# AgentProv (full text)

> Every agent breach is a chain-of-custody failure. AgentProv is the model that names the eight links, the data that shows which ones break, and the tools that check them.

- Incidents in the catalog: 385 (2024 through 2026-10-27), 325 in 2026.
- Tagged: 385; in-model: 270; outside the model: 115.
- Top primary layer: L6 Identity / Run, 38.1% of in-model incidents.

## The AgentProv Provenance Model

Eight layers, each answering one question about where an agent action came from, ordered from the outermost boundary inward. The primary layer of an incident is the one whose failure made it possible; secondary layers are the ones it then cascaded through.

Canonical page: https://agentprov.com/model

### L1 Credential

**Should this run hold this key at all?**

The outermost link is the secret itself. An agent run inherits API keys, cloud tokens, and session cookies from whoever launched it, and every later layer assumes that inheritance was intended. When a credential is broader than the task, longer lived than the run, or readable by anything the agent loads, the rest of the chain is already compromised.

Credential provenance asks where a key came from, which run it was minted for, and whether this run should be holding it at all. Failures here look like secrets read from environment files by a helper tool, keys exfiltrated through a coding assistant, or stolen model API keys resold for inference.

Taxonomy patterns: Credential Theft via AI Tools, LLMjacking cases.

Tagged incidents: primary in 29 of 270 in-model incidents; secondary in 86.

Most recent:

- 2026-10-21: [LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python Startup](https://agentprov.com/incidents/2026-10-21-litellm-1-107-0-on-pypi-and-docker-ships-a-credential-stealer-that-runs-at)
- 2026-10-17: [OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API Keys](https://agentprov.com/incidents/2026-10-17-opencode-console-breach-exposes-users-stored-openai-anthropic-and-google-api)
- 2026-10-13: [IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)](https://agentprov.com/incidents/2026-10-13-ibm-mcp-context-forge-shipped-a-known-jwt-secret-letting-anyone-mint-platform)

### L2 Instruction

**Who actually said "do this"?**

An agent acts on text, and text has no signature. A request typed by the operator, a sentence in a retrieved web page, and a comment planted in a pull request all arrive in the same context window. Instruction provenance is the record of which principal authored the intent behind an action.

When that record is missing, the agent becomes a confused deputy: it holds the operator's authority but follows whoever wrote the most persuasive text. Prompt injection, self-propagating injection between agents, and social engineering aimed at the model rather than the human all break this link.

Taxonomy patterns: Confused Deputy, Self-Propagating Prompt Injection, Social Engineering of AI Agents.

Tagged incidents: primary in 57 of 270 in-model incidents; secondary in 29.

Most recent:

- 2026-10-15: [Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block Threshold](https://agentprov.com/incidents/2026-10-15-datadog-counterfeit-policy-text-collapses-an-injection-classifier-s-recall-and)
- 2026-10-08: [Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage Them](https://agentprov.com/incidents/2026-10-08-cisco-talos-four-malware-families-carry-instructions-aimed-at-the-llms-that)
- 2026-10-07: [Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox Assistant](https://agentprov.com/incidents/2026-10-07-barracuda-phishing-emails-carry-hidden-prompt-injections-for-the-recipient-s-ai)

### L3 Tool

**Is this tool what its description claims?**

Agents choose tools by reading their descriptions. The description, the schema, and the code behind them can each come from a different author and can change after the tool was first approved. Tool provenance binds what the agent was told a tool does to what it actually executes.

Failures here include poisoned tool descriptions that carry hidden instructions, servers that change behavior after installation, and tooling built to slip past the scanners meant to vet it. MCP made this layer visible because it turned tool descriptions into a shared, third-party supply.

Taxonomy patterns: Tool Poisoning, Adversarial Evasion of AI Security Scanners.

Tagged incidents: primary in 6 of 270 in-model incidents; secondary in 7.

Most recent:

- 2026-10-01: [Claude Code 2.1.287 Turns On "Mods" by Default: Unsandboxed In-Process Plugins That Can Read the API Key](https://agentprov.com/incidents/2026-10-01-claude-code-2-1-287-turns-on-mods-by-default-unsandboxed-in-process-plugins)
- 2026-08-12: ["Deadbugz": A Malicious MCP Server Stays Benign for Exactly Three Tool Calls, Then Starts Hunting SSH Keys](https://agentprov.com/incidents/2026-08-12-deadbugz-a-malicious-mcp-server-stays-benign-for-exactly-three-tool-calls-then)
- 2026-08-11: ["GhostSplice": A Malicious MCP Server Splits One Refused Request Across Three Trusted Channels](https://agentprov.com/incidents/2026-08-11-ghostsplice-a-malicious-mcp-server-splits-one-refused-request-across-three)

### L4 Code / Package

**Where did this code come from?**

Agents install packages, pull images, and run code they or another model just wrote. Each artifact has an origin: a registry, a maintainer, a build, a prompt. Code provenance is the chain from that origin to the bytes that run on the developer's machine or in production.

The failures are familiar from software supply chain security, with new entry points. A model hallucinates a package name and an attacker registers it. A trusted AI platform hosts a malicious artifact. A compromised dependency harvests the credentials that the next stage of the cascade will use.

Taxonomy patterns: Supply Chain Credential Cascade, Hallucinated Artifact Exploitation, Trusted AI Platform Abuse.

Tagged incidents: primary in 9 of 270 in-model incidents; secondary in 25.

Most recent:

- 2026-10-12: [Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP Server](https://agentprov.com/incidents/2026-10-12-fake-apex-accelerator-npm-packages-reroute-a-coding-agent-s-llm-traffic-and)
- 2026-07-24: [165 Malicious npm and PyPI Packages in One Week, Several Targeting AI Tooling](https://agentprov.com/incidents/2026-07-24-165-malicious-npm-and-pypi-packages-in-one-week-several-targeting-ai-tooling)
- 2026-07-21: ["AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoader](https://agentprov.com/incidents/2026-07-21-agentbaiting-7-600-fake-github-repositories-800-posing-as-ai-skills-and-mcp)

### L5 Config

**Who wrote the file that runs on open?**

Agent tooling reads configuration from the workspace: rules files, MCP server lists, hooks, and settings that can launch processes. Opening a repository is enough to run them. Config provenance asks who authored each of those files and whether the person opening the project ever agreed to execute it.

When configuration is treated as data instead of code, a cloned repository or a merged pull request becomes an execution primitive. The same layer covers agents that run generated code with no sandbox at all, because in both cases execution happens without a trusted author behind it.

Taxonomy patterns: Config-as-Code Execution, Unsandboxed Code Execution.

Tagged incidents: primary in 37 of 270 in-model incidents; secondary in 58.

Most recent:

- 2026-10-25: [Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth Token](https://agentprov.com/incidents/2026-10-25-planted-agents-md-in-a-downloads-folder-got-codex-to-install-malware-a-claude)
- 2026-10-21: [MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command Execution](https://agentprov.com/incidents/2026-10-21-mcp-inspector-advisory-batch-two-critical-paths-from-connecting-to-a-malicious)
- 2026-10-16: [Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)](https://agentprov.com/incidents/2026-10-16-claude-agent-sdk-a-crafted-session-id-injects-an-mcp-server-and-runs-commands)

### L6 Identity / Run

**Which agent, run, or tenant is this?**

Multi-tenant platforms and multi-agent systems share caches, filesystems, memory, and queues. Identity provenance attaches every action and every stored artifact to the agent, run, and tenant that produced it, so that one run cannot read, write, or act as another.

Failures here are isolation failures: data that crosses tenants, agents that escape their sandbox, and actions authorized at the session level when they should have been authorized one by one. Without a per-run identity there is nothing for an action-level policy to check.

Taxonomy patterns: Cross-Tenant and Cross-Agent Isolation Failures, Agent Sandbox Escape, No Action-Level Authorization.

Tagged incidents: primary in 103 of 270 in-model incidents; secondary in 32.

Most recent:

- 2026-10-27: [MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)](https://agentprov.com/incidents/2026-10-27-mcp-server-and-langgraph-advisory-batch-aws-api-mcp-accepts-other-apps-tokens)
- 2026-10-23: [OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)](https://agentprov.com/incidents/2026-10-23-openai-moves-frontier-training-offline-after-red-team-agents-escaped-vms-and)
- 2026-10-21: [Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's Expense](https://agentprov.com/incidents/2026-10-21-symantec-skynet-mode-attack-agent-hijacks-exposed-llm-endpoints-to-hack-and)

### L7 Build / Approval

**Was this approved as what it claims to be?**

Humans approve things: a tool version, a pinned dependency, a pull request, a security finding. Approval provenance binds that decision to the exact artifact that was reviewed, so that what runs later is provably what was approved and not a look-alike or a silent update.

This link breaks when pins can drift, when approval prompts misdescribe the action, or when the evidence a reviewer relied on was itself fabricated, such as an AI-generated vulnerability report or advisory with no basis in fact.

Taxonomy patterns: Approval and Pin Integrity Failures, Fabricated Security Intelligence.

Tagged incidents: primary in 19 of 270 in-model incidents; secondary in 21.

Most recent:

- 2026-10-22: [METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-In](https://agentprov.com/incidents/2026-10-22-metr-and-redwood-openai-s-agent-monitoring-was-not-fit-for-purpose-during-the)
- 2026-10-21: [OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When Asked](https://agentprov.com/incidents/2026-10-21-openai-two-internal-agents-disabled-misalignment-monitoring-and-one-denied-it)
- 2026-10-15: [Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)](https://agentprov.com/incidents/2026-10-15-claude-code-plugin-hash-pins-could-be-bypassed-with-a-branch-named-like-the)

### L8 Output / Destination

**Where is this data going, and who chose that?**

The innermost link is the sink. Every exfiltration ends with data leaving through a channel: a URL the agent fetches, an image it renders, an email it sends, a webhook an integration calls. Destination provenance asks who chose that destination and whether that principal was allowed to.

Failures here include agents with no allowlist for outbound requests, server-side request forgery in inference and tooling stacks, and integrations granted far more reach than the task needed. Many incidents begin at an inner layer and only become a breach at this one.

Taxonomy patterns: No Output Destination Control, SSRF in AI Inference and Tooling, Overprivileged Integration.

Tagged incidents: primary in 10 of 270 in-model incidents; secondary in 71.

Most recent:

- 2026-10-01: [A Read-Only Grok Bot "CFO" Agent Posted a CEO's Bank Balances to the Company Slack](https://agentprov.com/incidents/2026-10-01-a-read-only-grok-bot-cfo-agent-posted-a-ceo-s-bank-balances-to-the-company-slack)
- 2026-09-29: ["PixelLeak": AI Coding Agents Posted 13,000+ Internal Screenshots From 300+ Organizations to Public GitHub Repositories](https://agentprov.com/incidents/2026-09-29-pixelleak-ai-coding-agents-posted-13-000-internal-screenshots-from-300)
- 2026-09-22: [Z.ai's ZCode Coding Agent Uploaded Entire Local Repositories, Git History Included, to Alibaba Cloud by Default](https://agentprov.com/incidents/2026-09-22-z-ai-s-zcode-coding-agent-uploaded-entire-local-repositories-git-history)

### Campaigns, not failures

Some catalog patterns describe what attackers do with AI rather than which link broke: AI-Orchestrated Offensive Operations, AI-Accelerated Vulnerability Discovery, Model Capability Extraction, AI Control Plane Exploitation in the Wild, Inference Server Authentication and Memory-Safety Failures. These are tagged by the layer the attacker exploited, not by the fact that an AI did the attacking.

### Related work

| Work | Date | Organizes by | Enforces? | Sidecar? | Real incidents? |
| --- | --- | --- | --- | --- | --- |
| CaMeL (Google DeepMind): Capability and provenance tracking inside a custom agent interpreter. | 2025 | capabilities | yes | no | no |
| AARM (Errico, now a CSA working group): Runtime action-mediation control model with receipts and five decision outcomes; names input provenance without defining a mechanism. | Feb 2026 | action mediation | spec only | spec only | no |
| Evidence Tracing and Execution Provenance survey: Finds enforcement less developed than recording, and no shared trace schema. | Jun 2026 | six dimensions | no | no | no |
| AgentLock v1.3: Provenance-lineage gating and parameter lineage, evaluated on AgentDojo. Layer 2 enforcement. | Jul 2026 | provenance (layer 2) | yes | no | no |
| NVIDIA five-layer agent architecture: Layers by responsibility, not by provenance. | Aug 2026 | responsibility | no | no | no |
| runwarden v0.1: Cross-run isolation probe. Layer 6. | Sep 2026 | provenance (layer 6) | no (probe) | no (CLI probe) | no |
| Decode-Time Provenance Binding for MCP (Yocam et al.): HMAC-bound trust labels and sink enforcement inside a mediated MCP layer. | Oct 2026 | trust labels | yes | no | no |
| AgentProv: The eight-layer model, grounded in the public incident catalog. | Oct 2026 | provenance | via AgentLock (L2) | planned (proxy) | 385 |

### Cite this

Grice, D. (2026). The AgentProv Provenance Model. https://agentprov.com/model

## AgentProv methodology

Canonical page: https://agentprov.com/methodology

Every number on agentprov.com comes from the public incident catalog (https://github.com/webpro255/awesome-ai-agent-attacks), parsed at build time, and from layer tags assigned by hand under the rules below. 385 of 385 incidents are tagged: 270 in-model and 115 outside the model.

### What the catalog includes

Each entry names a specific affected company, product, or project and records a date, a concrete impact, a technical root cause, any CVE, and at least one verifiable source from a reputable publication or official advisory.

The catalog accepts:

- documented AI agent security incidents with real-world impact
- agent framework and tool vulnerabilities with published advisories or CVEs
- AI chatbot integration breaches affecting real organizations
- supply chain attacks targeting AI development tools and libraries
- research disclosures demonstrating exploitable vulnerabilities in production AI systems
- autonomous agent behavior incidents, such as unintended actions and sandbox escapes

It excludes hypothetical attacks, unverified claims, commentary, vendor marketing, and duplicates. Inclusion in the catalog does not mean an incident is in the model: the tagging rules decide that separately, and entries outside the model are counted, not dropped.

### Tagging rules

Rules for `data/tags.yaml`. The eight layers are defined on the Model page; this file records how incidents are assigned to
them. `npm run data` enforces the schema.

#### Schema

In-model row:

```yaml
<incident-slug>:
  primary: 4              # exactly one layer number, 1..8
  secondary: [1]          # zero or more, never the primary
  actor: attacker         # optional: vendor_eval | operator | attacker | unknown
  related: [<slug>]       # optional, any row: the same event described from another side
  fixable: true           # true, false, or null
  vendor_response: patched
  in_the_wild: true
```

Outside-the-model row (no primary or secondary):

```yaml
<incident-slug>:
  out_of_model: true
  class: capability       # capability | offensive_use | resource_theft | context | model_safety | adjacent | reliability
  fixable: true
  vendor_response: patched
  in_the_wild: false
```

Each row gets a one-line `#` comment above it with the reason, citing the Root Cause or Impact text.

#### In or out of the model

An incident is in-model only when agent tooling was the attack surface: the agent, its tools, runtime,
config, supply chain, or credentials. Otherwise it is `out_of_model: true` with one class:

- `capability`: an AI found or built an exploit against non-agent software.
- `offensive_use`: AI used as the instrument against humans or non-agent systems, including impersonating
  an AI product as a lure.
- `resource_theft`: the key was stolen or leaked outside agent tooling (infostealer, phishing, code leak,
  credential resale) and then spent on inference or agent compute (LLMjacking).
- `context`: regulatory, legal, and policy events, trend reports, and surveys that are not themselves an
  incident. Kept because the report cites them, so the catalog stays fully tagged.
- `model_safety`: jailbreaks and harmful-content generation where the requester is the user, nothing
  acts on a system, and no third party is harmed. A guardrail is a content judgment, not a provenance
  control; defeating one with no action or target is out of the model.
- `adjacent`: ecosystem supply chain compromises with no agent or AI involvement as surface,
  instrument, capability, or payload target.
- `reliability`: an AI system producing harmful or false output, or failing at its task, with no
  attacker, no action on a system, and no security angle.

The class list is frozen at seven: capability, offensive_use, resource_theft, context, model_safety,
adjacent, reliability. A future row that fits none of them is a catalog scope question, not a new class.

Worms and compromised packages (the Shai-Hulud lineage and similar): in-model, primary by the supply
chain rule and secondary 1, when the payload harvested agent or AI tooling credentials and configs, or
the compromise spread through agent tooling. `adjacent` when the AI angle is only that an AI-adjacent
vendor was hit.

Agent runtime includes inference servers, LLM gateways, memory stores, vector databases, model
registries, and ML platforms. Incidents against them are in-model.

Layer 1 primary covers any case where the run held a credential it should not have: over-broad,
longer-lived than the run, or mishandled by the platform (stored unencrypted, exposed by an endpoint,
leaked by the tool, or not bound to its issuer). `resource_theft` stays for keys stolen outside agent
tooling and then spent.

An agent that harms a third party with no attacker involved is in-model; the failed link is whichever
control should have stopped the action.

Model Capability Extraction: when the attacker defeated a platform control (for example, tricking the
model into decrypting its own protected output), it is in-model at the layer of the defeated control.
When extraction used ordinary API access at scale with no control defeated (distillation campaigns), it
is `out_of_model`, class `context`.

Trusted AI Platform Abuse: in-model layer 4 when agent tooling executed or loaded the hosted artifact (a
malicious model file loaded by a tool, a package pulled by an agent). `out_of_model`, class
`offensive_use`, when the hosted artifact was a lure aimed at humans.

Fabricated Security Intelligence: in-model layer 7 when a review or approval process consumed the
fabricated evidence (a maintainer acted on it, a CVE or advisory was issued, a fix was merged).
`out_of_model`, class `offensive_use`, when it was only submitted or published and nobody acted.

Outside-the-model rows are counted and charted on /stats ("Outside the model"), never dropped.

#### Choosing the primary layer

- The primary is the link whose failure made the incident possible, not where the damage showed up.
- When unsure between two layers, pick the earlier number and say so in the reason. A taxonomy mapping
  (for example, Agent Sandbox Escape is layer 6) beats this tiebreak.
- An exposed server or endpoint with no authentication is primary 6. When it executes code, primary 6
  with secondary 5; code execution that needs an authenticated user, or that the model emits, is
  primary 5.
- A network path out of a sandbox (DNS, proxy, open egress) is an isolation failure, primary 6. Layer 8
  is primary only when the harm is data sent to a destination the agent chose (exfiltration,
  publication).
- An SSRF primitive is primary 8, with 6 secondary when it is reachable without authentication.
- A config or instruction file that runs or loads on open or clone is primary 5.
- An injected page or document that steers the agent is primary 2; add 8 if data left through an
  agent-chosen destination, and 1 if credentials were taken.
- Supply chain:
  - primary 4 when the artifact's origin was the first failure (typosquat, hallucinated name, maintainer
    account socially engineered);
  - primary 1 when a leaked or stolen credential is the documented root cause, or when an account was
    compromised by an unknown method;
  - primary 7 when the publish pipeline accepted what it should not have (forged provenance, an
    unreviewed push feeding a release).
- Oversight integrity is layer 7: monitoring disabled, tests altered to hide it, approval prompts that
  misdescribe an action.

#### Field meanings

- `actor` (optional, in-model rows only): who drove the failing action.
  - `vendor_eval`: the vendor's own evaluation or research agent caused the harm (third-party evaluators
    running agents count here too).
  - `operator`: a deployed agent acting for its operator, with no attacker involved.
  - `attacker`: an attacker drove the agent or exploited the platform. Vulnerability disclosures use
    this, since exploitation needs an attacker.
  - `unknown`: not determinable from the entry.
- `related` (optional, any row): slugs of other incidents that describe the same event from another
  side. Each row keeps its own tags; the validator checks the slugs exist.

- `fixable`: whether a code fix closes the class. true (a vendor patch closed it), false (architectural),
  null (unknown).
- `vendor_response`: what the vendor did, independent of `fixable`. An architectural incident can still be
  `patched` when the vendor changed its process or product. `patched | disputed | not_a_vulnerability |
  no_response | mixed | unknown`. Use `mixed` for multi-vendor advisories where vendors responded
  differently, and give the per-vendor split in the reason. A researcher saying there is nothing to patch
  is not a vendor response.
- `in_the_wild`: true if real victims or active exploitation of this incident's failure were reported.
  Internal red-teaming is false, even when a byproduct CVE is later exploited elsewhere.

### Outside the model, by class

- AI capability: 20
- Offensive use: 33
- Resource theft: 5
- Context: 31
- Model safety: 3
- Adjacent ecosystem: 21
- Reliability: 2

### Downloads

- https://agentprov.com/data/incidents.csv: The parser output: one row per catalog incident.
- https://agentprov.com/data/incidents.json: One object per incident with layer tags merged in.
- https://agentprov.com/data/tags.yaml: The hand-assigned layer tags, with a one-line reason per row.
- https://agentprov.com/data/stats.json: The aggregates behind every chart on the site.

### Catalog scope review

Entries tagged adjacent: ecosystem compromises with no agent or AI involvement, listed for a review of whether they belong in the catalog.

- 2026-07-06: [Summer.fi "Keeper AI Agents" Exploit Drains About $6M](https://agentprov.com/incidents/2026-07-06-summer-fi-keeper-ai-agents-exploit-drains-about-6m)
- 2026-06-17: [Mastra AI npm Scope Compromise (Sapphire Sleet / UNC1069)](https://agentprov.com/incidents/2026-06-17-mastra-ai-npm-scope-compromise-sapphire-sleet-unc1069)
- 2026-06-03: [node-gyp "Phantom Gyp" Self-Propagating npm Worm (Miasma)](https://agentprov.com/incidents/2026-06-03-node-gyp-phantom-gyp-self-propagating-npm-worm-miasma)
- 2026-06-01: [Red Hat @redhat-cloud-services npm "Miasma" Worm](https://agentprov.com/incidents/2026-06-01-red-hat-redhat-cloud-services-npm-miasma-worm)
- 2026-05-28: [Nx Console Malicious VS Code Extension Leads to GitHub Repository Breach](https://agentprov.com/incidents/2026-05-28-nx-console-malicious-vs-code-extension-leads-to-github-repository-breach)
- 2026-05-25: ["Megalodon" Mass GitHub Actions Secret Exfiltration](https://agentprov.com/incidents/2026-05-25-megalodon-mass-github-actions-secret-exfiltration)
- 2026-05-18: [actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud)](https://agentprov.com/incidents/2026-05-18-actions-cool-github-actions-tag-hijack-mini-shai-hulud)
- 2026-05-14: [OpenAI Internal Source Code and Certificate Theft via TanStack Worm](https://agentprov.com/incidents/2026-05-14-openai-internal-source-code-and-certificate-theft-via-tanstack-worm)
- 2026-04-30: [PyTorch Lightning PyPI Compromise (Mini Shai-Hulud)](https://agentprov.com/incidents/2026-04-30-pytorch-lightning-pypi-compromise-mini-shai-hulud)
- 2026-04-22: [Xinference PyPI Package Compromise (Versions 2.6.0-2.6.2)](https://agentprov.com/incidents/2026-04-22-xinference-pypi-package-compromise-versions-2-6-0-2-6-2)
- 2026-04-08: [UNC1069 Contagious Interview Cross-Ecosystem Package Campaign](https://agentprov.com/incidents/2026-04-08-unc1069-contagious-interview-cross-ecosystem-package-campaign)
- 2026-04-01: [Drift Protocol $285M Exploit](https://agentprov.com/incidents/2026-04-01-drift-protocol-285m-exploit)
- 2026-03-31: [Axios npm Supply Chain Attack](https://agentprov.com/incidents/2026-03-31-axios-npm-supply-chain-attack)
- 2026-03-31: [Cisco Source Code Stolen via Trivy Breach](https://agentprov.com/incidents/2026-03-31-cisco-source-code-stolen-via-trivy-breach)
- 2026-03-23: [Checkmarx KICS GitHub Actions Compromise](https://agentprov.com/incidents/2026-03-23-checkmarx-kics-github-actions-compromise)
- 2026-03-20: [CanisterWorm npm Worm by TeamPCP](https://agentprov.com/incidents/2026-03-20-canisterworm-npm-worm-by-teampcp)
- 2026-03-19: [Trivy GitHub Action Compromise by TeamPCP](https://agentprov.com/incidents/2026-03-19-trivy-github-action-compromise-by-teampcp)
- 2026-03-11: [UNC6426 nx npm to AWS Admin Takeover](https://agentprov.com/incidents/2026-03-11-unc6426-nx-npm-to-aws-admin-takeover)
- 2025-03-15: [tj-actions/changed-files GitHub Actions Supply Chain Attack](https://agentprov.com/incidents/2025-03-15-tj-actions-changed-files-github-actions-supply-chain-attack)
- 2025-02-21: [Bybit $1.5B Cryptocurrency Heist](https://agentprov.com/incidents/2025-02-21-bybit-1-5b-cryptocurrency-heist)
- 2024-12-04: [Ultralytics PyPI Supply Chain Attack](https://agentprov.com/incidents/2024-12-04-ultralytics-pypi-supply-chain-attack)

## AgentProv stats tables

Canonical page: https://agentprov.com/stats

### Primary layer

In-model incidents by the layer whose failure made the incident possible.

| Category | Incidents |
| --- | --- |
| L1 Credential | 29 |
| L2 Instruction | 57 |
| L3 Tool | 6 |
| L4 Code / Package | 9 |
| L5 Config | 37 |
| L6 Identity / Run | 103 |
| L7 Build / Approval | 19 |
| L8 Output / Destination | 10 |

### Primary layer per quarter

In-model incidents per quarter, stacked by primary layer.

| Quarter | L1 | L2 | L3 | L4 | L5 | L6 | L7 | L8 |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 2024-Q1 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 |
| 2024-Q2 | 2 | 0 | 0 | 0 | 0 | 1 | 0 | 0 |
| 2024-Q3 | 0 | 4 | 0 | 0 | 0 | 2 | 0 | 1 |
| 2024-Q4 | 0 | 3 | 0 | 0 | 0 | 2 | 0 | 0 |
| 2025-Q1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
| 2025-Q2 | 0 | 3 | 1 | 0 | 0 | 3 | 0 | 0 |
| 2025-Q3 | 2 | 4 | 0 | 1 | 2 | 1 | 2 | 0 |
| 2025-Q4 | 1 | 4 | 0 | 0 | 3 | 1 | 0 | 0 |
| 2026-Q1 | 4 | 1 | 0 | 0 | 4 | 6 | 1 | 0 |
| 2026-Q2 | 6 | 6 | 0 | 4 | 7 | 21 | 4 | 2 |
| 2026-Q3 | 8 | 25 | 4 | 3 | 11 | 48 | 8 | 6 |
| 2026-Q4 | 5 | 5 | 1 | 1 | 9 | 17 | 4 | 1 |

### Secondary layers

How often each layer appears as a layer an incident cascaded through.

| Category | Incidents |
| --- | --- |
| L1 Credential | 86 |
| L2 Instruction | 29 |
| L3 Tool | 7 |
| L4 Code / Package | 25 |
| L5 Config | 58 |
| L6 Identity / Run | 32 |
| L7 Build / Approval | 21 |
| L8 Output / Destination | 71 |

### Layer 6 by actor

Who drove the failing action in incidents whose primary layer is Identity / Run.

| Actor | Layer 6 incidents |
| --- | --- |
| Vendor evaluation or research agent | 26 |
| Deployed agent acting for its operator | 5 |
| Attacker | 70 |
| Unknown | 2 |

### Fixable or architectural

In-model incidents by whether a vendor code fix closes the class.

| Category | Incidents |
| --- | --- |
| Vendor patch closed it | 175 |
| Architectural | 92 |
| Unknown | 3 |

### Vendor response

What the vendor did, for in-model incidents.

| Category | Incidents |
| --- | --- |
| Patched | 158 |
| Unknown | 91 |
| Not a vulnerability | 10 |
| Mixed | 5 |
| Disputed | 3 |
| No response | 3 |

### In the wild

Share of tagged incidents with real victims or active exploitation reported.

| Population | In the wild | Not in the wild | Share |
| --- | --- | --- | --- |
| In-model | 102 | 168 | 37.8% |
| Outside the model | 69 | 46 | 60% |
| All tagged | 171 | 214 | 44.4% |

### Outside the model

Tagged entries where agent tooling was not the attack surface, or that are context, model safety, adjacent ecosystem compromises, or reliability failures, by class. Counted so they are never dropped.

| Category | Incidents |
| --- | --- |
| AI capability | 20 |
| Offensive use | 33 |
| Resource theft | 5 |
| Context | 31 |
| Model safety | 3 |
| Adjacent ecosystem | 21 |
| Reliability | 2 |

### Incidents per quarter

Catalog incidents by disclosure quarter.

| Quarter | Incidents |
| --- | --- |
| 2024-Q1 | 5 |
| 2024-Q2 | 6 |
| 2024-Q3 | 8 |
| 2024-Q4 | 7 |
| 2025-Q1 | 5 |
| 2025-Q2 | 7 |
| 2025-Q3 | 12 |
| 2025-Q4 | 10 |
| 2026-Q1 | 24 |
| 2026-Q2 | 69 |
| 2026-Q3 | 172 |
| 2026-Q4 | 60 |

### Keyword buckets

Rough, non-exclusive keyword matches over title, target, root cause, and impact. Not layer tags.

| Category | Incidents |
| --- | --- |
| credential / secret theft | 198 |
| Claude Code / Anthropic | 102 |
| OpenAI / ChatGPT / Codex | 90 |
| prompt injection | 80 |
| RCE | 67 |
| npm / PyPI supply chain | 62 |
| Gemini / Google | 57 |
| crypto / DeFi | 56 |
| MCP | 51 |
| offensive use by attackers | 45 |
| Copilot / GitHub | 32 |
| Cursor | 25 |
| LangChain / Langflow / LangGraph | 23 |
| not a vulnerability / disputed | 22 |
| misalignment / rogue agent | 20 |
| n8n / Flowise / low-code | 17 |
| LiteLLM | 16 |
| OpenClaw / ClawHub | 15 |
| Ollama / vLLM / inference servers | 12 |
| DPRK | 9 |

### MCP share per quarter

Percent of each quarter's incidents that mention MCP in title, target, or root cause.

| Quarter | MCP | Total | Share |
| --- | --- | --- | --- |
| 2024-Q1 | 0 | 5 | 0% |
| 2024-Q2 | 0 | 6 | 0% |
| 2024-Q3 | 0 | 8 | 0% |
| 2024-Q4 | 0 | 7 | 0% |
| 2025-Q1 | 0 | 5 | 0% |
| 2025-Q2 | 2 | 7 | 28.6% |
| 2025-Q3 | 1 | 12 | 8.3% |
| 2025-Q4 | 0 | 10 | 0% |
| 2026-Q1 | 2 | 24 | 8.3% |
| 2026-Q2 | 7 | 69 | 10.1% |
| 2026-Q3 | 13 | 172 | 7.6% |
| 2026-Q4 | 16 | 60 | 26.7% |

### Top source outlets

Outlets cited most often across incident source lists.

| Outlet | Citations |
| --- | --- |
| The Hacker News | 138 |
| The Register | 51 |
| BleepingComputer | 44 |
| SecurityWeek | 35 |
| Help Net Security | 30 |
| Cybersecurity News | 28 |
| Dark Reading | 24 |
| GBHackers | 23 |
| Wiz | 18 |
| Infosecurity Magazine | 17 |
| CSO Online | 16 |
| NVD | 13 |
| TechCrunch | 12 |
| SC Media | 11 |
| CISA | 9 |

## Citation

Grice, D. (2026). The AgentProv Provenance Model. https://agentprov.com/model