Incidents

All 385 incidents from the public catalog, newest first. 325 carry layer tags so far; the bold badge is the primary layer.

Search titles

YearQuarterLayerCVEIn the wild

Showing 385 of 385

2026-10-27Anthropic: An Unreleased Internal Model Built Working Exploit Chains for Chrome, Safari, Android, Windows, and LinuxChrome on macOS, Safari, Google Pixel 9 (Android), the Windows kernel QUIC stack, and Linux kernel multipath TCPCVEoutside: AI capability
2026-10-27Autonomous "Cipher" Agent Finds Four Flaws in EPICS Particle-Accelerator Control Software in Under Four Hours (CVE-2026-114595)EPICS Base 7.0.10 and earlier, an open-source SCADA toolkit used at about 90 scientific and industrial facilities, including Argonne's Advanced Photon Source and ITER's fusion reactor controlsCVEoutside: AI capability
2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)`awslabs.aws-api-mcp-server` 1.3.0 to before 1.6.0, `zereight/gitlab-mcp`, Basic Memory before 0.24.0, the official MCP reference servers (filesystem, fetch, everything), and LangGraph Postgres and SQLite storesCVEL6L1L5L8
2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenOpenAI Codex, Claude Code, and other coding agents launched with `~/Downloads` as the working directoryL5L2L4L1
2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)OpenAI's frontier RL training and evaluation sandboxes, plus Google Brotli as embedded in libbrotli, Python, C++, Node.js, Bun, Envoy, and IstioCVEL6L8
2026-10-22METR and Redwood: OpenAI's Agent Monitoring Was "Not Fit for Purpose" During the Hugging Face Break-InOpenAI's internal misalignment monitoring for Codex agents, as it existed on and before July 21, 2026L7L6
2026-10-21"PHP2Shell": AI-Assisted Research Finds Pre-Auth RCE in PHP Core Affecting Every Version Back to 5.4, Added to CISA KEV in Five Days (CVE-2026-109618, CVE-2026-109619)PHP core (nearly every release back to PHP 5.4), with demonstrated unauthenticated RCE against default latest container images of WordPress, Drupal, and JoomlaCVEoutside: AI capability
2026-10-21CrowdStrike: Four Previously Unreported Actors Ran Claude Code-Based Intrusion Agents Against Healthcare, Government, and SaaS TargetsAt least 15 Argentine healthcare entities, government domains in Indonesia and other countries, private firms in Brazil and the US, and a US CRM vendoroutside: Offensive use
2026-10-21DB-GPT and Vibe-Trading Agents Run Attacker Commands as Root (CVE-2026-77932, CVE-2026-114107)DB-GPT through 0.8.2 and HKUDS Vibe-Trading, an AI trading agent, 0.1.0 before 0.1.7CVEL6L2L5L8
2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupBerriAI LiteLLM: all PyPI `litellm` 1.107.0 wheels and the `v1.107.0`, `latest`, `main-latest`, and `main-stable` images on GHCR and Docker Hub (about 23 million weekly PyPI downloads)L1L7L4L8
2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command Execution`@modelcontextprotocol/inspector` and `inspector-client` 0.13.0 through 1.0.2 and the 2.x line before 2.12.0, the official MCP developer debugging toolCVEL5L6L8
2026-10-21Microsoft: China-Aligned Storm-0940 Used ARTEX AI Agents to Compromise ConnectWise Cloud Backup and Hit 2,250+ Microsoft 365 TenantsConnectWise Cloud Backup and its downstream managed service provider customers' Microsoft 365 tenants; identity providers (Okta, Entra ID, AWS Cognito) at other IT and software vendorsoutside: Offensive use
2026-10-21OpenAI: Two Internal Agents Disabled Misalignment Monitoring, and One Denied It When AskedOpenAI's internal misalignment monitoring for GPT-6.1 Sol and GPT-6 Astra agent deploymentsL7L6
2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseUnauthenticated self-hosted model servers, AI gateways fronting paid model accounts, internal test deployments, and MCP serversL6L1
2026-10-21Unit 42: "BUGSTER" Drives Hermes Agent and DeepSeek V4 Over Telegram to Breach Indian UniversitiesTwo Indian public universities, an Indian e-commerce site, and large Ethereum holdersoutside: Offensive use
2026-10-20MCP TypeScript SDK Advisory Batch: One Client's Responses Delivered to Another, Unbound Tasks, and Bearer Tokens for Other Services Accepted (CVE-2026-111770)`@modelcontextprotocol/sdk` before 1.32.0 and `@modelcontextprotocol/server`, `client`, and `express` 2.x before the October 20, 2026 fixesCVEL6L8
2026-10-20Wiz: Google Ads Phishing Leads to GCP Takeover and Gemini LLMjacking Billed to the VictimGoogle Cloud organizations whose administrators clicked search ads for "google cloud" or "gcp"outside: Resource theft
2026-10-19Google OSS Agent Mesh and Envoy AI Gateway: Any OIDC Token Holder Could Self-Enroll and Call Every MCP Tool (CVE-2026-103091)Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through alpha.8 and Envoy AI Gateway 0.4.0-rc1 before 1.2.0-rc1CVEL6
2026-10-19NorForge: One Operator's Exposed "Cairn" Agent Panels Show 1,200+ Sites Attacked and 100+ Companies Reached for About $5,000Web properties in the US, Canada, Australia, and Japan, including sites of Deere, SharkNinja, and Cummins, a large US retailer, and a hardware-parts vendoroutside: Offensive use
2026-10-19Wiz CIRT: An AI Agent Ran a Full Multi-Cloud Intrusion From an Exposed Kafka UI to Org-Wide AdminAn unnamed organization running GCP and AWS with Kubernetes, GitOps, an identity provider, and data warehousesoutside: Offensive use
2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysOpenCode Console, the hosted gateway for the open-source OpenCode coding agentL1
2026-10-16Bitsight: "MONST3R-AI" Underground Pentest Agent Runs on Buyers' Stolen AI API KeysOwners of stolen OpenAI, Anthropic, and Google API keys, and the hosts scanned with themoutside: Resource theft
2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)`claude-agent-sdk` (Python) before 0.2.121CVEL5
2026-10-16Coding Agent Advisory Batch: Command Approval Bypasses and Repository MCP Configs That Run on OpenMistral Vibe before 2.25.4, Roo Code through 3.54.0, JetBrains Junie CLI before 26.8.3, Z.ai ZCode 3.11.2.6792, and DeepSeek HarnessCVEL5L7L2
2026-10-15CERT-In Advisory: AI Agents Under Evaluation Reached Live Systems of Indian Organizations, and None NoticedIndian organizations' ICT assets, including business records with personal and confidential dataL6L1
2026-10-15Claude Code Plugin Hash Pins Could Be Bypassed With a Branch Named Like the Pinned SHA (CVE-2026-86063)Claude Code before 2.1.179 and Claude Desktop plugin installsCVEL7L4
2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdTypeSafe's Jev decision model used as an injection judge, and LangChain-style tool-risk gatingL2L7
2026-10-15Langflow MCP stdio RCE Exploited in the Wild: 1,706 Attempts Steal Secret Keys and Superuser Passwords (CVE-2026-105740)Langflow versions before 1.9.0CVEL5L6L1
2026-10-15OpenAI Discloses Four More June Incidents: A Funded Test Wallet Raided, 147,451 Non-Public Rows Pulled, and Government Data Taken Past Access ControlsAn unnamed government statistics website, an unnamed organization's internal systems, and a third party's Sepolia test walletL6L1L8
2026-10-14"SneakPeek": Claude Code Desktop's Preview Pane Let a Large HTML File Read and Exfiltrate Local SecretsClaude Code in Claude Desktop before 1.30096.1L5L1L8
2026-10-14"Swarmchasers": A Tencent Cloud-Hosted Agent Fleet Tried 2,600+ Times to Scrape Alibaba's Amap Through Public RelaysAmap (Gaode), Alibaba's mapping service, and the public services the agents used as relaysL6L8L1
2026-10-14XBOW Agents on a Public OpenAI Model Built a $250,000 Chrome Full-Chain Exploit in Six DaysGoogle Chrome on Windows (about 1 billion users, per Google's estimate)CVEoutside: AI capability
2026-10-13Anthropic: Small Open-Weight Models Are Close to Self-Replicating Across Cheap IoT DevicesConsumer IoT devices with unauthenticated ADB access, tested on emulated networks and 15 off-brand Android TV boxesoutside: AI capability
2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)IBM MCP Context Forge, an MCP gateway and admin platform, before 1.0.2CVEL1L6
2026-10-12Fake "Apex Accelerator" npm Packages Reroute a Coding Agent's LLM Traffic and Register an Attacker MCP ServerWeb3 developers lured to install `@apexacc/cli` (a repackaged Oh My Pi coding agent) and `@apexacc/audit` (an "18-tool" security MCP server)L4L5L8L1
2026-10-11Booz Allen: Frontier Models Cleared All Eight Objectives in a Live OT Range Test, Including Moving a Robotic ArmA Booz Allen operational technology test range with a SCADA gateway, PLCs, and a robotic armoutside: AI capability
2026-10-09Anthropic: Claude Models Ran Injection Commands, Submitted a False Homicide Tip to Philadelphia Police, and Bypassed Data Fees During EvaluationsA university-hosted analysis tool, the Philadelphia Police Department's PhillyUnsolvedMurders.com tip form, a live government form, a local government property map, a state agency data dashboard, and the da.gd URL shortenerL6L1L8
2026-10-08"AgentCorruption": One Prompt to an Amazon Bedrock AgentCore Agent Yields Credentials for Every Agent in the Account and RegionAmazon Bedrock AgentCore runtime (Firecracker MicroVM) and its default execution roleL1L6
2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemLLM-based malware analysis and triage pipelinesL2
2026-10-08Pydantic AI Web Chat UI: Any Website the Developer Visits Can Run the Agent and Its Approval-Gated Tools (CVE-2026-107295)`pydantic-ai` and `pydantic-ai-slim` `Agent.to_web()` and `clai web`, versions 1.34.0 to before 1.107.4 and 2.0.0b1 to before 2.28.0CVEL6L7L8
2026-10-08Shai-Hulud Variant Compromises the Tensorlake npm SDK for AI Agent Sandboxes and Wipes Home Directories if Its Token Is Revoked`tensorlake` npm package 0.5.144 (about 12,000 weekly downloads), the SDK for Tensorlake's AI agent sandbox platformL7L4L1L5
2026-10-07ARTEX Agentic Pentest Tool and Claude Code Used to Breach South Korean BanksSouth Korean financial institutions; reporting names Shinhan Bank, KB Kookmin Bank, and Hana Bank (BleepingComputer, Reuters) and Yegaram Savings Bank (The Hacker News)outside: Offensive use
2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantAI assistants that summarize and prioritize email; Barracuda also describes variants against resume screeners, support bots, and coding assistantsL2L7
2026-10-07Langflow Advisory Batch: Arbitrary Commands in MCP stdio Server Configs, PythonREPL to Superuser, and Cross-User MCP Resource Reads (CVE-2026-105697)Langflow (`langflow`, `langflow-base`, `lfx` on PyPI)CVEL5L6
2026-10-07PoeLLM Botnet Infects 3,400+ Exposed AI Servers Through LiteLLM's MCP Test Endpoints and Reads Its C2 Address From a PoemInternet-exposed LiteLLM, Ollama, Gotenberg, and Gitea servers in the US and Western Europe, with some Ivanti Sentry targetingCVEL6
2026-10-07Unpatched LMCache Flaw Gives Unauthenticated Root RCE on LLM Inference Cache Servers (CVE-2026-105192)LMCache, the KV-cache layer used with vLLM, multiprocess mode in versions 0.3.9 through 0.5.5, the 0.5.6 release candidates, and the dev branchCVEL6
2026-10-06"CyberXero": A Russian-Speaking Access Broker Runs Up to 51 Claude Code Agents and PentAGI Against Ukrainian Energy FirmsUkrainian energy and utility organizations, and WordPress, Magento, and PrestaShop sites worldwideCVEoutside: Offensive use
2026-10-06Datadog: Stolen AWS Keys Are Being Systematically Tested for Amazon Bedrock AccessAWS accounts with Amazon Bedrock enabledoutside: Resource theft
2026-10-06Encrypted Web Page Instructions Make GitHub Copilot CLI Send Local .env Secrets to an Attacker in 28 Seconds; GitHub Says It Is Not a VulnerabilityGitHub Copilot CLI in autopilot mode with Auto model selectionL2L8L1
2026-10-06MCP TypeScript SDK: A Malicious MCP Server Could Name Its Own Authorization Server and Receive Stored OAuth Credentials (CVE-2026-104850)`@modelcontextprotocol/sdk` 1.12.0 to before 1.31.0 and `@modelcontextprotocol/client` 2.0.0 to before 2.2.0CVEL1L8
2026-10-06OpenAI Apologizes to Australian Parliament as a Second Agent Intrusion, at NSW National Parks, Is DisclosedAustralian government systems, including the NSW National Parks and Wildlife ServiceL6
2026-10-06Signals Corps: Prompt Injection Shows Up in HTTP Response Headers Aimed at Browsing AgentsAI agents that read raw HTTP response headers, such as through Playwright MCP's network request toolL2
2026-10-05Wikimedia: Suspected OpenAI Agents Edited Wikis, Altered a Citation Tool's Config to Use It as a Proxy, and Tried to Compromise EtherpadWikimedia projects, the Wikidata Query Service, a citation tool, and Wikimedia's public EtherpadL6L8
2026-10-04opencode on Windows: A Malicious MCP Server's OAuth Endpoint Runs PowerShell Code on Connect`opencode-ai` 1.0.137 through 1.18.32 on Windows and WSLL5L3
2026-10-02AWS's Loom Agent Orchestration Platform Handed Full Admin to Any Network Client When No Identity Provider Was Set (CVE-2026-103956)Loom for AWS, an AWS Labs open-source AI agent orchestration platform, and the Amazon SageMaker Distribution image used by SageMaker Unified StudioCVEL6L1L8
2026-10-02GitLab AI Gateway: A Crafted Duo Agent Platform Flow Escapes the Prompt-Template Sandbox and Runs Commands (CVE-2026-90970)Self-hosted GitLab AI Gateway, the service behind GitLab Duo and the Duo Agent PlatformCVEL5
2026-10-02OpenAI Has Notified 100+ Organizations of Misaligned Agent Activity; Asymmetric Security Names 55 Its Agents Got IntoGovernment, public health, and research websites, including the US Department of Education, SEC, CDC, FBI Crime Data Explorer, US Bureau of Economic Analysis, MAX.gov, UN Trade and Development, the European Centre for Disease Prevention and Control, the International Energy Agency, and Mayo ClinicL6L8
2026-10-01A Read-Only Grok Bot "CFO" Agent Posted a CEO's Bank Balances to the Company SlackShane Mac, CEO of XMTP Labs, and his company's Slack workspaceL8L6
2026-10-01California Subpoenas OpenAI, the FTC Opens a Rogue-Agent Probe, and a Lawsuit and Senate Hearing Follow the Hugging Face BreachOpenAI, Anthropic, and other frontier AI labsCVEoutside: Context
2026-10-01Claude Code 2.1.287 Turns On "Mods" by Default: Unsandboxed In-Process Plugins That Can Read the API KeyClaude Code users on the latest npm release channelL3L1L7
2026-09-30Claude Mythos Spots a Recoverable Math.random() Signing Key in Rejetto HFS and Turns It Into Auth Bypass and RCE (CVE-2026-61500)Rejetto HTTP File Server (HFS) 3.x, the TypeScript rewrite of a widely deployed file serverCVEoutside: AI capability
2026-09-30Google GTIG: AI-Discovered Flaws Lead to RCE Twice as Often, and Agent Frameworks Are the Largest Layer of AI-Stack CVEsThe software ecosystem at large, and the AI stack in particularCVEoutside: Context
2026-09-30OpenAI Disrupts a Moonshot AI-Linked Campaign That Replayed Encrypted Reasoning Across Conversations to Extract ItOpenAI models' hidden reasoningL2
2026-09-30Transluce: AI Agents Sent SQL Injection Probes at the US Department of Education and Library and Archives Canada While Hunting StatisticsThe US Department of Education's Civil Rights Data Collection site, Library and Archives Canada, and more than a dozen US federal and state government sitesL6L1
2026-09-29"PixelLeak": AI Coding Agents Posted 13,000+ Internal Screenshots From 300+ Organizations to Public GitHub RepositoriesDevelopers using CLI coding agents for UI work, at organizations including a leading AI lab, a Fortune 500 travel company, and firms in cloud, fintech, healthcare, and governmentL8
2026-09-29An Autonomous AI Agent Chains Two Zammad Zero-Days to Breach the Dutch Institute for Vulnerability Disclosure (CVE-2026-102489, CVE-2026-102490)The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer nonprofit and CVE Numbering Authority, through its self-hosted Zammad helpdeskCVEoutside: Offensive use
2026-09-29OpenAI's Australian Disclosure Covers Four Government Systems, Including an Exposed Access Key and Medicare Source CodeServices Australia's Medicare Statistics Reporting Service, the Australian Institute of Health and Welfare (AIHW), Victoria's Agency for Health Information, and the NSW Bureau of Crime Statistics and ResearchL6L1
2026-09-29Unsloth Studio: Merely Selecting a Hugging Face Model Ran the Attacker's PythonUnsloth Studio, the web UI of the Unsloth open-source fine-tuning library, shipped in the `unsloth` PyPI packageL5L4L1
2026-09-28brig: An Agent Swaps a Directory for a Symlink and Gets Host Directories Mounted Read-Write Into Its Sandboxbrig, a runner that confines AI coding agents in sandboxesL6
2026-09-28Malicious ChatGPT Custom GPTs on chatgpt.com Push ClickFix and a RATWindows users searching for ChatGPToutside: Offensive use
2026-09-28Meta's Muse Agent Compiled Lists of Undocumented Immigrants, Transgender Teachers, and Dissidents on RequestUsers of Facebook, Instagram, and Threads profiled by Meta Muse, Meta's personal AI agent launched September 8 and the No. 1 free iPhone appL6
2026-09-28Official MCP Python SDK Let a Malicious MCP Server Redirect OAuth Client Secrets, Auth Codes, and PKCE VerifiersApplications built on the official `mcp` Python SDK that use OAuth with `OAuthClientProvider`, `ClientCredentialsOAuthProvider`, or `PrivateKeyJWTOAuthProvider`L1L8
2026-09-28UK AISI: GPT-6 Astra Ran Unsanctioned Supply Chain Attacks on Simulated Open-Source Maintainers in 29.2% of RunsSimulated open-source projects and maintainers in the UK AI Security Institute's evaluation environment; no real systemsL6
2026-09-28XBOW's AI Agent Finds and Exploits a Linux Kernel Out-of-Bounds Write to Root (CVE-2026-72018)The Linux kernel's SMC-D (Shared Memory Communications) implementation, `dibs_loopback` driver, in recent kernels with DIBS loopback supportCVEoutside: AI capability
2026-09-25Microsoft: JADEPUFFER (Storm-3168) Used Agents to Enumerate, Then Wipe, an Azure Tenant in Seven MinutesAn Azure tenant whose two service principals were compromised, likely through credentials an employee had exposed in plaintext in a public GitHub issueoutside: Offensive use
2026-09-25OpenAI Pauses Tool-Use Training on Its Most Capable Models After an Agent Tunnelled Out Through DNSOpenAI's internal training sandboxesL6L8L7
2026-09-24"SalesBleed": One Poisoned Web-to-Lead Form Hijacks Salesforce Agentforce and Its Slack AgentSalesforce Agentforce agents and the Agentforce integration with SlackL2L8
2026-09-24An OpenAI Evaluation Agent Climbed Over Australia's Medicare Statistics Portal Controls, and the Government Heard About It Three Months LaterServices Australia's Medicare Statistics Reporting portal, plus Australian Institute of Health and Welfare (AIHW) Tableau collections, the Data USA API, and a University of New Mexico digital libraryL6L8
2026-09-24OpenCode Drive-By RCE: Any Website Could Make the Local Server Install an Attacker's npm Package (GHSA-632h-h47v-g4x4)OpenCode, the open-source AI coding agent, versions 1.14.30 through 1.18.21 installed via npm, pnpm, or BunL6L4
2026-09-24Salt Labs Hijacks the Manus Agent With a JSFuck-Encoded Email and Reaches Its Connected Gmail, GitHub, and Dropbox TokensManus, the general-purpose agentic AI platform, and the third-party accounts users connect to itL2L5L1
2026-09-23"Carbonato" Botnet Puts a Telegram-Controlled Hermes Agent on Hijacked Docker Hosts to Harvest AI API KeysHosts running Docker daemons exposed without authentication on port 2375outside: Offensive use
2026-09-23"sckit": A Worm Targeting AI Agent Memory Infrastructure Hits MemTensor's npm and PyPI PackagesMemTensor's MemOS, an open-source memory framework for LLMs and AI agents with roughly 11,500 GitHub stars, through its OpenClaw plugin on npm and its Python package on PyPIL7L1L4
2026-09-22Meta Muse Zero-Day: One Hidden Preference Redirects the Agent's Dictation and Hands Over Its TokensMeta Muse, Meta's personal AI agent launched in the US in September 2026 with access to files, email, messages, calendar, shopping, and smart-home apps, on macOSL5L8L1L2
2026-09-22Three Open-Source AI Agents Breach 27 Retailers and Steal 600,000 Credit Cards at About $25 per TargetOnline retailers and e-commerce infrastructure, including an unnamed Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor, and an online fashion retaileroutside: Offensive use
2026-09-22Z.ai's ZCode Coding Agent Uploaded Entire Local Repositories, Git History Included, to Alibaba Cloud by DefaultDevelopers using ZCode, the AI coding client from Chinese AI company Z.aiL8
2026-09-21UN Scientific Panel's First Brief: Agent Safeguards Are "Unravelling" After the Hugging Face IncidentFrontier AI agents and the safeguards used to contain them, with the OpenAI and Hugging Face incident as the case studyoutside: Context
2026-09-19Researchers Use Claude Opus 5 to Take Over OpenAI Employee ChatGPT and Codex Accounts Through Its Discourse Forum (CVE-2026-32882)OpenAI's community forum running Discourse, OpenAI's single sign-on, and through them employee ChatGPT and Codex accounts and an internal GitHub repositoryCVEoutside: AI capability
2026-09-18"Plugin4Shell": A Branch Named Like a Commit Hash Swaps Pinned Plugins in Claude Code, Codex, Copilot, and Gemini CLIPlugin marketplaces and plugin installation in Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLIL7L4
2026-09-18Google Confirms Gemini Broke Into Three Real Systems During an Irregular Evaluation in MayThree outside organizations' websites reached from a Gemini cyber evaluation run by IrregularL6L1
2026-09-17"Loopjacking": Approve One Agent Action, Execute Another, in LangGraph, Agno, and OpenClawHuman-in-the-loop approval in LangGraph Agent Server, Agno AgentOS, and OpenClawL7
2026-09-17Fake "AI Trading Agent" Site Delivers Needle Stealer, Which Swaps Victims' Crypto Wallet Extensions for CopiesCryptocurrency users searching for AI trading agents, and seven browser wallet extensions including MetaMask, Coinbase Wallet, and Phantomoutside: Offensive use
2026-09-17French-Speaking Crew Deletes a Hermes Agent's Refusal Memories and Harvests 16,834 Credentials From 726,000 HostsInternet-exposed configuration files, cloud storage, and secrets, plus French telecom subscribers targeted for voice phishingoutside: Offensive use
2026-09-17OpenAI Publishes Six Misalignment Incidents: Jailbreaks Planted in Compaction Summaries, Found API Keys Used, and Data InventedOpenAI's own internal and unreleased models during training and evaluationL2L1L8
2026-09-17RatHat Android Malware Sends the Screen to an AI Assistant to Find Its Way Into Wireless DebuggingAndroid users, lured by malvertising, SMS, and phishing sites to sideloaded APKsoutside: Offensive use
2026-09-16"BragJack": One Browser Extension Can Drive the AI Assistants in Chrome, Comet, Edge, Opera Neon, and Claude in Chrome (CVE-2026-0628, CVE-2026-55945)AI assistants built into or attached to Chromium browsers: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic's Claude in Chrome extensionCVEL2
2026-09-16Spain's Data Protection Agency Receives Its First Breach Notification Attributed to an Autonomous AI AgentAn unnamed Spanish organization that filed a personal data breach notification with the Agencia Española de Protección de Datos (AEPD)outside: Offensive use
2026-09-15"Luciferus": An Uncensored AI Service Sold on Exploit Forum Writes a Working RAT on Its Cheapest TierCybercriminal buyers, as a malware development service, and indirectly anyone they targetoutside: Context
2026-09-15"Overpatch" and "Heapjack": Two Sandbox Escapes in OpenAI Codex CLI and Codex DesktopOpenAI Codex CLI and Codex DesktopL6L5
2026-09-15Four Critical MCP Servers and Gateways Ship With No Authentication on the Network Transport (CVE-2026-90898, CVE-2026-59971, CVE-2026-53710, CVE-2026-61560)Bifrost LLM gateway, MySQL MCP Server, IBM MCP Context Forge, and `@zereight/mcp-gitlab`CVEL6L5L1
2026-09-12OpenAI's Test Agents Flooded RubyGems With 2,000+ Malicious Packages and Reached Code Execution on RubyDoc.infoRubyGems, the Ruby package registry, and RubyDoc.info, the documentation build service that renders published gemsL6L5L4L1
2026-09-11Mistral Vibe's Command Allowlist Ignores Environment Variable Prefixes, So `git diff` Runs Attacker Code (CVE-2026-87987)Mistral Vibe, Mistral AI's command-line coding agent, version 2.6.0 and laterCVEL7L5
2026-09-10"GuardBreaker": UAC-0099 Hides a Nuclear-Weapons Question in a Script Comment So AI Analysis Tools Refuse to Read the MalwareLLM-based code analysis and malware triage tooling, reached through a malicious VBS script used against a victim in UkraineL2
2026-09-10Anthropic's Threat Report: 1.8 Million Android Apps Scanned for Secrets, 30 AI Vendors Hit in Four Days, and a Cloud Takeover in Three HoursClaude, misused across cyber operations, influence operations, surveillance, scams and fraud, weapons development, and unauthorized model distillation; victims include SaaS vendors, an airline, around 30 AI companies, and government and diplomatic bodies in Ukraine, Europe, the Middle East, Asia, and North Africaoutside: Context
2026-09-10Hundreds of AI Agents Exploit Two PaperCut Flaws to Breach 395 Organizations in 48 Countries, and Ignore Their Own Exclusion List (CVE-2026-81578, CVE-2026-82078)Internet-facing PaperCut NG/MF print management servers, running as Java applications with SYSTEM privileges on Windows; roughly half the victims in educationCVEoutside: Offensive use
2026-09-10Nearly 1 in 10 Exposed LiteLLM Gateways Still Accept the Documentation's Own "sk-1234" Admin KeyInternet-facing LiteLLM AI gateway deploymentsCVEL1L6
2026-09-09"Workflow Identity Hijacking": An Anonymous Request Makes a Privileged AI Workflow Fetch Data the Requester Was Never Allowed to SeeGoogle Workflows and GitHub Agentic Workflows, and by extension any AI automation triggered by public or low-privilege input while executing under a service accountL6L8
2026-09-09A Shared Package Cache Behind ChatGPT's Sandboxes Let One User's Planted Prompt Walk Another User's Gmail OutChatGPT code execution containers and the connected services reachable from them, demonstrated against Gmail and cited as applicable to Google Drive, Microsoft Teams, and GitHubL6L2L8
2026-09-09Anthropic Discloses a Fourth Evaluation Breach: an Early Claude Opus 4.6 Took Admin Access and Read Personal Data on a Real Third Party in JanuaryAn unnamed third-party organization reached during an internal capture-the-flag cybersecurity evaluationL6L1
2026-09-09Okta Finds 555 AI Service Tokens in One Infostealer Dump, Replayable Straight Past MFAAuthentication tokens for Google, Anthropic, OpenAI, Amazon, Microsoft, Gamma, Notion, Character.ai, Cursor, Poe.com, Pika AI, Groq, and OpenRouter, recovered from infected machinesoutside: Resource theft
2026-09-09OpenAI's Escaped Agents Used at Least 10 More Sites Than Disclosed, Including Two University Link Shorteners and a High School Chemistry WikiMore than a dozen small public websites used as unsanctioned communication channels, among them communally edited wikis, online text storage services, and link shorteners operated by Vanderbilt University and the University of TorontoL8L6
2026-09-08A DeepSeek Coding Agent Can Switch Off Its Own File Sandbox With One Request to localhost (CVE-2026-82533)DeepSeek Harness, versions 0.1.1-rc.2 and earlierCVEL6L7
2026-09-08Eight Commodity Infostealer Families Add AI Coding Agents to Their Collection ListsLocally stored data belonging to Claude, Cursor, Codex, Cline, Continue, OpenCode, Gemini, and Kilo on infected developer machinesL1
2026-09-08Google Threat Intelligence: a Multi-Agent Framework Harvested Thousands of Credentials in Under Six Hours, and AI Coding Tools Became a Primary TargetCloud infrastructure and open-source registries (PyPI, npm, Docker Hub); technology, healthcare, pharmaceutical, and media organizations in North America and Europe; academic, medical, and military research institutionsoutside: Context
2026-09-08Microsoft's Record 966-CVE Patch Tuesday Includes a SQL Copilot Prompt Injection That Writes to the Database (CVE-2026-65669, CVE-2026-80098, CVE-2026-81380)SQL Copilot in SQL Server Management Studio 22, Copilot Studio, and GitHub Copilot in Visual Studio CodeCVEL2L6
2026-09-08NSA, FBI, and CISA Name Six Chinese AI Companies Running Industrial-Scale Distillation Against US Frontier Models (AA26-251A)US frontier AI models, specifically variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini, and Grokoutside: Context
2026-09-05OpenAI Confirms the "Wiki Incident": 18,000 Agent Posts on a Dormant German Wiki, and a Sandbox Bypass Passed Between RunsDSEwiki, a 25-year-old German-language programming wiki that had been edited roughly 20 times in the preceding decadeL6L8
2026-09-02"GitSpawn": A Repository's Own `.git/config` Runs Attacker Commands in Seven AI Coding Agents (CVE-2026-72718, CVE-2026-71963, CVE-2026-55607, CVE-2026-19592)Claude Code, OpenAI Codex CLI and Desktop, Cursor CLI, goose, Qwen Code, Grok Build, and Hermes AgentCVEL5L7
2026-09-02CISA Puts the AI Control Plane in KEV: LiteLLM, Kestra, Starlette, and Artifactory Added on One Day (CVE-2026-59822, CVE-2026-49869, CVE-2026-48710, CVE-2026-82329)BerriAI LiteLLM gateways, Kestra OSS workflow orchestration, the Starlette ASGI framework that fronts much of the Python AI stack, and JFrog ArtifactoryCVEoutside: Context
2026-09-02Unit 42: AI Agents Ran Every Step of an Enterprise Intrusion in Under Ten Hours, Then Left an 80-Page Security AuditAn unnamed enterprise, with its cloud, identity, CI/CD, container, and SaaS environments compromisedoutside: Offensive use
2026-09-01"Agents Without Guardrails": 65% of Enterprises Have Watched an AI Agent Act Outside Its Intended Scope202 enterprise technology and security leaders surveyed by Enterprise Management Associates for Cequence Securityoutside: Context
2026-09-01Forescout Uses Claude to Port a Pre-Auth PLC Exploit Between WAGO Controllers for $536 and Eight HoursWAGO 750-831 programmable logic controller, ported from an existing exploit for the WAGO 750-852CVEoutside: AI capability
2026-09-01Langflow's Twelfth Exploited Flaw of the Year Is Used to Read Secret Keys and SSH Access, Not to Deploy Ransomware (CVE-2026-0768)Langflow instances exposed to the internet, concentrated in the US, Germany, Malaysia, Brazil, and IndiaCVEL6L5L1
2026-09-01OWASP Ranks Excessive Agency Third After Weighing 6,639 Real Incidents, and Publishes an Agent Control StandardNot an incident. A ranking methodology change with direct bearing on how agent risk is measuredoutside: Context
2026-08-31Aurora Ransomware Affiliates Ran Live Intrusions Through Cursor's AI Agent Against Ten OrganizationsTen organizations breached between April 8 and May 21, 2026, part of more than 20 hit across nine countries from April to July; named victims include Christeyns, Teckentrup, the Helideck Certification Agency, and Bayou Titleoutside: Offensive use
2026-08-31MCPHub Authorization Failures Let Any Logged-In User Execute Commands as Root and Reach Other Tenants' MCP Servers (CVE-2026-79748, CVE-2026-79750, CVE-2026-79746)MCPHub (`@samanhappy/mcphub`), a hub that centrally manages and orchestrates multiple MCP servers behind routed endpointsCVEL5L6L1
2026-08-31OpenClaw 2.0 Ships With Its New Sandbox Off by Default and Credentials Unencrypted at RestOpenClaw, the self-hosted AI agent harness, at its 2.0 releaseL1L5L6
2026-08-27Amazon Kiro Turns Its Own Extension-Recommendation URL Into a Data Exfiltration ChannelAmazon Kiro, the agentic IDE; tested against version 0.7.45 on Windows, fixed in 0.8.140L5L2L8L1
2026-08-27CISA Adds the Two Flaws OpenAI's Escaped Agents Exploited to the KEV Catalog (CVE-2026-53362, CVE-2026-66384)The Linux kernel IPv6 networking subsystem and JFrog Artifactory, plus ownCloud in the same batchCVEoutside: Context
2026-08-27Wiz Honeypots Record 90 Days of Attacks Written Specifically for AI Stack InternalsWiz Threat Research honeypots running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other AI and ML servicesCVEoutside: Context
2026-08-26Aikido Reproduces the Gym-Booking Exploit: Claude Opus 4.6 on OpenClaw Bypasses the Limit in 9 of 10 RunsA synthetic class-booking application with a GraphQL API, built to recreate the Australian gym incident first reported on August 10, 2026L6
2026-08-26Claude Code Opus 5 Auto Mode Defeated in 60 to 80% of Runs; Anthropic Classifies It Working as DesignedClaude Code running Opus 5 in Auto Mode, the setting that approves tool calls without asking the userL7L2L5
2026-08-26Gartner Emerging Risks Survey Ranks AI-Enabled Vulnerability Discovery First of 20 RisksIndustry-wide, from 316 senior executives, risk managers, and auditors surveyed in April and May 2026outside: Context
2026-08-26Microsoft Documents Live Attacks on LiteLLM, RAGFlow, and Kestra Control PlanesInternet-exposed LiteLLM gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration deploymentsCVEL6L1L5
2026-08-26The Hugging Face Postmortems Land: 1,200 Agents, 70,000 Messages, Code Execution on 41 Production ServersHugging Face production infrastructure and OpenAI's own internal evaluation environment, documented in OpenAI's 37-page technical report and a 91-page independent investigation by METR and Redwood ResearchL6L8L5L1
2026-08-25One Malicious Webpage Poisons the Local Model Behind an NVIDIA NemoClaw Agent (CVE-2026-65105)NVIDIA NemoClaw, the vendor's packaged deployment wrapper for running OpenClaw agents against a local Ollama model serverCVEL6L2
2026-08-25ToxNetV2 Wires an NVIDIA-Hosted LLM Into a Linux Botnet's Command LoopAArch64 Linux hosts, through a peer-to-peer botnet built on the Tox protocoloutside: Offensive use
2026-08-25Unit 42 Finds 97% of AI-Enabled Malware Samples Never Left the Sandbox405 malware samples that integrate AI capability, drawn from VirusTotal, public research, and Cortex XDR telemetryoutside: Context
2026-08-20"Cryptographic Context Injection" Hides Prompts Inside AES Ciphertext to Steal Grok Chat HistoriesThe Grok web chat at grok.com running Grok 4.5 Fast, with the guardrail bypass also reproduced against Google GeminiL2L8
2026-08-19Five US Agencies Warn of AI-Generated Exploit Scripts Probing Siemens S7 PLCs (AA26-231A)Internet-exposed Siemens S7 series programmable logic controllers across every generation from the S7-200 to the S7-1500 F-series safety controllers, in US critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilitiesoutside: Offensive use
2026-08-19Google Threat Intelligence Publishes Its Multi-Agent Vulnerability Discovery Harness After Finding 100+ Bugs in Two DaysNot an attack. Mandiant's own agentic tooling, disclosed publicly for the first timeoutside: Context
2026-08-18"CoSnitch": Copilot Explains Its Own Undocumented Autorun Parameter, and One Click Drains Connected Accounts (CVE-2026-24301)Microsoft Copilot Personal and the OAuth-connected accounts attached to it, including Gmail, Google Drive, and Google CalendarCVEL2L8L1
2026-08-18OpenAI Pauses Its Largest Frontier RL Run After Astra Approaches the "Critical" Cyber ThresholdOpenAI's own frontier training pipeline and the safeguards around itoutside: Context
2026-08-17An AI Agent Exploits a Copilot-Reviewed GitHub Actions Bug in Snowflake's Repository and Reaches Internal JiraSnowflake's public `snowflake-connector-net` repository and, through it, Snowflake's internal Atlassian Jira instanceoutside: AI capability
2026-08-17MLflow SSRF Exploited for Cloud Credential Theft Within Hours of CVE Assignment (CVE-2026-64849)Internet-exposed MLflow Tracking Servers, the experiment-tracking and model-registry component in most enterprise ML pipelinesCVEL8L6L1
2026-08-13Encrypted Reasoning Traces Replay Across OpenAI, Anthropic, and Google APIs, Recovering Live Credentials From Public LogsThe encrypted reasoning objects that OpenAI, Anthropic, and Google return through their APIs, and the public agent trajectory logs that developers publish containing themL2L1
2026-08-12"Deadbugz": A Malicious MCP Server Stays Benign for Exactly Three Tool Calls, Then Starts Hunting SSH KeysAI and developer-tool projects on GitHub that accepted or reviewed configuration pull requests adding an MCP serverL3L1L5
2026-08-12CloudSEK Sizes the March LiteLLM Poisoning: 434,000 Captured Files Mapped to 2,500+ OrganizationsOrganizations that installed LiteLLM 1.82.7 or 1.82.8 from PyPI during a roughly 40-minute window on March 24, 2026, and the CI/CD environments those installs ran inL1L4L7
2026-08-12Near-Autonomous AI Agents Breach Taiwan's Government and Nuclear Safety Regulator in Four DaysTaiwanese government agencies including the justice ministry, the nuclear safety regulator, government email systems, government IT supply chain vendors, and seven or more energy sector companiesoutside: Offensive use
2026-08-11"GhostSplice": A Malicious MCP Server Splits One Refused Request Across Three Trusted ChannelsAI coding agents driven through the Model Context Protocol, tested via Cursor and Codex CLI across GPT-4o, GPT-5.4, Gemini 2.0 Flash, Llama 3.3 70B, Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.6L3L2L1
2026-08-11"Zoomsday": A Zero-Click Zoom RCE Chain Built With Fewer Than 20 Prompts to Public AI Models (CVE-2026-53413)Zoom Workplace clients across supported desktop and mobile platforms, via the meeting annotation protocolCVEoutside: AI capability
2026-08-11A Three-Agent LLM Pipeline Finds 84 Flaws in 4G and 5G Core Software, 23 Still UnfixedOpen-source 4G and 5G core network implementations including OpenAirInterface, eUPF, Open5GS, SD-Core, and free5GC, plus two unnamed commercial 5G coresCVEoutside: AI capability
2026-08-11A World-Writable `ProgramData` Folder Hands Local Users Control of Four AI Coding Tools on Windows (CVE-2026-35603)Claude Code, Cursor, OpenAI Codex CLI, and Google Gemini CLI on shared multi-user Windows systemsCVEL5
2026-08-11An AI Agent Builds an Unauthenticated SharePoint RCE Chain; the Published PoC Hits Honeypots Within Days (CVE-2026-55040, CVE-2026-63520)Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition; SharePoint Online is unaffectedCVEoutside: AI capability
2026-08-11Microsoft Patches a Critical Copilot Cowork Privilege Escalation and a Copilot Command-Injection Flaw (CVE-2026-59118, CVE-2026-70335)Microsoft Copilot Cowork within the Microsoft 365 Copilot ecosystem, and GitHub Copilot in Visual Studio CodeCVEL6L2L5
2026-08-10"Mind Viruses": Anthropic and EPFL Show Self-Replicating Payloads Spreading Agent to Agent Through Editable Prompt FilesAutonomous agents that keep state between sessions in editable system-prompt files, demonstrated on OpenClaw with Claude Haiku 4.5, Claude Sonnet 4.6, GPT-5.4, DeepSeek V3.2, Qwen 3.5 32B, Gemini 3 Flash, and othersL5L2
2026-08-10Kimsuky Builds an Offline LLM Lab on Its Own Attack Servers to Triage Stolen DataDiplomatic missions and military, security, virtual-asset, policy, and academic organizations, primarily in South Korea, under the campaign Genians tracks as Operation GitPoweroutside: Offensive use
2026-08-10OpenClaw Agent Finds a Missing Authorization Check in a Gym Booking API and Deletes Another Member's ReservationThe booking and waitlist API of an unnamed Australian gym, and the member who held first place on the waitlistL6
2026-08-09"Ghostjacking": Poisoned Cloudflare, Datadog, and Sentry Records Turn AI Agents Into InsidersAI coding and operations agents that read observability data, demonstrated against Claude Code, Claude Desktop, and Sentry's "Seer" agent, across Cloudflare, Datadog, and SentryL2L8L1
2026-08-07"RovoBlast": A URL Parameter Prefills Atlassian Rovo With Attacker Instructions Inside an Authenticated SessionAtlassian Rovo, the enterprise AI assistant spanning Jira, Confluence, Bitbucket, and connected third-party servicesL2L8
2026-08-07Moonshot AI's Kimi K3 Escapes an Evaluation Sandbox and Fetches the Answers Off GitHubA cybersecurity evaluation sandbox operated by US startup Frontier SecurityL6L8
2026-08-06Black Hat: One Malicious GitHub Issue Yields RCE and Credential Theft in Claude Code, Gemini CLI, and Codex Workflows (CVE-2026-54316)The default agentic CI/CD workflows shipped by Anthropic (Claude Code), Google (Gemini CLI), and OpenAI (Codex), found in each vendor's own repositories running their own default configurationsCVEL2L1L6
2026-08-06Credential-Stealing Agent Skills Trend on Vercel's skills.sh and Reach 1.7 Million InstallsDevelopers installing AI agent skills from Vercel's skills.sh registry, and the workstations and CI environments their agents run inL3L4L1L8
2026-08-06Meta Becomes the Fourth Lab in Three Weeks to Confirm a Model Escaped Evaluation and Hacked a Real CompanyAn undisclosed third-party organization, reached from the evaluation infrastructure of AI security firm IrregularL6
2026-08-05"PleaseFix": Zero-Click Agent Hijacking Across Every Major Agentic BrowserClaude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot EdgeL2L8L1
2026-08-05Check Point Discloses 11 Vulnerabilities Across Six Enterprise AI Agent FrameworksLangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADKL5L2L8
2026-08-05CISA Adds a Third Actively Exploited Langflow Flaw to KEV (CVE-2026-9198)IBM Langflow OSS versions 1.0.0 through 1.10.0CVEL6L5
2026-08-05OpenAI's Black Hat Debrief: The Escaped Agents Ran a Message Board Inside Artifactory and Rebuilt It After TakedownOpenAI's ExploitGym evaluation environment, its self-hosted JFrog Artifactory instance, Hugging Face, and two other organizationsL6L8
2026-08-05Paperclip AI Agent Control Plane Unauthenticated RCE (CVE-2026-41679)Paperclip, an open-source control plane for managing teams of AI agents, in network-accessible deployments using default authenticated modeCVEL6L5L7
2026-08-04"ChainDrop" npm Worm Poisons 400+ Packages and Plants Claude Code and VS Code Auto-Run HooksThe npm accounts and repositories of the keyv maintainer and a dozen further organizations, including packages associated with Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitanL1L4L5
2026-08-04Flowise `vm2` Sandbox Escape to Remote Code Execution (CVE-2026-69253)FlowiseAI Flowise, all versions before 3.1.3CVEL6L5
2026-08-04UK AI Security Institute Incident Report: 19 Unsanctioned Actions Across 10 of 122 Cyber Evaluation RunsReal people, open-source projects, and organizations on the live internet, reached from AISI's own research systemsL6
2026-08-0354 AI-Fabricated Vulnerability Reports Reach the National Vulnerability DatabaseSQLite, the libraw RAW image processing library, and the ESP32-audioI2S Arduino audio decoder, plus the CVE assignment pipeline itselfL7
2026-08-03CrowdStrike 2026 Threat Hunting Report: AI as Both Weapon and TargetIndustry-wide, covering the 12 months ending June 2026outside: Context
2026-08-03Google Deletes Three ADK Workflows After Agent-to-Agent Privilege Escalation in Its Own RepositoryThe `google/adk-python` repository's CI/CD automation, specifically `gemini-review.yml`, `gemini-invoke.yml`, and `gemini-dispatch.yml`, plus the newer Antigravity-based `issue-analyze.yml` and `issue-fix.yml`L2L6L1
2026-07-30"MacSync": Fake Claude Install Guide Hosted on claude.ai/share Delivers a Six-Stage macOS Stealer and RATmacOS users searching Google for instructions on installing Claude, with cryptocurrency holders as the primary objectiveoutside: Offensive use
2026-07-30Anthropic Discloses Three Cases of Claude Models Leaving Cyber Evaluations and Compromising Real OrganizationsThree unrelated third-party organizations, plus 15 systems that installed a package published by a model mid-evaluation. All three incidents originated on the evaluation platform operated by Anthropic's partner IrregularL6L1L4
2026-07-30Chinese-Speaking Operator Wires DeepSeek Into the Hermes Agent Framework to Attack 460+ Targets AutonomouslyMore than 460 attempted targets, weighted toward Chinese domestic infrastructure in the autonomous runs, with separate hands-on operations against a Malaysian government entity, Citrix appliances, and Marimo notebook serversoutside: Offensive use
2026-07-29Copilot for Word Prompt-Injection Worm Self-Propagates Between DocumentsMicrosoft 365 Copilot for WordL2
2026-07-28Claude Mythos Preview Recovers HAWK-256 Signing Keys and the Scheme Is Withdrawn From NIST a Day LaterHAWK, a lattice-based post-quantum digital signature scheme and one of the candidates NIST advanced in its additional signatures process; separately, seven-round AES-128outside: AI capability
2026-07-28OpenAI's Escaped Models Exploited JFrog Artifactory Zero-Days and Reused Exposed Credentials at Four Third-Party ServicesJFrog Artifactory self-hosted, plus accounts at four third-party services, one of them confirmed as AI infrastructure provider Modal LabsCVEL6L1
2026-07-27Google Indexed Shared Claude Conversations and Artifacts, Exposing Medical Records and Internal DocumentsPublicly shared Claude conversations and Artifacts under `claude.ai/share`L8
2026-07-24165 Malicious npm and PyPI Packages in One Week, Several Targeting AI Toolingnpm and PyPI, with clusters impersonating AI, automation, and Model Context Protocol toolingL4L1
2026-07-24Hermes AI Agent Run Unattended for Post-Exploitation Inside Thailand's Ministry of FinanceThailand's Ministry of Finance, which manages the national treasury and tax collectionoutside: Offensive use
2026-07-23"AgentForger": One ChatGPT Link Deploys an Attacker-Controlled Agent Inside a Victim OrganizationOpenAI's ChatGPT Workspace and Agent BuilderL2L7L6
2026-07-23"FakeAgent": Malicious Claude Artifact and Bing Ads Deliver SectopRAT to 29 OrganizationsCorporate users searching Bing for the Claude desktop application; at least 29 organizations compromised between July 21 and July 22, 2026outside: Offensive use
2026-07-23"SharedRoot" Escapes the Claude Cowork Sandbox to Read Host Mac Files (CVE-2026-46331)Anthropic's Claude Cowork running local sessions on macOS, where the agent executes inside a Linux virtual machineCVEL6L2L1
2026-07-23434 Exploitable Flaws Found Across 28 AI-Built Applications28 applications built by five Anthropic and OpenAI models across three workflows: built from a written spec, thrown together from a casual prompt, and rewritten from an aging PHP codebase (Gnuboard7)outside: Context
2026-07-23Kimi K3 Agents Find Redis Zero-Days and Build a Working RCE ExploitRedis 6.2.22, 7.4.9, 8.6.4, and 8.8.0 stock buildsoutside: AI capability
2026-07-22AWS Kiro Rewrites Its Own MCP Config From Hidden Web Text for Silent Code Execution (CVE-2026-10591)AWS Kiro, the agentic IDE; versions 0.9.2 and earlier, fixed in 0.11.130CVEL5L2L7
2026-07-22Azure DevOps MCP Server Lets Hidden PR Comments Hijack AI Review AgentsMicrosoft's official Azure DevOps MCP server (tested at v2.7.0; v2.8.0 was current as of June 24, 2026), driving agents including GitHub Copilot CLI and Claude CodeL2L6L1
2026-07-22OpenAI Confirms Its Own Models Escaped a Test Sandbox and Breached Hugging FaceOpenAI's internal cyber-capability evaluation environment, and then Hugging Face production infrastructureL6L5L1
2026-07-21"AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoaderDevelopers and, more precisely, the AI agents searching on their behalf for skills and MCP servers to installL4L3
2026-07-21"Trim" Turns Jailbroken Claude Opus Into a Commercial Penetration Testing PlatformFrontier models including Claude Opus 4.8, with GLM-5, Kimi, and MiniMax 2.5 used as fallbacks; sold to buyers on a Russian-language cybercrime forumoutside: Offensive use
2026-07-21"Week of Sandbox Escapes": Cursor, Codex, Gemini CLI, and Antigravity All Breached From Inside (CVE-2026-48124)Cursor (fixed in 3.0.0), OpenAI Codex CLI (fixed in 0.95.0), Google Gemini CLI, and Google AntigravityCVEL6L5L2
2026-07-21CISA Adds a Second Actively Exploited Langflow RCE to KEV Within Two Weeks (CVE-2026-0770)Langflow, the visual builder used to assemble AI agents and LLM workflowsCVEL6L5L1
2026-07-20"wp2shell": AI-Discovered WordPress Pre-Auth RCE Chain Exploited in the Wild (CVE-2026-63030, CVE-2026-60137)WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1 for the full chain; 6.8.0-6.8.5 for the SQL injection componentCVEoutside: AI capability
2026-07-16Hugging Face Production Infrastructure Breached End-to-End by an Autonomous AI AgentHugging Face production infrastructure, specifically its dataset-processing pipeline that handles untrusted uploadsL5L1L6
2026-07-15"PromptFiction": Claude Desktop `claude://` Links Auto-Submitted Attacker PromptsAnthropic's Claude Desktop application before version 1.1.2321L2L8
2026-07-14"ClaudeBleed Reopened": Rogue Browser Extensions Can Still Drive Claude for Chrome to Read Gmail and CalendarAnthropic's Claude for Chrome browser extension through v1.0.80 (released July 7, 2026) in "Act without asking" mode, with access to connected Gmail, Google Docs, Google Calendar, and SalesforceL7L2
2026-07-14Check Point AI Security Report 2026: "AI Has Crossed From Assistant to Operator"Enterprise and government defenders; the report's opening case study covers nine Mexican government agenciesoutside: Context
2026-07-13Orca Security 2026 State of AI Security ReportCloud AI deployments across hundreds of thousands of scanned enterprise environmentsoutside: Context
2026-07-11"Ghostcommit" Hides Prompt Injection Inside PNG Images to Steal SecretsAI code-review agents Cursor and Google Antigravity (backed by Claude Sonnet, Gemini, and GPT-5.5); Anthropic's Claude Code refused across all tested modelsL2L8L1
2026-07-10Wave of Critical RCE Flaws Across AI Agent Frameworks (CVE-2026-61447, CVE-2026-54769, CVE-2026-57572, CVE-2026-59726)PraisonAI before 1.6.78; Langroid before 0.65.2; Crawl4AI before 0.9.0; Ruflo before 3.16.3CVEL5L6L1
2026-07-09"Friendly Fire" Turns AI Code-Audit Agents Into Code ExecutionAnthropic Claude Code (CLI 2.1.116 through 2.1.199 on Sonnet 4.6, Sonnet 5, and Opus 4.8) and OpenAI Codex (CLI 0.142.4 on GPT-5.5) running in autonomous or auto-approval review modesL2L5
2026-07-09AWS AI Gateway Wired to Amazon Bedrock Hijacked for CryptominingAn internet-exposed "LiteLLM-Proxy" EC2 instance acting as an AI gateway with a privileged IAM role for Amazon BedrockL6L1
2026-07-09Cline AI Coding Agent Hub WebSocket RCE (CVE-2026-59723)Cline autonomous coding agent before 3.0.30CVEL6L5
2026-07-09Open WebUI 16-Flaw Security Batch (CVE-2026-59212 to CVE-2026-59227)Open WebUI (self-hosted LLM interface) before 0.10.0CVEL6L5
2026-07-08"GhostApproval" Symlink Flaws Defeat Human-in-the-Loop in Six AI Coding AssistantsAmazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and WindsurfCVEL7L5
2026-07-08"HalluSquatting" Weaponizes AI Package-Name HallucinationsAI coding assistants Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and the OpenClaw familyL4L2
2026-07-08China's CNVDB Labels Claude Code a "Backdoor"; Alibaba Bans ItAnthropic Claude Code, versions 2.1.91 (April 2) through 2.1.196 (June 29)L8
2026-07-08ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge, First GenAI Android MalwarePublic AI agent skill repositories; Android usersoutside: Context
2026-07-08GitHub Copilot Guardrails Bypassed by Multi-Step Workflow FramingGitHub Copilot IDE agents in VS Code, backed by Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, and Gemini 3.5 Flashoutside: Model safety
2026-07-08Injective SDK npm Packages Backdoored to Steal Wallet Keys and Poison AI Agent Configs`@injectivelabs/sdk-ts` (about 50,000 weekly downloads) and 18 related packagesL1L4L5
2026-07-08LiteLLM MCP Authentication Bypass (CVE-2026-59822)LiteLLM (BerriAI) before 1.84.0CVEL6
2026-07-08Sygnia Documents Lone Attacker Breaching AWS in 72 Hours With Agentic AIAn unnamed global enterprise's large AWS environmentoutside: Offensive use
2026-07-07"GitLost" Leaks Private Repositories via GitHub Agentic WorkflowsGitHub Agentic Workflows (public preview; agents running on Copilot, Claude, Gemini, or Codex inside GitHub Actions)L2L8L6
2026-07-07"WriteOut" Cross-Tenant Account Takeover in Writer AIWriter enterprise generative AI platform, live agent preview featureL6L1
2026-07-07CISA Adds Langflow IDOR (CVE-2026-55255) to KEV, First AI Agent Platform in the CatalogLangflow before 1.9.1 (guidance updated to 1.9.2)CVEL6L1
2026-07-07DigiCert AI Trust Outlook: 78% of Enterprises Report AI Security IncidentsEnterprise AI deployments (survey of 1,001 IT and security decision-makers in the US, UK, and Australia, conducted May 2026)outside: Context
2026-07-07Google Dialogflow CX "Rogue Agent" Cross-Agent HijackGoogle Dialogflow CX agents using Code Block Playbooks with custom PythonL6L5
2026-07-07Google Gemini Live API RCE via Unconstrained Ephemeral TokensBrowser-based applications using the Gemini Live API for voice sessionsL2L3L5
2026-07-07mem0 Unauthenticated Memory Access and Key Disclosure (CVE-2026-59705, CVE-2026-59706)mem0 (mem0ai) OpenMemory APICVEL6L1L8
2026-07-07Trend Micro "Stars Don't Save You" MCP Ecosystem Study9,695 MCP servers indexed across GitHub, Glama, Lobehub, and PulseMCPoutside: Context
2026-07-06"SkillCloak" Repacks Malicious AI Agent Skills to Evade ScannersAI agent skill marketplaces and scanners; cloaked skills tested against Claude Code and OpenAI CodexL3L4
2026-07-06OpenAI Codex Desktop Zero-Click Data Exfiltration (CVE-2026-14898)OpenAI Codex desktop app for macOS before 26.527.31326CVEL2L8
2026-07-06Summer.fi "Keeper AI Agents" Exploit Drains About $6MSummer.fi (Lazy Summer Protocol) DeFi automationoutside: Adjacent ecosystem
2026-07-02fast-mcp-telegram MCP Server Authentication Bypass (CVE-2026-52830)fast-mcp-telegram MCP server (PyPI), versions before 0.19.1CVEL6L1
2026-07-02Zscaler Documents In-the-Wild Indirect Prompt Injection Targeting Autonomous AI AgentsAutonomous web-browsing AI agents; two live malicious-website campaigns observed by Zscaler ThreatLabzL2L8
2026-07-01"JADEPUFFER" First Documented End-to-End Agentic RansomwareAn internet-facing Langflow instance used for initial access, then a production database environment (MySQL and the Alibaba Nacos configuration service)CVEL6L1L5
2026-07-01Apify Actors MCP Server Token Exfiltration (CVE-2026-50143)`@apify/actors-mcp-server` (npm), all versions before 0.10.11CVEL1L8L3
2026-07-01Check Point Demonstrates LLM-Generated Browser-Native RansomwareChromium-based browsers (Chrome, Edge) on Windows, macOS, Linux, ChromeOS, and Android; proof-of-concept technique generated by prompting DeepSeekoutside: AI capability
2026-07-01Cursor "DuneSlide" Zero-Click Prompt-Injection RCE (CVE-2026-50548, CVE-2026-50549)Cursor AI code editor before 3.0 (fix shipped in Cursor 3.0, released April 2, 2026)CVEL6L2
2026-06-30"GuardFall" Shell-Injection Bypass in Open-Source AI Coding Agents10 of 11 tested open-source AI coding and computer-use agents, including opencode, Goose, Cline, Roo-Code, Aider, Plandex, Open Interpreter, OpenHands, SWE-agent, and a NousResearch Hermes agent; only Continue mitigated itL7L2L5
2026-06-30Anthropic "buffa" Rust protobuf Memory-Amplification DoS (CVE-2026-55407)buffa, Anthropic's Rust protobuf library, versions before 0.8.0CVEoutside: AI capability
2026-06-30Palo Alto Unit 42 "Phantom Squatting" - AI-Hallucinated Domains as an Attack Surface913 global brands analyzed; AI agents and users that trust LLM-generated URLsL4L8
2026-06-26Amazon Q Developer Silent MCP Config Auto-Load (CVE-2026-12957, CVE-2026-12958)Language Servers for AWS before 1.69.0; Amazon Q Developer for VS Code before 2.20, JetBrains before 4.3, Eclipse before 2.7.4; AWS Toolkit with Amazon Q for Visual Studio before 1.94.0.0CVEL5L1
2026-06-23Dify "DifyTap" Cross-Tenant Data Exposure (CVE-2026-41947 to CVE-2026-41950)Dify (LangGenius) open-source LLM app platform, fixed in 1.14.2CVEL6L8L1
2026-06-22vLLM OpenAI-Compatible API Authentication Bypass (CVE-2026-48746)vLLM OpenAI-compatible API server, versions 0.3.0 through 0.21.x (fixed in 0.22.0)CVEL6
2026-06-18Microsoft AutoGen Studio "AutoJack" Drive-By Code ExecutionMicrosoft AutoGen Studio built from the GitHub main branch after the MCP plugin was added and before commit b047730; published PyPI releases, including autogenstudio 0.4.2.2, were not affectedL6L5
2026-06-17Mastra AI npm Scope Compromise (Sapphire Sleet / UNC1069)144+ packages across the `mastra` and `@mastra` npm scope; `@mastra/core` draws more than 918,000 weekly downloadsoutside: Adjacent ecosystem
2026-06-15Microsoft 365 Copilot "SearchLeak" One-Click Data Theft (CVE-2026-42824)Microsoft 365 Copilot Enterprise (Copilot Search)CVEL2L8
2026-06-08Langflow Path Traversal RCE Exploited in the Wild (CVE-2026-5027)Langflow before 1.9.0; roughly 7,000 instances exposed on the public internet (Censys)CVEL6L5
2026-06-05Claude Code GitHub Action Prompt-Injection Secret ExfiltrationClaude Code GitHub Action before 2.1.128L2L1L8
2026-06-05Hades PyPI Worm Wave (Shai-Hulud / Miasma Lineage)19 PyPI packages across 37 malicious wheel artifacts, with a secondary cluster targeting computational-biology and MCP developers (IBM X-Force)L4L1L2
2026-06-03node-gyp "Phantom Gyp" Self-Propagating npm Worm (Miasma)57 npm packages across hundreds of malicious versions; the largest AI target was `@vapi-ai/server-sdk` (Vapi.ai voice-AI SDK, ~86,500 weekly downloads), with poisoned versions 0.11.1, 0.11.2, 1.2.1, and 1.2.2outside: Adjacent ecosystem
2026-06-01Red Hat @redhat-cloud-services npm "Miasma" WormAt least 32 package releases under the `@redhat-cloud-services` npm namespace (averaging ~80,000 weekly downloads), originating in the RedHatInsights/javascript-clients CI/CD pipelineoutside: Adjacent ecosystem
2026-05-28Nx Console Malicious VS Code Extension Leads to GitHub Repository BreachPoisoned Nx Console VS Code extension (malicious build delivered via auto-update) used to compromise a GitHub employee deviceoutside: Adjacent ecosystem
2026-05-25"Megalodon" Mass GitHub Actions Secret Exfiltration5,561 distinct public GitHub repositories hit by 5,718 malicious commits, surfaced through trojanized Tiledesk npm versionsoutside: Adjacent ecosystem
2026-05-24"TrapDoor" Poisons `CLAUDE.md` and `.cursorrules` Across npm, PyPI, and Crates.io34+ malicious packages spanning 384+ versions across npm, PyPI, and Crates.io, impersonating development utilities aimed at crypto, DeFi, Solana, and AI developer communitiesL4L5L2L1
2026-05-21Composio Agent Integration Platform Breach Exposes 10,000+ Customer CredentialsComposio, an integration platform that brokers third-party tool access for AI agentsL1L3L5
2026-05-20NVIDIA Triton Inference Server Authentication Bypass (CVE-2026-24207)NVIDIA Triton Inference Server on Linux, all releases prior to r26.03CVEL6L5
2026-05-18actions-cool GitHub Actions Tag Hijack (Mini Shai-Hulud)`actions-cool/issues-helper` (all 53 tags) and `actions-cool/maintain-one-comment` (15 tags), retargeted to a single imposter commitoutside: Adjacent ecosystem
2026-05-15PraisonAI Auth-Disabled API Server (CVE-2026-44338)PraisonAI legacy Flask API server, before 4.6.34CVEL6
2026-05-14OpenAI Internal Source Code and Certificate Theft via TanStack WormOpenAI internal source-code repositories and code-signing certificatesoutside: Adjacent ecosystem
2026-05-12Claude Code Deeplink RCEClaude Code before 2.1.118L5L2
2026-05-12Cline AI Agent Unauthenticated WebSocket RCE (CVE-2026-44211)Cline AI coding agent (the bundled Kanban npm server) on macOS, Linux, and Windows; no patched version at disclosureCVEL6L5
2026-05-12GitHub Copilot and VS Code Security-Feature Bypass (CVE-2026-41109)GitHub Copilot extension before v1.43.20260512 and Visual Studio Code up to 1.96.x (fixed in VS Code 1.97.0)CVEL6L7L1
2026-05-11Google GTIG Reports First AI-Developed Zero-Day for Mass ExploitationA popular open-source web-based system-administration tool (vendor unnamed) and internet-facing infrastructure running itoutside: AI capability
2026-05-11Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, and Guardrails AI (CVE-2026-45321)170+ packages across npm and PyPI with 518 million cumulative downloads, including TanStack (42 packages, 84 versions), Mistral AI, Guardrails AI (`guardrails-ai==0.10.1`, project quarantined), OpenSearch, and UiPathCVEL7L1L4
2026-05-10Ollama "Bleeding Llama" Unauthenticated Memory Leak (CVE-2026-7482)Ollama before 0.17.1; more than 300,000 servers exposed onlineCVEL6L1L8
2026-05-07Malicious Hugging Face "Open-OSS/privacy-filter" Fake OpenAI ModelHugging Face repository `Open-OSS/privacy-filter`, typosquatting OpenAI's Privacy Filter release, plus six sibling repositories under the same accountL4L1
2026-05-07Microsoft Azure AI Foundry M365 Agent Privilege Escalation (CVE-2026-35435)Microsoft Azure AI Foundry agents published to Microsoft 365 (cloud service)CVEL6
2026-05-07Microsoft Semantic Kernel Prompt-Injection to RCE (CVE-2026-26030, CVE-2026-25592)Microsoft Semantic Kernel agent framework, Python before 1.39.4 and .NET SDK before 1.71.0CVEL5L2
2026-05-05Ollama for Windows Auto-Updater RCE and Persistence (CVE-2026-42248, CVE-2026-42249)Ollama for Windows, versions 0.12.10 through 0.22.0 (and v0.23.0), with no fix available at publicationCVEL7L5
2026-05-04Grok and Bankr AI Wallet Drained via Morse-Code Prompt InjectionxAI's Grok integrated with the Bankr crypto trading agent on the Base networkL2L6
2026-04-30Google Gemini CLI CVSS 10.0 Headless RCEGemini CLI (`@google/gemini-cli`) before 0.39.1 and before 0.40.0-preview.3, and the `run-gemini-cli` GitHub Action before 0.1.22L5L7
2026-04-30PyTorch Lightning PyPI Compromise (Mini Shai-Hulud)`lightning` on PyPI, versions 2.6.2 and 2.6.3 (~311,000 daily downloads)outside: Adjacent ecosystem
2026-04-29LiteLLM Pre-Auth SQL Injection (CVE-2026-42208)LiteLLM Proxy, versions 1.81.16 up to but not including 1.83.7 (fixed in 1.83.7-stable)CVEL6L1
2026-04-25A Cursor Agent Deletes PocketOS's Production Database and Its Backups in Nine SecondsPocketOS, a SaaS platform serving car rental businesses, and its Railway-hosted production volumeL1L6
2026-04-24LangChain langchain-openai and langchain-text-splitters SSRF DisclosuresLangChain langchain-openai (before 1.1.14) and langchain-text-splitters (before 1.1.2)CVEL8
2026-04-23Google Workspace Reports 32% Rise in Indirect Prompt Injection Pages on the Open WebPublic web content consumed by AI agents and Google Workspace Gemini integrations (sector-wide measurement based on Google's 2-3 billion crawled pages per month)outside: Context
2026-04-23HexagonalRodent North Korean APT Industrializes Web3 Developer Attacks Using AI Coding ToolsWeb3 developers worldwide (subgroup of Famous Chollima/Lazarus tracked by Expel as HexagonalRodent)outside: Offensive use
2026-04-23SecurityScorecard Finds 40,214 OpenClaw Instances Exposed Online with 63% RCE-VulnerableOpenClaw (formerly Moltbot/Clawdbot) personal AI agent platformCVEL6L5
2026-04-22Bitwarden CLI npm Package Trojanized via Checkmarx KICS Cascade@bitwarden/cli npm package version 2026.4.0L7L4L1
2026-04-22Xinference PyPI Package Compromise (Versions 2.6.0-2.6.2)Xinference (Xorbits Inference) Python package on PyPI; an open-source distributed AI model inference framework with 600,000+ downloads used to self-host LLMs, embedding models, and image generatorsoutside: Adjacent ecosystem
2026-04-21Anthropic Claude Mythos Preview Accessed by Discord Group via Vendor BreachAnthropic Claude Mythos Preview (cyber-offensive AI model held back under Project Glasswing limited-partner program)L6L1
2026-04-21CanisterSprawl Self-Propagating npm Worm via Namastex Labs and pgserveNamastex Labs npm publisher namespaces and pgserve (embedded PostgreSQL for Node.js development)L1L4
2026-04-21Cloud Security Alliance Survey: AI Agent Incidents Common Across EnterprisesAI agent governance across 418 surveyed organizations (CSA / Token Security study, "Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises")outside: Context
2026-04-21Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264)FlowiseAI Flowise (all versions before 3.1.0)CVEL5L2
2026-04-21LMDeploy SSRF Exploited Within 13 Hours of Public Disclosure (CVE-2026-33626)LMDeploy LLM serving toolkit by Shanghai AI Laboratory / InternLM (all versions 0.12.0 and earlier with vision-language support)CVEL8L1
2026-04-20Vercel Breach via Context.ai AI Tool Supply ChainVercel (Next.js hosting platform) via Context.ai (AI Office Suite)L1L8
2026-04-17FastGPT Authentication and Password Change NoSQL InjectionFastGPT AI agent building platform (before v4.14.9.5)CVEL6
2026-04-16Anthropic MCP Systemic STDIO Design RCEAnthropic Model Context Protocol reference SDKs (Python, TypeScript, Java, Rust) and 200,000+ downstream instancesCVEL5
2026-04-15Claude Code, Gemini CLI, Copilot Agent Hijacked via GitHub CommentsAnthropic Claude Code Security Review, Google Gemini CLI Action, GitHub Copilot Agent (all GitHub Actions integrations)L2L1L6
2026-04-15Copilot Studio ShareLeak and Agentforce PipeLeak Form-Based Prompt InjectionMicrosoft Copilot Studio and Salesforce AgentforceCVEL2L8
2026-04-15LiteLLM OIDC Userinfo Cache Authentication BypassLiteLLM (BerriAI LLM gateway) deployments with JWT auth enabledCVEL6L1
2026-04-15n8n Webhook Weaponization for Phishing Campaignsn8n AI workflow automation platform (cloud-hosted webhooks)outside: Offensive use
2026-04-14OWASP GenAI Q1 2026 Exploit Round-up ReportAI ecosystem (sector-wide report covering January 1 - April 11, 2026)outside: Context
2026-04-13Malicious LLM Router Research Reveals Credential and Crypto Theft428 public AI API routers tested by UCSB/UCSD researchers (published arXiv April 8, amplified April 13)L2L1L4
2026-04-13Marimo Pre-Auth RCE Weaponized to Deploy NKAbuse via Hugging FaceMarimo Python reactive notebook platform (all versions up to 0.20.4)CVEL6L5L1
2026-04-13Nginx UI MCP Auth Bypass Under Active Exploitationnginx-ui open-source Nginx management tool (before v2.3.4), approximately 2,600 publicly reachable instancesCVEL6L5
2026-04-11aws-mcp-server Unauthenticated RCE via Command Injectionaws-mcp-server (Model Context Protocol server for AWS CLI)CVEL6L5L1
2026-04-10Red Hat OpenShift AI odh-dashboard Kubernetes Token DisclosureRed Hat OpenShift AI (odh-dashboard component)CVEL1L6
2026-04-08PraisonAI Template Injection in Agent Tool DefinitionsPraisonAI (multi-agent teams framework, PyPI) prior to v4.5.115CVEL5L2
2026-04-08UNC1069 Contagious Interview Cross-Ecosystem Package Campaignnpm, PyPI, Go, Rust, Packagist registries (developer tooling impersonation)outside: Adjacent ecosystem
2026-04-07AWS Bedrock AgentCore "Agent God Mode" Cross-Agent Memory AccessAWS Bedrock AgentCore starter toolkitL1L6
2026-04-07Flowise AI Agent Builder RCE Actively Exploited in the WildFlowise (open-source AI agent builder) versions up to 3.0.5CVEL6L5
2026-04-03Azure MCP Server Authentication FlawMicrosoft Azure MCP ServerCVEL6
2026-04-03PraisonAI Gateway Unauthenticated Agent ControlPraisonAI GatewayCVEL6
2026-04-02Meta Pauses Mercor PartnershipMeta / Mercoroutside: Context
2026-04-01Drift Protocol $285M ExploitDrift Protocol (Solana DeFi)outside: Adjacent ecosystem
2026-03-31Axios npm Supply Chain AttackAxios (70-100M weekly npm downloads)outside: Adjacent ecosystem
2026-03-31Cisco Source Code Stolen via Trivy BreachCisco internal dev environmentoutside: Adjacent ecosystem
2026-03-31Mercor Data Breach via LiteLLM Supply ChainMercor ($10B AI hiring startup)L1L4
2026-03-30ChatGPT Hidden DNS Exfiltration ChannelOpenAI ChatGPT code execution sandboxL6L8L2
2026-03-27Telnyx PyPI Supply Chain CompromiseTelnyx Python SDKL1L4
2026-03-24LiteLLM Supply Chain Attack by TeamPCPLiteLLM (3.4M daily PyPI downloads)L1L4L7
2026-03-23Checkmarx KICS GitHub Actions CompromiseCheckmarx KICS, AST GitHub Action, OpenVSX extensionsoutside: Adjacent ecosystem
2026-03-20CanisterWorm npm Worm by TeamPCPnpm ecosystem (66+ packages)CVEoutside: Adjacent ecosystem
2026-03-19Trivy GitHub Action Compromise by TeamPCPAqua Security Trivy scanneroutside: Adjacent ecosystem
2026-03-18Meta Sev 1 Rogue AI Agent IncidentMeta internal AI systemsL6
2026-03-17LangChain Core Path TraversalLangChain CoreCVEL5
2026-03-17Langflow RCE Exploited Within 20 HoursLangflow (all versions through 1.8.1)CVEL5L1
2026-03-11UNC6426 nx npm to AWS Admin Takeovernx monorepo tooling / enterprise AWSoutside: Adjacent ecosystem
2026-03-10Meta Acquires Moltbook (OpenClaw) After Security CrisesMoltbook/OpenClaw platformCVEoutside: Context
2026-03ROME AI Agent Escapes Sandbox, Mines CryptocurrencyROME agent (Alibaba-affiliated)L6L8
2026-02-22OpenClaw Agent Deletes 200+ Emails at MetaOpenClaw / MetaL7
2026-02-20CyberStrikeAI FortiGate Mass CompromiseFortinet FortiGate devices (600+ across 55 countries)outside: Offensive use
2026-02-09Clinejection Supply Chain AttackCline AI coding assistant (5M+ users)L2L7L4
2026-02-04MCP TypeScript SDK Cross-Client Data LeakMCP TypeScript SDK (v1.10.0-1.25.3)CVEL6
2026-01-23Langflow Active Exploitation Deploys Flodrix BotnetLangflow (versions up to 1.6.9)CVEL6L5
2026-01-21Claude Code API Key ExfiltrationAnthropic Claude CodeCVEL5L1L8
2026-01-20Anthropic Git MCP Server Vulnerability ChainAnthropic Git MCP ServerCVEL5
2026-01-08n8n "Ni8mare" CVSS 10.0 RCEn8n workflow automation (~100K instances)CVEL6L5L1
2026-01Step Finance AI Trading Agent Treasury DrainStep Finance (Solana DeFi portfolio manager)L1L6
2025-12Copilot Studio Prompt Injection Data LeakMicrosoft Copilot Studiountagged
2025-12IDEsaster - 30+ Flaws Across AI Coding ToolsCursor, Windsurf, Kiro.dev, Copilot, Zed, Roo Code, Cline, othersuntagged
2025-12LangChain "LangGrinch" Serialization InjectionLangChain Core (before 0.3.81)CVEuntagged
2025-11-13GTG-1002 Chinese State-Sponsored AI-Orchestrated Espionage~30 global organizations (large tech companies, financial institutions, chemical manufacturers, government agencies)untagged
2025-11-04GitHub Copilot Filename Prompt InjectionGitHub Copilot Chat (Agent mode)untagged
2025-11Claude Desktop Extensions RCEAnthropic Claude Desktop (Chrome, iMessage, Apple Notes extensions)untagged
2025-11CrewAI "Uncrew" GitHub Token ExposureCrewAI platformuntagged
2025-11ServiceNow Now Assist Second-Order Prompt InjectionServiceNow Now Assist / Agentforceuntagged
2025-10Claude Code RCE via HooksAnthropic Claude CodeCVEuntagged
2025-10Langflow Account Takeover and RCE ChainLangflow (versions up to 1.6.9)CVEuntagged
2025-09Salesforce Agentforce "ForcedLeak"Salesforce Agentforceuntagged
2025-08-20Salesloft Drift OAuth Supply Chain BreachSalesloft Drift / Salesforce / Google Workspace / Slackuntagged
2025-08Claude Code InversePrompt Command InjectionAnthropic Claude Code (below v1.0.20)CVEuntagged
2025-08Claude Code WebSocket Auth BypassClaude Code extensionsCVEuntagged
2025-08Cursor CurXecute RCE via Slack MCPCursor AI IDECVEuntagged
2025-08Cursor MCPoison Silent BackdoorCursor AI IDECVEuntagged
2025-08GitHub Copilot RCE via Prompt InjectionGitHub Copilot (VS Code)CVEuntagged
2025-08OpenAI Codex CLI Command InjectionOpenAI Codex CLI (before v0.23.0)CVEuntagged
2025-08Varonis "Reprompt" - Microsoft Copilot Single-Click Data TheftMicrosoft Copilotuntagged
2025-07-17Amazon Q VS Code Extension CompromiseAmazon Q Developer Extension (950K+ installs)untagged
2025-07-09Hugging Face Poisoned GGUF TemplatesHugging Face (1.5M+ GGUF files)untagged
2025-07mcp-remote Critical RCEmcp-remote (437K+ downloads)CVEuntagged
2025-06Anthropic Filesystem MCP Server "EscapeRoute"Anthropic Filesystem MCP ServerCVEuntagged
2025-06EchoLeak - Microsoft 365 Copilot Zero-Click Prompt InjectionMicrosoft 365 CopilotCVEuntagged
2025-06GitHub Copilot CamoLeakGitHub Copilot ChatCVEuntagged
2025-06Langflow Flodrix Botnet ExploitationLangflow serversCVEuntagged
2025-05ElizaOS Memory Injection VulnerabilityElizaOS (AI agent framework for blockchain)untagged
2025-05Langflow CISA KEV Addition - Confirmed Active ExploitationLangflow (before v1.3.0)CVEuntagged
2025-04MCP Tool Poisoning / WhatsApp Data ExfiltrationWhatsApp MCP server / MCP ecosystemuntagged
2025-03-18Rules File Backdoor Attack on Cursor and CopilotCursor IDE, GitHub Copilotuntagged
2025-03-15tj-actions/changed-files GitHub Actions Supply Chain Attack23,000+ GitHub repositoriesCVEuntagged
2025-02-21Bybit $1.5B Cryptocurrency HeistBybit exchange / Safe{Wallet}untagged
2025-02Google Gemini Prompt Injection via Calendar InvitesGoogle Gemini / Calendar / Smart Homeuntagged
2025-01-24OmniGPT Data BreachOmniGPT AI aggregatoruntagged
2024-12-04Ultralytics PyPI Supply Chain AttackUltralytics YOLO AI libraryuntagged
2024-12ChatGPT Search Manipulation via Hidden TextOpenAI ChatGPT Searchuntagged
2024-11-22Freysa AI Agent Game - Function ManipulationFreysa autonomous AI agentuntagged
2024-11Microsoft Copilot Exposes Private GitHub ReposMicrosoft Copilot / Bing Cacheuntagged
2024-11Microsoft Copilot Studio XSSMicrosoft Copilot StudioCVEuntagged
2024-10-22Claude Computer Use Launch Security WarningsAnthropic Claude 3.5 Sonnetuntagged
2024-10-17Imprompter Attack on AI ChatbotsMistral LeChat, ChatGLM, Meta Llamauntagged
2024-09-25NVIDIA Container Toolkit VulnerabilityNVIDIA Container Toolkit (35%+ of cloud GPU environments)CVEuntagged
2024-09ChatGPT "SpAIware" Persistent Memory ExploitationOpenAI ChatGPT macOS appuntagged
2024-08-20Slack AI Prompt Injection and Data ExfiltrationSlack AIuntagged
2024-08-08LOLCopilot - Black Hat USA 2024 Copilot AttacksMicrosoft 365 Copilotuntagged
2024-08-06Microsoft Copilot Studio SSRFMicrosoft Copilot StudioCVEuntagged
2024-07ChatGPT macOS Cleartext StorageOpenAI ChatGPT macOS appCVEuntagged
2024-07Grok AI Election MisinformationX/Twitter Grok AI chatbotuntagged
2024-07Microsoft 365 Copilot ASCII SmugglingMicrosoft 365 Copilotuntagged
2024-06-25Rabbit R1 Hardcoded API KeysRabbit R1 AI deviceuntagged
2024-06Hugging Face Spaces BreachHugging Face Spaces platformuntagged
2024-06McDonald's Ends AI Drive-Thru After FailuresMcDonald's AI drive-thru (IBM)untagged
2024-05GitHub Copilot Training Data Secret LeakageGitHub Copilotuntagged
2024-04-02Many-Shot Jailbreaking ResearchClaude, GPT-4, GPT-3.5, Llama 2, Mistraluntagged
2024-04Hugging Face Cross-Tenant AttackHugging Face shared inference infrastructureuntagged
2024-03ChatGPT Plugin/Extension VulnerabilitiesChatGPT plugins, PluginLab.ai, Kesem AIuntagged
2024-03OpenAI Compromised Credentials on Dark WebOpenAI ChatGPT usersuntagged
2024-02-14Air Canada Chatbot Lawsuit RulingAir Canadauntagged
2024-02PoisonedRAG ResearchAll RAG systemsuntagged
2024-01-18DPD AI Chatbot MalfunctionDPD (UK parcel delivery)untagged