Stats
Built from the public catalog at build time, covering 2024 through 2026-10-27. Every chart can be embedded. How incidents are tagged is on the methodology page.
- 385
- incidents
- 135
- with a CVE
- 233
- unique CVEs
- 2.86
- sources per incident
- 385
- tagged
- 270
- in-model
- 115
- outside the model
- 325
- in 2026
Through the model
Every catalog incident tagged against the eight layers. See the methodology for the rules.
Primary layer
In-model incidents by the layer whose failure made the incident possible.
Data table
| Incidents | |
|---|---|
| L1 Credential | 29 |
| L2 Instruction | 57 |
| L3 Tool | 6 |
| L4 Code / Package | 9 |
| L5 Config | 37 |
| L6 Identity / Run | 103 |
| L7 Build / Approval | 19 |
| L8 Output / Destination | 10 |
Primary layer per quarter
In-model incidents per quarter, stacked by primary layer.
Data table
| Quarter | L1 | L2 | L3 | L4 | L5 | L6 | L7 | L8 |
|---|---|---|---|---|---|---|---|---|
| 2024-Q1 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 |
| 2024-Q2 | 2 | 0 | 0 | 0 | 0 | 1 | 0 | 0 |
| 2024-Q3 | 0 | 4 | 0 | 0 | 0 | 2 | 0 | 1 |
| 2024-Q4 | 0 | 3 | 0 | 0 | 0 | 2 | 0 | 0 |
| 2025-Q1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
| 2025-Q2 | 0 | 3 | 1 | 0 | 0 | 3 | 0 | 0 |
| 2025-Q3 | 2 | 4 | 0 | 1 | 2 | 1 | 2 | 0 |
| 2025-Q4 | 1 | 4 | 0 | 0 | 3 | 1 | 0 | 0 |
| 2026-Q1 | 4 | 1 | 0 | 0 | 4 | 6 | 1 | 0 |
| 2026-Q2 | 6 | 6 | 0 | 4 | 7 | 21 | 4 | 2 |
| 2026-Q3 | 8 | 25 | 4 | 3 | 11 | 48 | 8 | 6 |
| 2026-Q4 | 5 | 5 | 1 | 1 | 9 | 17 | 4 | 1 |
Secondary layers
How often each layer appears as a layer an incident cascaded through.
Data table
| Incidents | |
|---|---|
| L1 Credential | 86 |
| L2 Instruction | 29 |
| L3 Tool | 7 |
| L4 Code / Package | 25 |
| L5 Config | 58 |
| L6 Identity / Run | 32 |
| L7 Build / Approval | 21 |
| L8 Output / Destination | 71 |
Layer 6 by actor
Who drove the failing action in incidents whose primary layer is Identity / Run.
Data table
| Actor | Layer 6 incidents |
|---|---|
| Vendor evaluation or research agent | 26 |
| Deployed agent acting for its operator | 5 |
| Attacker | 70 |
| Unknown | 2 |
Fixable or architectural
In-model incidents by whether a vendor code fix closes the class.
Data table
| Incidents | |
|---|---|
| Vendor patch closed it | 175 |
| Architectural | 92 |
| Unknown | 3 |
Vendor response
What the vendor did, for in-model incidents.
Data table
| Incidents | |
|---|---|
| Patched | 158 |
| Unknown | 91 |
| Not a vulnerability | 10 |
| Mixed | 5 |
| Disputed | 3 |
| No response | 3 |
In the wild
Share of tagged incidents with real victims or active exploitation reported.
Data table
| Population | In the wild | Not in the wild | Share |
|---|---|---|---|
| In-model | 102 | 168 | 37.8% |
| Outside the model | 69 | 46 | 60% |
| All tagged | 171 | 214 | 44.4% |
Outside the model
Tagged entries where agent tooling was not the attack surface, or that are context, model safety, adjacent ecosystem compromises, or reliability failures, by class. Counted so they are never dropped.
Data table
| Incidents | |
|---|---|
| AI capability | 20 |
| Offensive use | 33 |
| Resource theft | 5 |
| Context | 31 |
| Model safety | 3 |
| Adjacent ecosystem | 21 |
| Reliability | 2 |
The catalog
Every incident in the catalog, untagged counts.
Incidents per quarter
Catalog incidents by disclosure quarter.
Data table
| Quarter | Incidents |
|---|---|
| 2024-Q1 | 5 |
| 2024-Q2 | 6 |
| 2024-Q3 | 8 |
| 2024-Q4 | 7 |
| 2025-Q1 | 5 |
| 2025-Q2 | 7 |
| 2025-Q3 | 12 |
| 2025-Q4 | 10 |
| 2026-Q1 | 24 |
| 2026-Q2 | 69 |
| 2026-Q3 | 172 |
| 2026-Q4 | 60 |
Keyword buckets
Rough, non-exclusive keyword matches over title, target, root cause, and impact. Not layer tags.
Data table
| Incidents | |
|---|---|
| credential / secret theft | 198 |
| Claude Code / Anthropic | 102 |
| OpenAI / ChatGPT / Codex | 90 |
| prompt injection | 80 |
| RCE | 67 |
| npm / PyPI supply chain | 62 |
| Gemini / Google | 57 |
| crypto / DeFi | 56 |
| MCP | 51 |
| offensive use by attackers | 45 |
| Copilot / GitHub | 32 |
| Cursor | 25 |
| LangChain / Langflow / LangGraph | 23 |
| not a vulnerability / disputed | 22 |
| misalignment / rogue agent | 20 |
| n8n / Flowise / low-code | 17 |
| LiteLLM | 16 |
| OpenClaw / ClawHub | 15 |
| Ollama / vLLM / inference servers | 12 |
| DPRK | 9 |
Top source outlets
Outlets cited most often across incident source lists.
Data table
| Outlet | Citations |
|---|---|
| The Hacker News | 138 |
| The Register | 51 |
| BleepingComputer | 44 |
| SecurityWeek | 35 |
| Help Net Security | 30 |
| Cybersecurity News | 28 |
| Dark Reading | 24 |
| GBHackers | 23 |
| Wiz | 18 |
| Infosecurity Magazine | 17 |
| CSO Online | 16 |
| NVD | 13 |
| TechCrunch | 12 |
| SC Media | 11 |
| CISA | 9 |