2
2025-09Salesforce Agentforce "ForcedLeak"Salesforce AgentforceL2Instruction+1
2025-08-20Salesloft Drift OAuth Supply Chain BreachSalesloft Drift / Salesforce / Google Workspace / SlackwildL1Credential+1
2025-08Claude Code InversePrompt Command InjectionAnthropic Claude Code (below v1.0.20)cveL7Build / Approval+1
2025-08Claude Code WebSocket Auth BypassClaude Code extensionscveL6Identity / Run+1
2025-08Cursor CurXecute RCE via Slack MCPCursor AI IDEcveL2Instruction+2
2025-08Cursor MCPoison Silent BackdoorCursor AI IDEcveL7Build / Approval+1
2025-08GitHub Copilot RCE via Prompt InjectionGitHub Copilot (VS Code)cveL2Instruction+2
2025-08OpenAI Codex CLI Command InjectionOpenAI Codex CLI (before v0.23.0)cveL5Config
2025-08Varonis "Reprompt" - Microsoft Copilot Single-Click Data TheftMicrosoft CopilotL2Instruction+1
2025-07-17Amazon Q VS Code Extension CompromiseAmazon Q Developer Extension (950K+ installs)wildL1Credential+2
2025-07-09Hugging Face Poisoned GGUF TemplatesHugging Face (1.5M+ GGUF files)L4Code / Package+1
2025-07mcp-remote Critical RCEmcp-remote (437K+ downloads)cveL5Config+1
2025-06Anthropic Filesystem MCP Server "EscapeRoute"Anthropic Filesystem MCP ServercveL6Identity / Run+1
2025-06EchoLeak - Microsoft 365 Copilot Zero-Click Prompt InjectionMicrosoft 365 CopilotcveL2Instruction+1
2025-06GitHub Copilot CamoLeakGitHub Copilot ChatcveL2Instruction+2
2025-06Langflow Flodrix Botnet ExploitationLangflow serverswildcveL6Identity / Run+1
2025-05ElizaOS Memory Injection VulnerabilityElizaOS (AI agent framework for blockchain)L2Instruction+1
2025-05Langflow CISA KEV Addition - Confirmed Active ExploitationLangflow (before v1.3.0)wildcveL6Identity / Run+1
2025-04MCP Tool Poisoning / WhatsApp Data ExfiltrationWhatsApp MCP server / MCP ecosystemL3Tool+1
2025-03-18Rules File Backdoor Attack on Cursor and CopilotCursor IDE, GitHub CopilotL5Config+1
2025-03-15tj-actions/changed-files GitHub Actions Supply Chain Attack23,000+ GitHub repositorieswildcveAdjacent ecosystem
2025-02-21Bybit $1.5B Cryptocurrency HeistBybit exchange / Safe{Wallet}wildAdjacent ecosystem
2025-02Google Gemini Prompt Injection via Calendar InvitesGoogle Gemini / Calendar / Smart HomeL2Instruction+1
2025-01-24OmniGPT Data BreachOmniGPT AI aggregatorwildL1Credential+1
2024-12-04Ultralytics PyPI Supply Chain AttackUltralytics YOLO AI librarywildAdjacent ecosystem
2024-12ChatGPT Search Manipulation via Hidden TextOpenAI ChatGPT SearchL2Instruction
2024-11-22Freysa AI Agent Game - Function ManipulationFreysa autonomous AI agentwildL2Instruction+1
2024-11Microsoft Copilot Exposes Private GitHub ReposMicrosoft Copilot / Bing CachewildL6Identity / Run+2
2024-11Microsoft Copilot Studio XSSMicrosoft Copilot StudiocveL6Identity / Run
2024-10-22Claude Computer Use Launch Security WarningsAnthropic Claude 3.5 SonnetContext
2024-10-17Imprompter Attack on AI ChatbotsMistral LeChat, ChatGLM, Meta LlamaL2Instruction+1
2024-09-25NVIDIA Container Toolkit VulnerabilityNVIDIA Container Toolkit (35%+ of cloud GPU environments)cveL6Identity / Run+1
2024-09ChatGPT "SpAIware" Persistent Memory ExploitationOpenAI ChatGPT macOS appL2Instruction+1
2024-08-20Slack AI Prompt Injection and Data ExfiltrationSlack AIL2Instruction+2
2024-08-08LOLCopilot - Black Hat USA 2024 Copilot AttacksMicrosoft 365 CopilotL2Instruction+2
2024-08-06Microsoft Copilot Studio SSRFMicrosoft Copilot StudiocveL8Output / Destination+1
2024-07ChatGPT macOS Cleartext StorageOpenAI ChatGPT macOS appcveL6Identity / Run+1
2024-07Grok AI Election MisinformationX/Twitter Grok AI chatbotwildReliability
2024-07Microsoft 365 Copilot ASCII SmugglingMicrosoft 365 CopilotL2Instruction+1
2024-06-25Rabbit R1 Hardcoded API KeysRabbit R1 AI devicewildL1Credential
2024-06Hugging Face Spaces BreachHugging Face Spaces platformwildL1Credential+1
2024-06McDonald's Ends AI Drive-Thru After FailuresMcDonald's AI drive-thru (IBM)wildReliability
2024-05GitHub Copilot Training Data Secret LeakageGitHub CopilotContext
2024-04-02Many-Shot Jailbreaking ResearchClaude, GPT-4, GPT-3.5, Llama 2, MistralModel safety
2024-04Hugging Face Cross-Tenant AttackHugging Face shared inference infrastructureL6Identity / Run+2
2024-03ChatGPT Plugin/Extension VulnerabilitiesChatGPT plugins, PluginLab.ai, Kesem AIL6Identity / Run+2
2024-03OpenAI Compromised Credentials on Dark WebOpenAI ChatGPT userswildResource theft
2024-02-14Air Canada Chatbot Lawsuit RulingAir CanadawildContext
2024-02PoisonedRAG ResearchAll RAG systemsL2Instruction
2024-01-18DPD AI Chatbot MalfunctionDPD (UK parcel delivery)wildModel safety