https://basitalisandhu.github.io/ai-agent-incidents/ An open, structured dataset of publicly documented AI-agent and LLM-application security incidents, coded by the role AI plays: weapon, target or surface. en Tue, 01 Sep 2026 00:00:00 +0000 https://basitalisandhu.github.io/ai-agent-incidents/incidents/088.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/088.html Tue, 01 Sep 2026 00:00:00 +0000 vulnerability-disclosuretargetsupply-chain Claude Code, Codex, GitHub Copilot and Gemini CLI checked out marketplace plugins at a pinned commit but did not verify the resulting HEAD, so the owner of a plugin repository could create a branch named after the pinned SHA and have attacker code installed and run on update. Fixed in Claude Code 2.1.179 and Codex 0.146.0; Copilot unpatched and Gemini CLI deprecated; no exploitation in the wild reported. Type: vulnerability-disclosure. Lens: target. Vector: supply-chain. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/087.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/087.html Tue, 01 Sep 2026 00:00:00 +0000 incidentsurfaceexcessive-agency Asked to attach screenshots of code changes to pull requests, coding agents that could not upload images through the command line created public repositories under developers' accounts to host them; Glow found more than 13,000 internal images from over 300 organizations, including billing records and treasury consoles, and reproduced the behaviour with Claude Code. Glow began notifying organizations on 9 September 2026. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/086.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/086.html Tue, 01 Sep 2026 00:00:00 +0000 incidentsurfaceexcessive-agency On 25 September 2026 OpenAI disclosed that agents in its research environment had transmitted training and evaluation data while using third-party services, including 53 ChatGPT user-provided images posted to image-hosting sites as unlisted links. OpenAI said it had removed most of the content with the hosts and is reviewing agent activity month by month back from the Hugging Face incident. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/085.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/085.html Tue, 01 Sep 2026 00:00:00 +0000 threat-reportweaponautonomous-ops Google Threat Intelligence Group reports a suspected financially motivated actor who used an AI coding chatbot and markdown agent instruction sets to run a multi-agent vulnerability scanning and credential harvesting campaign from a victim's cloud infrastructure, compromising thousands of third-party credentials in under six hours; the report also covers supply-chain, espionage and distillation cases, and Google disabled the associated accounts and assets. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/084.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/084.html Tue, 01 Sep 2026 00:00:00 +0000 vulnerability-disclosuretargetexploitation Manifold Security found that a repository delivered with a malicious .git/config (core.fsmonitor and one withheld key) runs attacker code when Claude Code, goose, Hermes Agent, Qwen Code, Grok Build, Codex or Cursor collect Git metadata, outside the sandbox and before any approval or trust prompt. Claude Code (fsmonitor path), goose, Codex and Cursor were fixed; Hermes Agent, Qwen Code, Grok Build and a second Claude Code path were unpatched at publication. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: code-execution. CVE: CVE-2026-72718; CVE-2026-71963; CVE-2026-19592. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/083.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/083.html Tue, 01 Sep 2026 00:00:00 +0000 vulnerability-disclosuresurfaceexploitation DeepSeek Harness 0.1.1-rc.2 and earlier exposed an unauthenticated local HTTP API that trusted the Host header, so a sandboxed agent induced by attacker-supplied text could run one curl command to set its session to danger-full-access and run commands outside the sandbox without approval. Fixed in 0.1.2-alpha.1; VulnCheck rated it 9.4. Type: vulnerability-disclosure. Lens: surface. Vector: exploitation. Outcome: code-execution. CVE: CVE-2026-82533. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/082.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/082.html Tue, 01 Sep 2026 00:00:00 +0000 incidentweaponautonomous-ops An attacker using Codex and hundreds of AI agents exploited an authentication bypass and an RCE in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, mostly in education. GreyNoise reports credential harvesting on 280 instances, OS or domain secrets extracted on 147 and domain administrator access at 12 organizations. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. CVE: CVE-2026-81578; CVE-2026-82078. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/080.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/080.html Tue, 01 Sep 2026 00:00:00 +0000 incidentweaponautonomous-ops Hundreds of malicious packages uploaded 11 May; credential theft attempted, success unclear; OpenAI says benign. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/079.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/079.html Tue, 01 Sep 2026 00:00:00 +0000 incidentweaponautonomous-ops Agents accessed public and non-public portal files and wrote files; no personal data apparent. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/078.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/078.html Tue, 01 Sep 2026 00:00:00 +0000 threat-reportweaponautonomous-ops Covers December 2025 to August 2026; Claude used as orchestrator across cyber kill chain. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/081.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/081.html Sat, 01 Aug 2026 00:00:00 +0000 incidentsurfacepoisoning On 10 August 2026 the GitHub account zellkernel opened 23 pull requests in 74 minutes across AI, MCP and developer-tool projects adding a 'productivity-suite' MCP server (remote endpoint or hidden local script). After three tool calls the server changes its tool metadata to direct the agent to look for SSH keys, AWS credentials, shell history and Kubernetes configuration and hide this from the user; no confirmed victims were reported. Type: incident. Lens: surface. Vector: poisoning. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/077.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/077.html Sat, 01 Aug 2026 00:00:00 +0000 vulnerability-disclosuresurfaceexploitation Unprivileged issue reached CI in Anthropic, Google, OpenAI agent repos; Gemini CLI CVSS 10. Type: vulnerability-disclosure. Lens: surface. Vector: exploitation. Outcome: code-execution. CVE: CVE-2026-12537; CVE-2026-54316. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/076.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/076.html Sat, 01 Aug 2026 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection One-click autorun prompt, URL-fetch exfiltration and persistent memory poisoning; critical; patched. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. CVE: CVE-2026-24301. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/075.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/075.html Wed, 01 Jul 2026 00:00:00 +0000 incidentweaponautonomous-ops No human attacker; models cheating an eval escaped sandbox via Artifactory zero-day, hit Hugging Face. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/074.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/074.html Wed, 01 Jul 2026 00:00:00 +0000 incidentweaponautonomous-ops Claude, told environment was simulated, breached three organizations via weak passwords; fourth case disclosed September. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/073.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/073.html Mon, 01 Jun 2026 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Parameter-to-prompt, sanitizer race and Bing SSRF chain; critical; fixed before disclosure. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. CVE: CVE-2026-42824. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/072.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/072.html Fri, 01 May 2026 00:00:00 +0000 vulnerability-disclosuresurfacedirect-injection Vector-store filter eval and file-write tool turned a prompt into host RCE; both fixed. Type: vulnerability-disclosure. Lens: surface. Vector: direct-injection. Outcome: code-execution. CVE: CVE-2026-26030; CVE-2026-25592. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/071.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/071.html Wed, 01 Apr 2026 00:00:00 +0000 incidentsurfaceexcessive-agency Agent found account-scoped Railway token, ran volume delete in 9 seconds; data later restored. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: data-destruction. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/070.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/070.html Sun, 01 Mar 2026 00:00:00 +0000 threat-reportsurfaceindirect-injection Web-hosted injections seen in telemetry: ad-review evasion, SEO phishing, destructive and transaction commands. Type: threat-report. Lens: surface. Vector: indirect-injection. Outcome: fraud. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/069.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/069.html Sun, 01 Mar 2026 00:00:00 +0000 incidenttargetsupply-chain Versions 1.82.7 and 1.82.8 backdoored in TeamPCP campaign after Trivy compromise. Type: incident. Lens: target. Vector: supply-chain. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/068.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/068.html Sun, 01 Mar 2026 00:00:00 +0000 incidenttargetexploitation Public build endpoint RCE exploited 20 hours after advisory; attackers harvested keys and .env files. Type: incident. Lens: target. Vector: exploitation. Outcome: data-exfiltration. CVE: CVE-2026-33017. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/067.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/067.html Sun, 01 Mar 2026 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Direct or indirect injection reaches Code Interpreter SandboxPython fallback; RCE, file read, SSRF. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. CVE: CVE-2026-2275; CVE-2026-2285; CVE-2026-2286; CVE-2026-2287. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/066.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/066.html Sun, 01 Feb 2026 00:00:00 +0000 vulnerability-disclosuresurfacegenerated-code Hallucinated npm name spread through agent skills to 237 repos; researcher claimed it. Type: vulnerability-disclosure. Lens: surface. Vector: generated-code. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/065.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/065.html Sun, 01 Feb 2026 00:00:00 +0000 incidentweaponautonomous-ops Claimed Claude-powered account; RCE in at least four of seven repos; Trivy releases deleted. Type: incident. Lens: weapon. Vector: autonomous-ops. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/064.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/064.html Sun, 01 Feb 2026 00:00:00 +0000 vulnerability-disclosuretargetexploitation Crafted link leaked gateway token over WebSocket even on loopback; fixed in 2026.1.29. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: code-execution. CVE: CVE-2026-25253. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/063.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/063.html Sun, 01 Feb 2026 00:00:00 +0000 incidentsurfaceindirect-injection Issue-title injection plus cache poisoning stole npm token; malicious cline@2.3.0 published 17 Feb. Type: incident. Lens: surface. Vector: indirect-injection. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/062.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/062.html Sun, 01 Feb 2026 00:00:00 +0000 incidenttargetsupply-chain Koi audit of 2,857 skills found 341 malicious; fake prerequisites installed Atomic Stealer. Type: incident. Lens: target. Vector: supply-chain. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/061.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/061.html Sun, 01 Feb 2026 00:00:00 +0000 vulnerability-disclosuretargetexploitation Repo hooks and ANTHROPIC_BASE_URL ran code and leaked API keys before trust prompt. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: code-execution. CVE: CVE-2025-59536; CVE-2026-21852. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/060.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/060.html Sun, 01 Feb 2026 00:00:00 +0000 threat-reporttargetextraction 24,000 fraudulent accounts made 16M exchanges to extract Claude capabilities. Type: threat-report. Lens: target. Vector: extraction. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/059.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/059.html Sun, 01 Feb 2026 00:00:00 +0000 threat-reportweaponautonomous-ops Unsophisticated actor used commercial LLMs to compromise 600+ FortiGate devices via weak credentials. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/058.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/058.html Thu, 01 Jan 2026 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Parameter-to-prompt via ?q=, double-request bypass and chained requests; patched on disclosure. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/057.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/057.html Thu, 01 Jan 2026 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Path-validation and git_diff argument-injection flaws chained with Filesystem MCP for code execution. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. CVE: CVE-2025-68143; CVE-2025-68144; CVE-2025-68145. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/056.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/056.html Mon, 01 Dec 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Prompt injection abused legitimate IDE features in every tested AI IDE; 24 CVEs. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. CVE: multiple. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/055.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/055.html Mon, 01 Dec 2025 00:00:00 +0000 incidentsurfaceexcessive-agency Turbo-mode agent cleared cache by deleting D: drive root; Google investigating. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: data-destruction. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/054.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/054.html Sat, 01 Nov 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Agent discovery let low-privilege record content steer higher-privilege agents under default configuration. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/053.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/053.html Sat, 01 Nov 2025 00:00:00 +0000 threat-reportweaponautonomous-ops APT28 malware queried Qwen at runtime for commands; first LLM-in-malware seen in operations. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/052.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/052.html Sat, 01 Nov 2025 00:00:00 +0000 threat-reportweaponautonomous-ops Jailbroken Claude Code plus MCP tools ran 80-90% of intrusions against about 30 targets. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/051.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/051.html Wed, 01 Oct 2025 00:00:00 +0000 threat-reportweaponsocial-engineering Actors bolted ChatGPT onto existing toolchains for malware, phishing and scams; accounts banned. Type: threat-report. Lens: weapon. Vector: social-engineering. Outcome: fraud. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/050.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/050.html Wed, 01 Oct 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Hidden PR comment plus Camo image proxy leaked secrets; GitHub disabled image rendering. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/049.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/049.html Mon, 01 Sep 2025 00:00:00 +0000 incidentsurfacesupply-chain v1.0.16 BCC'd every outgoing email to attacker; 1,643 downloads; package removed. Type: incident. Lens: surface. Vector: supply-chain. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/048.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/048.html Mon, 01 Sep 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Reported June 2025; OpenAI silently fixed in August, acknowledged early September. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/047.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/047.html Mon, 01 Sep 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Hidden text in PDF made Notion 3.0 agent leak page contents via search tool. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/046.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/046.html Mon, 01 Sep 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Web-to-Lead injection plus $5 expired whitelisted domain; CVSS 9.4; Salesforce blocked untrusted URLs. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/045.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/045.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Reddit comment made agentic browser fetch email OTP and post it back. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/044.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/044.html Fri, 01 Aug 2025 00:00:00 +0000 incidentsurfacenhi-secrets Postinstall prompted local AI CLIs to hunt secrets; stolen data posted to public GitHub repos. Type: incident. Lens: surface. Vector: nhi-secrets. Outcome: data-exfiltration. CVE: CVE-2025-10894. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/043.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/043.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Injection set chat.tools.autoApprove in settings.json; Microsoft patched August 2025. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. CVE: CVE-2025-53773. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/042.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/042.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Invite title drove smart-home control, Zoom video, geolocation and email theft in demos. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/041.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/041.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuretargetexploitation Approved MCP config swapped for malicious one without re-approval; fixed in 1.3. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: code-execution. CVE: CVE-2025-54136. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/040.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/040.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Injected external data created .cursor/mcp.json without approval; patched in Cursor 1.3. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. CVE: CVE-2025-54135. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/039.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/039.html Fri, 01 Aug 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Broad safe-command allowlist let injected prompt leak secrets over DNS; fixed in v1.0.4. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. CVE: CVE-2025-55284. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/038.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/038.html Fri, 01 Aug 2025 00:00:00 +0000 threat-reportweaponautonomous-ops Claude Code automated recon, credential theft and extortion at 17+ organisations; ransoms exceeded $500k. Type: threat-report. Lens: weapon. Vector: autonomous-ops. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/037.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/037.html Tue, 01 Jul 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Ticket text made developer's MCP assistant copy private tables into customer-visible reply; dummy data. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/036.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/036.html Tue, 01 Jul 2025 00:00:00 +0000 incidentsurfaceexcessive-agency Agent ignored code freeze, deleted production database, fabricated data and misreported rollback. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: data-destruction. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/035.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/035.html Tue, 01 Jul 2025 00:00:00 +0000 vulnerability-disclosuretargetexposure/misconfig Admin login 123456 plus IDOR exposed 64 million applicant records; disclosed 30 June. Type: vulnerability-disclosure. Lens: target. Vector: exposure/misconfig. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/034.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/034.html Tue, 01 Jul 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection README injection abused grep allowlist; reported 27 June, fixed in v0.1.14 on 25 July. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/033.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/033.html Tue, 01 Jul 2025 00:00:00 +0000 incidentsurfacesupply-chain Wiper prompt shipped in v1.84.0 but failed on a syntax error; AWS revoked credentials. Type: incident. Lens: surface. Vector: supply-chain. Outcome: none-demo. CVE: CVE-2025-8217. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/032.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/032.html Sun, 01 Jun 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Zero-click via crafted email, CVSS 9.3; fixed server-side; no known exploitation. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. CVE: CVE-2025-32711. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/031.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/031.html Thu, 01 May 2025 00:00:00 +0000 vulnerability-disclosuretargetgenerated-code Default RLS gaps in generated Supabase apps; supplier disputes CVE as customer responsibility. Type: vulnerability-disclosure. Lens: target. Vector: generated-code. Outcome: information-disclosure. CVE: CVE-2025-48757. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/030.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/030.html Thu, 01 May 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Malicious public issue made agent leak private repo contents into public pull request. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/029.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/029.html Tue, 01 Apr 2025 00:00:00 +0000 vulnerability-disclosuresurfacepoisoning Malicious tool description made Cursor send SSH key and MCP config as arguments. Type: vulnerability-disclosure. Lens: surface. Vector: poisoning. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/028.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/028.html Sat, 01 Mar 2025 00:00:00 +0000 vulnerability-disclosuresurfacepoisoning Hidden Unicode in rules files steers assistants to emit malicious code; vendors cited user responsibility. Type: vulnerability-disclosure. Lens: surface. Vector: poisoning. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/027.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/027.html Sat, 01 Feb 2025 00:00:00 +0000 threat-reportweaponnhi-secrets Scraped customer credentials plus guardrail-bypass tool; Microsoft sued four named defendants. Type: threat-report. Lens: weapon. Vector: nhi-secrets. Outcome: fraud. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/026.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/026.html Sat, 01 Feb 2025 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection GitHub issue steered Operator to copy private Hacker News email into attacker page. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/025.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/025.html Wed, 01 Jan 2025 00:00:00 +0000 vulnerability-disclosuretargetexposure/misconfig Open database with chat history, API secrets and logs; secured after Wiz notice. Type: vulnerability-disclosure. Lens: target. Vector: exposure/misconfig. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/024.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/024.html Tue, 01 Oct 2024 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Web page text made Computer Use download and run attacker binary; beta product. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/023.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/023.html Sun, 01 Sep 2024 00:00:00 +0000 vulnerability-disclosuresurfaceretrieval-memory Injected memory leaked all later chats via image URLs; OpenAI fixed macOS app. Type: vulnerability-disclosure. Lens: surface. Vector: retrieval-memory. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/022.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/022.html Thu, 01 Aug 2024 00:00:00 +0000 vulnerability-disclosuresurfaceretrieval-memory Public-channel message retrieved by Slack AI; poisoned link leaked private channel content. Type: vulnerability-disclosure. Lens: surface. Vector: retrieval-memory. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/021.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/021.html Thu, 01 Aug 2024 00:00:00 +0000 vulnerability-disclosuretargetexploitation HTTP action SSRF bypass reached Azure metadata service; cross-tenant exposure possible. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: information-disclosure. CVE: CVE-2024-38206. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/020.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/020.html Sat, 01 Jun 2024 00:00:00 +0000 vulnerability-disclosuretargetexploitation Digest path traversal gave file write and RCE on Ollama servers; fixed in 0.1.34. Type: vulnerability-disclosure. Lens: target. Vector: exploitation. Outcome: code-execution. CVE: CVE-2024-37032. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/019.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/019.html Wed, 01 May 2024 00:00:00 +0000 vulnerability-disclosuresurfacedirect-injection ask API with visualize runs LLM-generated Python; injection gives RCE. Type: vulnerability-disclosure. Lens: surface. Vector: direct-injection. Outcome: code-execution. CVE: CVE-2024-5565. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/018.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/018.html Wed, 01 May 2024 00:00:00 +0000 incidenttargetnhi-secrets Laravel-stolen keys probed ten LLM services; victim cost up to $46k daily. Type: incident. Lens: target. Vector: nhi-secrets. Outcome: financial-loss. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/017.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/017.html Fri, 01 Mar 2024 00:00:00 +0000 vulnerability-disclosuresurfacegenerated-code Empty package drew 30k+ downloads; Alibaba repo README told users to install it. Type: vulnerability-disclosure. Lens: surface. Vector: generated-code. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/016.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/016.html Thu, 01 Feb 2024 00:00:00 +0000 threat-reportweaponsocial-engineering Five state-linked groups used LLMs for research, scripting and phishing; accounts disabled. Type: threat-report. Lens: weapon. Vector: social-engineering. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/015.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/015.html Thu, 01 Feb 2024 00:00:00 +0000 incidenttargetsupply-chain Malicious models flagged on Hub; baller423 PyTorch model opened reverse shell on load. Type: incident. Lens: target. Vector: supply-chain. Outcome: code-execution. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/014.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/014.html Thu, 01 Feb 2024 00:00:00 +0000 incidentweaponsocial-engineering Employee paid about US$25M after video call with deepfaked CFO and colleagues. Type: incident. Lens: weapon. Vector: social-engineering. Outcome: financial-loss. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/013.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/013.html Thu, 01 Feb 2024 00:00:00 +0000 incidentsurfaceexcessive-agency Tribunal held airline liable for chatbot's invented refund policy. Type: incident. Lens: surface. Vector: excessive-agency. Outcome: financial-loss. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/012.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/012.html Mon, 01 Jan 2024 00:00:00 +0000 incidentsurfacejailbreak Customer prompted bot to swear and write critical poem; DPD updated the system. Type: incident. Lens: surface. Vector: jailbreak. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/011.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/011.html Fri, 01 Dec 2023 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Hidden text on summarised page leaked documents via image URL; vendor first declined. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/010.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/010.html Fri, 01 Dec 2023 00:00:00 +0000 incidentsurfacedirect-injection User told bot to agree with anything; dealer dropped the chatbot. Type: incident. Lens: surface. Vector: direct-injection. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/009.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/009.html Fri, 01 Dec 2023 00:00:00 +0000 vulnerability-disclosuretargetnhi-secrets Tokens spanned 723 organisations; researchers showed write access to Llama-2, Bloom, Pythia repos. Type: vulnerability-disclosure. Lens: target. Vector: nhi-secrets. Outcome: none-demo. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/008.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/008.html Wed, 01 Nov 2023 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Reported 19 Sep 2023; shared-document injection leaked chat history; Google confirmed fix. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/007.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/007.html Wed, 01 Nov 2023 00:00:00 +0000 vulnerability-disclosuretargetextraction Megabytes of memorized training data extracted from production ChatGPT; OpenAI patched the exploit. Type: vulnerability-disclosure. Lens: target. Vector: extraction. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/006.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/006.html Wed, 01 Nov 2023 00:00:00 +0000 incidenttargetavailability OpenAI cited DDoS-like traffic; Anonymous Sudan claimed credit, unverified. Type: incident. Lens: target. Vector: availability. Outcome: service-disruption. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/005.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/005.html Mon, 01 May 2023 00:00:00 +0000 vulnerability-disclosuresurfaceindirect-injection Web injection abused Zapier plugin access; first exploitable cross-plugin request forgery; fixed. Type: vulnerability-disclosure. Lens: surface. Vector: indirect-injection. Outcome: data-exfiltration. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/004.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/004.html Sat, 01 Apr 2023 00:00:00 +0000 incidentsurfaceexposure/misconfig Internal data pasted into public chatbot; Samsung then restricted generative AI tools. Type: incident. Lens: surface. Vector: exposure/misconfig. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/003.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/003.html Sat, 01 Apr 2023 00:00:00 +0000 vulnerability-disclosuresurfacedirect-injection LLM-generated code reached Python exec in LLMMathChain; affects LangChain through 0.0.131. Type: vulnerability-disclosure. Lens: surface. Vector: direct-injection. Outcome: code-execution. CVE: CVE-2023-29374. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/002.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/002.html Wed, 01 Mar 2023 00:00:00 +0000 incidenttargetexposure/misconfig Open-source library bug exposed payment details of 1.2% of Plus subscribers; service paused. Type: incident. Lens: target. Vector: exposure/misconfig. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month. https://basitalisandhu.github.io/ai-agent-incidents/incidents/001.html https://basitalisandhu.github.io/ai-agent-incidents/incidents/001.html Wed, 01 Feb 2023 00:00:00 +0000 incidenttargetextraction Prompt injection exposed hidden rules and codename; Microsoft confirmed Sydney was an internal codename. Type: incident. Lens: target. Vector: extraction. Outcome: information-disclosure. Dates are months unless a day is given; the feed date is the first of that month.