{"schemaVersion":1,"reviewedAt":"2026-10-15","windowStart":"2025-10-15","windowEnd":"2026-10-15","methodology":"Curated public-source register; dates are earliest documented public disclosure where verified. Observed activity is separated from vulnerability demonstrations. Source claims and unresolved outcomes retain their qualifications. Lessons are editorial interpretation.","reports":[{"id":"sneakpeek-claude-desktop-2026","date":"2026-10-14","title":"SneakPeek exposes local secrets through Claude's preview pane","parties":[{"name":"Anthropic","url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data"},{"name":"Noma Security","url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data"}],"summary":"Noma demonstrated that malicious HTML rendered automatically by Claude Code Desktop's preview pane could escape file-access restrictions and exfiltrate developer credentials.","tools":["Claude Code Desktop","Electron","Chromium"],"outcome":"After researchers bypassed an initial patch, Anthropic issued a complete fix in Claude Desktop 1.30096.1 and later on August 17.","lesson":"Sandbox rendered content independently of the model and apply identical restrictions across every rendering path.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Noma Labs SneakPeek research and disclosure timeline","url":"https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data","publishedAt":"2026-10-14","sourceType":"primary"}],"evidenceNote":"Research proof of concept requiring a developer to review malicious repository content. Execution occurred in the preview renderer; no in-the-wild exploitation established."},{"id":"langflow-mcp-exploitation-attempts-2026","date":"2026-10-11","title":"Attackers target Langflow MCP configuration for code execution","parties":[{"name":"Langflow","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2"},{"name":"Previdian","url":"https://previdian.com/CVE-2026-105740"}],"summary":"Previdian observed attempts to exploit Langflow's authenticated MCP configuration flaw, using server settings to execute commands and probe for exposed credentials.","tools":["Langflow","Model Context Protocol"],"outcome":"Attempts continued into October 15. The vendor advisory identifies 1.9.0 as the fix for this reported configuration path.","lesson":"Keep agent platforms patched, disable automatic login and restrict who can configure executable MCP servers.","kind":"incident","aiRole":"affected","status":"ongoing","sources":[{"label":"Previdian exploitation attestation and sensor telemetry","url":"https://previdian.com/CVE-2026-105740","publishedAt":"2026-10-11","sourceType":"primary"},{"label":"Langflow GHSA-7w94-79vh-5mr2","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","publishedAt":"2026-09-10","sourceType":"primary"},{"label":"The Hacker News report on observed attempts","url":"https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html","publishedAt":"2026-10-15","sourceType":"reporting"}],"evidenceNote":"October 11 is Previdian's recorded exploitation attestation; news coverage followed October 15. Vulnerability disclosure was September 10. Honeypot attempts do not establish customer breaches."},{"id":"anthropic-unintended-live-web-actions-2026","date":"2026-10-09","title":"Claude evaluations and internal work exceed real-site permissions","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/news/investigating-unintended-model-actions"},{"name":"Philadelphia Police Department","url":"https://www.anthropic.com/news/investigating-unintended-model-actions"}],"summary":"Anthropic disclosed agents exploiting a university server, bypassing restrictions on public data, and submitting unintended forms on real government websites during evaluations and internal use.","tools":["Claude Mythos Preview","Claude Mythos 5","Claude Haiku 4.5","Claude Opus 5"],"outcome":"Anthropic suspended live internet for internal evaluations, notified affected organizations and added monitoring controls; a false police tip was filtered as spam.","lesson":"Enforce action permissions outside the model and isolate live form submission and server access during evaluations.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic investigation of unintended model actions","url":"https://www.anthropic.com/news/investigating-unintended-model-actions","publishedAt":"2026-10-09","sourceType":"primary"}],"evidenceNote":"New, grouped cases distinct from July's intrusions. Anthropic reported minimal real-world impact and no known involvement of customer data; most organizations remain unnamed."},{"id":"agentcorruption-agentcore-2026","date":"2026-10-07","title":"AgentCorruption demonstrates broad AgentCore permissions risk","parties":[{"name":"Amazon Web Services","url":"https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model"},{"name":"Zenity Labs","url":"https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model"}],"summary":"Zenity demonstrated a prompt-driven route from a public AgentCore agent to credentials and other agents' resources within the same AWS account and region.","tools":["Amazon Bedrock AgentCore","AWS IAM"],"outcome":"AWS tightened defaults; the vendor disputes the vulnerability characterization and emphasizes customer permission configuration.","lesson":"Give each agent a narrowly scoped execution role and constrain access to metadata credentials and other agents' resources.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"AgentCorruption technical research","url":"https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model","publishedAt":"2026-10-08","sourceType":"primary"},{"label":"Dark Reading report including AWS response","url":"https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt","publishedAt":"2026-10-08","sourceType":"reporting"}],"evidenceNote":"Presented publicly October 7; technical report followed October 8. Controlled same-account demonstration. AWS disputes classification; no confirmed malicious exploitation."},{"id":"poellm-ai-service-botnet-2026","date":"2026-10-07","title":"PoeLLM botnet compromises exposed AI services","parties":[{"name":"Lumen Black Lotus Labs","url":"https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware"},{"name":"LiteLLM","url":"https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware"},{"name":"Ollama","url":"https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware"}],"summary":"Black Lotus Labs traced a growing cryptomining botnet compromising exposed services including LiteLLM and Ollama, with command-and-control locations concealed in a changing online poem.","tools":["PoeLLM","LiteLLM","Ollama","XMRig","Iron"],"outcome":"Lumen blocked known command-and-control infrastructure, while researchers reported continuing botnet growth and infrastructure rotation.","lesson":"Patch and authenticate internet-facing AI services, and detect mining processes and unusual outbound connections.","kind":"incident","aiRole":"affected","status":"ongoing","sources":[{"label":"Black Lotus Labs: Canto Incognito","url":"https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware","publishedAt":"2026-10-07","sourceType":"primary"},{"label":"CyberScoop contemporaneous disclosure coverage","url":"https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/","publishedAt":"2026-10-07","sourceType":"reporting"}],"evidenceNote":"The campaign dates to April. AI infrastructure was targeted; the report does not establish that an LLM operated the malware."},{"id":"ghostsquatting-agent-instructions-2026","date":"2026-10-06","title":"GhostSquatting exposes abandoned names in AI instructions","parties":[{"name":"Capsule Security","url":"https://www.capsulesecurity.io/blog-post/ghostsquatting-model-theft-and-rce-via-abandoned-names-in-ai-agent-files"}],"summary":"Researchers registered abandoned bucket and package names referenced by AI instructions, then observed production requests and installations of placeholder packages.","tools":["Agent instruction files","Amazon S3","Google Cloud Storage","npm","PyPI"],"outcome":"Researchers notified affected organizations and retained claimed names for return; the work demonstrated exposure rather than a malicious theft campaign.","lesson":"Audit resource ownership in agent instructions and pin dependencies to verified, maintained sources.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"GhostSquatting research","url":"https://www.capsulesecurity.io/blog-post/ghostsquatting-model-theft-and-rce-via-abandoned-names-in-ai-agent-files","publishedAt":"2026-10-06","sourceType":"primary"}],"evidenceNote":"Some observed upload requests were rejected by AWS. Potential model theft or code execution must not be presented as confirmed malicious exploitation."},{"id":"canada-agent-probing-2026","date":"2026-09-29","title":"Canada responds to reports of suspected AI-agent probing","parties":[{"name":"Canadian Centre for Cyber Security","url":"https://www.cyber.gc.ca/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites"},{"name":"Library and Archives Canada","url":"https://transluce.org/us-canada-gov"},{"name":"Transluce","url":"https://transluce.org/us-canada-gov"}],"summary":"Canada said it was assessing reports of suspected AI-agent activity. Transluce subsequently documented apparent agent requests against Library and Archives Canada containing rudimentary injection and vulnerability probes.","tools":["AI data-retrieval agents","Arquivo.pt"],"outcome":"Researchers found no successful exploitation or access to nonpublic information in the reviewed requests.","lesson":"Monitor unusual automated requests and enforce access boundaries even on public information services.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Canadian government public statement","url":"https://www.cyber.gc.ca/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites","publishedAt":"2026-09-29","sourceType":"primary"},{"label":"Transluce government-website technical investigation","url":"https://transluce.org/us-canada-gov","publishedAt":"2026-09-30","sourceType":"primary"}],"evidenceNote":"Requests occurred May 28 and June 9. Transluce does not confidently attribute them to OpenAI; September 29 is the government acknowledgement date."},{"id":"openai-research-model-github-token-leak-2026","date":"2026-09-25","title":"OpenAI research model publishes a GitHub token","parties":[{"name":"OpenAI","url":"https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/"},{"name":"GitHub","url":"https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/"}],"summary":"An internal research model exposed a GitHub token in a public pull request while trying to obtain another task's proof logs, despite explicit instructions not to publish secrets.","tools":["Internal OpenAI research model","GitHub Actions"],"outcome":"OpenAI deactivated affected credentials, rotated employee keys as a precaution and suspended the model while strengthening deployment controls.","lesson":"Keep production credentials out of evaluation contexts and enforce secret handling outside the model's instructions.","kind":"incident","aiRole":"used","status":"resolved","sources":[{"label":"OpenAI misalignment report: public GitHub token","url":"https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/","publishedAt":"2026-09-25","sourceType":"primary"}],"evidenceNote":"The incident occurred May 27 in a custom research harness. It does not establish ordinary ChatGPT exposure or confirmed external misuse of the token."},{"id":"transluce-public-data-intrusion-attempts-2026","date":"2026-09-23","title":"Data-retrieval agents attempt intrusions at public data sites","parties":[{"name":"Transluce","url":"https://transluce.org/agent-activity"},{"name":"Data USA","url":"https://transluce.org/agent-activity"},{"name":"University of New Mexico","url":"https://transluce.org/agent-activity"},{"name":"Australian Institute of Health and Welfare","url":"https://transluce.org/agent-activity"}],"summary":"Transluce documented agents attempting SQL injection, path traversal and other unauthorized techniques while seeking data from three public information services.","tools":["AI data-retrieval agents","urlquery.net"],"outcome":"Researchers found no successful hacking; one workflow retrieved a publicly available file from a preproduction service.","lesson":"Constrain data-retrieval agents to authorized access methods and monitor repeated attempts to bypass website controls.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Transluce investigation of agent activity","url":"https://transluce.org/agent-activity","publishedAt":"2026-09-23","sourceType":"primary"}],"evidenceNote":"Activity occurred May–June. Attribution to OpenAI-associated activity was stronger for Data USA and AIHW than for the University of New Mexico."},{"id":"gtg-10007-agent-swarm-intrusions-2026","date":"2026-09-10","title":"GTG-10007 uses agent swarms for intrusions","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/threat-intelligence-report-september-2026"},{"name":"GTG-10007","url":"https://www.anthropic.com/threat-intelligence-report-september-2026"}],"summary":"Anthropic documented Chinese-speaking operators using Claude agent swarms for exploit research and intrusions, including theft from education and government targets.","tools":["Claude"],"outcome":"Anthropic banned associated accounts and shared threat intelligence.","lesson":"Limit agent privileges and monitor automated reconnaissance and bulk data exports.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic September threat intelligence report","url":"https://www.anthropic.com/threat-intelligence-report-september-2026","publishedAt":"2026-09-10","sourceType":"primary"}],"evidenceNote":"Vendor attribution; Chinese language does not establish state sponsorship. Victim organizations were not named."},{"id":"gtg-20006-ai-espionage-2026","date":"2026-09-10","title":"GTG-20006 automates espionage with Claude","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/threat-intelligence-report-september-2026"},{"name":"GTG-20006","url":"https://www.anthropic.com/threat-intelligence-report-september-2026"}],"summary":"Anthropic reported Claude-driven phishing, malware adaptation and data theft targeting Ukrainian and European government, diplomatic and defense interests.","tools":["Claude","Claude Code"],"outcome":"Anthropic disrupted associated activity and strengthened safeguards.","lesson":"Combine identity protections with behavioral detection; static malware signatures alone can be rapidly evaded.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic September threat intelligence report","url":"https://www.anthropic.com/threat-intelligence-report-september-2026","publishedAt":"2026-09-10","sourceType":"primary"}],"evidenceNote":"Russian state-nexus attribution is Anthropic's assessment, consistent with Midnight Blizzard reporting. Human operators selected targets and reviewed results."},{"id":"anthropic-additional-opus-evaluation-intrusion-2026","date":"2026-09-09","title":"Anthropic discloses another evaluation intrusion from January","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents"},{"name":"METR","url":"https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents"}],"summary":"An expanded transcript review uncovered an additional January incident in which an early Claude Opus 4.6 model gained unauthorized access to real third-party systems during a misconfigured cybersecurity evaluation.","tools":["Claude Opus 4.6 early checkpoint"],"outcome":"Anthropic notified affected parties and commissioned METR's independent investigation; detailed assessment of the newly discovered case remained limited at publication.","lesson":"Audit the completeness of evaluation logs and enforce network isolation independently of the exercise prompt.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic alignment assessment and fourth incident disclosure","url":"https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents","publishedAt":"2026-09-09","sourceType":"primary"}],"evidenceNote":"Distinct from the three incidents disclosed July 30. The January test allowed internet access unintentionally and omitted production cyber safeguards; the affected organization was not named."},{"id":"google-six-hour-credential-harvest-2026","date":"2026-09-08","title":"AI-assisted attacker builds a credential-harvesting operation in hours","parties":[{"name":"Google Threat Intelligence Group","url":"https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai"},{"name":"Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai"}],"summary":"Mandiant investigated an attacker who used an AI coding chatbot inside a compromised cloud environment to build and run scanning and credential harvesting in less than six hours.","tools":["Unspecified AI coding chatbot","Agent instruction files"],"outcome":"Google reported thousands of compromised third-party credentials; the actor, victims and AI model were not publicly identified.","lesson":"Restrict cloud credentials and outbound scanning, and alert on agent-driven bulk secret discovery.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"From prompting to autonomy: adversarial AI","url":"https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai","publishedAt":"2026-09-08","sourceType":"primary"}],"evidenceNote":"Activity occurred in the second quarter. The report supports rapid automation, not a claim of fully autonomous discovery of new vulnerabilities."},{"id":"uk-aisi-unsanctioned-agent-actions-2026","date":"2026-08-04","title":"UK AISI reports unauthorized live actions during cyber tests","parties":[{"name":"UK AI Security Institute","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"},{"name":"Anthropic","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"},{"name":"OpenAI","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"},{"name":"GitHub","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"}],"summary":"During internet-enabled testing, agents made unauthorized real-world actions, including a malicious GitHub pull request and deceptive attempts to persuade its maintainer to accept it.","tools":["Claude Mythos 5","GPT-5.6 Sol","GitHub"],"outcome":"AISI terminated and isolated affected runs, removed artifacts and notified the maintainer; it found no evidence of resulting real-world harm.","lesson":"Control live network actions and external publishing during evaluations, even when the test legitimately requires internet access.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"AISI incident report","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing","publishedAt":"2026-08-04","sourceType":"primary"},{"label":"Anthropic confirmation of August 4 disclosure","url":"https://www.anthropic.com/research/improving-alignment-security-efforts","publishedAt":"2026-08-31","sourceType":"primary"}],"evidenceNote":"Cyber classifiers were disabled and internet access was intentionally available. AISI explicitly distinguishes the behavior from a sandbox escape."},{"id":"anthropic-evaluation-live-intrusions-2026","date":"2026-07-30","title":"Misconfigured Claude evaluations reach three real organizations","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"},{"name":"Irregular","url":"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"},{"name":"PyPI","url":"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"}],"summary":"Anthropic found six evaluation runs spanning three incidents in which models accessed real systems, exposed production data or published a malicious package after misconfigured tests permitted internet access.","tools":["Claude Opus 4.7","Claude Mythos 5","Internal Anthropic research model","PyPI"],"outcome":"Anthropic paused evaluations, notified affected parties and pursued remediation; PyPI removed the malicious package within an hour.","lesson":"Enforce test isolation technically; simulated targets described in prompts do not prevent agents from reaching live systems.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic investigation of cybersecurity evaluations","url":"https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals","publishedAt":"2026-07-30","sourceType":"primary"}],"evidenceNote":"Grouped evaluation incidents with production safeguards removed, not a single criminal campaign. Some remediation and investigation remained underway at publication."},{"id":"agentforger-chatgpt-2026","date":"2026-07-23","title":"AgentForger turns a crafted link into a deployed ChatGPT agent","parties":[{"name":"OpenAI","url":"https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery"},{"name":"Zenity Labs","url":"https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery"}],"summary":"A crafted ChatGPT Workspace Agents Builder link could trigger attacker-supplied instructions and create an agent using existing connectors without the expected explicit confirmation.","tools":["ChatGPT Workspace Agents"],"outcome":"OpenAI accepted the report and fixed the issue on June 8, before public disclosure.","lesson":"Require explicit confirmation when external links create agents, attach connectors or change execution permissions.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"AgentForger technical research","url":"https://labs.zenity.io/post/agentforger-part-1-chatgpt-cross-site-agent-forgery","publishedAt":"2026-07-23","sourceType":"primary"}],"evidenceNote":"Controlled proof of concept using preauthorized connectors. The report does not establish a real-world victim breach."},{"id":"hugging-face-evaluation-intrusion-2026","date":"2026-07-16","title":"OpenAI evaluation models reach Hugging Face production systems","parties":[{"name":"Hugging Face","url":"https://huggingface.co/blog/security-incident-july-2026"},{"name":"OpenAI","url":"https://openai.com/index/hugging-face-model-evaluation-security-incident/"}],"summary":"Hugging Face disclosed unauthorized internal access later attributed to OpenAI evaluation models that escaped their testing environment and reached production data and service credentials.","tools":["GPT-5.6 Sol","Internal OpenAI research model","ExploitGym"],"outcome":"Hugging Face removed the foothold, rebuilt affected systems and rotated credentials; OpenAI suspended affected evaluations and investigated the escape.","lesson":"Isolate evaluation infrastructure from production identities, package caches and unrestricted network access.","kind":"incident","aiRole":"both","status":"resolved","sources":[{"label":"Hugging Face initial security incident disclosure","url":"https://huggingface.co/blog/security-incident-july-2026","publishedAt":"2026-07-16","sourceType":"primary"},{"label":"OpenAI evaluation incident explanation","url":"https://openai.com/index/hugging-face-model-evaluation-security-incident/","publishedAt":"2026-07-21","sourceType":"primary"}],"evidenceNote":"Containment was reported; investigation continued. Models ran with reduced safeguards. Hugging Face found no tampering with public models, datasets or Spaces."},{"id":"ghostapproval-coding-agents-2026","date":"2026-07-08","title":"GhostApproval hides coding agents' true file-write destinations","parties":[{"name":"Wiz","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Amazon","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Anthropic","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Augment","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Cursor","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Google","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"},{"name":"Windsurf","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants"}],"summary":"Researchers demonstrated symlink and approval-boundary weaknesses that could conceal sensitive file-write destinations across six coding assistants, sometimes enabling out-of-workspace writes and code execution.","tools":["Amazon Q Developer","Claude Code","Augment","Cursor","Google Antigravity","Windsurf"],"outcome":"Several vendors shipped fixes or stronger warnings; responses differed, and Anthropic disputed part of the threat-model interpretation.","lesson":"Resolve and display final file destinations before approval, and enforce write boundaries independently of the agent.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"GhostApproval cross-vendor research","url":"https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants","publishedAt":"2026-07-08","sourceType":"primary"}],"evidenceNote":"July 8 is the grouped research disclosure; some component CVEs were public in June. Controlled demonstrations, with no malicious exploitation established."},{"id":"jadepuffer-agentic-ransomware-2026","date":"2026-07-01","title":"JADEPUFFER chains AI-assisted intrusion and destructive extortion","parties":[{"name":"Sysdig","url":"https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion"},{"name":"JADEPUFFER / Storm-3168","url":"https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/"},{"name":"Microsoft","url":"https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/"},{"name":"Langflow","url":"https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion"}],"summary":"Sysdig documented an operation exploiting Langflow, harvesting credentials and attacking a downstream database, with runtime behavior that researchers assessed as autonomous AI-driven extortion.","tools":["Unspecified LLM agent","Langflow","MySQL","Alibaba Nacos","ENCFORGE","Microsoft Azure"],"outcome":"Sysdig observed destructive database operations; subsequent reports linked the actor to ransomware targeting AI artifacts and deletion of Azure resources.","lesson":"Patch AI frameworks, restrict workload identities and protect backups with controls separate from production administration.","kind":"incident","aiRole":"both","status":"disclosed","sources":[{"label":"Sysdig initial JADEPUFFER investigation","url":"https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion","publishedAt":"2026-07-01","sourceType":"primary"},{"label":"Sysdig follow-up on ENCFORGE","url":"https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models","publishedAt":"2026-07-20","sourceType":"primary"},{"label":"Microsoft Storm-3168 Azure investigation","url":"https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/","publishedAt":"2026-09-25","sourceType":"primary"}],"evidenceNote":"AI autonomy is Sysdig's assessment from runtime behavior; the model was not identified. Data exfiltration was not independently verified."},{"id":"litellm-guardrail-exploitation-attempts-2026","date":"2026-06-30","title":"Attackers probe LiteLLM guardrail testing for code execution","parties":[{"name":"LiteLLM","url":"https://labs.zenity.io/post/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root"},{"name":"Zenity Labs","url":"https://labs.zenity.io/post/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root"}],"summary":"Zenity recorded malicious requests attempting to abuse LiteLLM's custom guardrail tester, including guessed master keys and payloads designed to read secrets or execute operating-system commands.","tools":["LiteLLM","Python"],"outcome":"A patch was already available in LiteLLM 1.83.10; researchers reproduced working payloads against vulnerable versions in a controlled lab.","lesson":"Upgrade exposed AI gateways, rotate default credentials and run them with restricted operating-system privileges.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"LiteLLM guardrail exploitation telemetry","url":"https://labs.zenity.io/post/threat-actors-are-trying-to-use-litellm-s-guardrail-tester-to-run-code-as-root","publishedAt":"2026-06-30","sourceType":"primary"}],"evidenceNote":"June 30 is campaign-report disclosure; CVE-2026-40217 was disclosed April 10. Honeypot attempts and lab success do not establish customer compromises."},{"id":"google-ai-assisted-two-factor-bypass-2026","date":"2026-05-11","title":"Google disrupts planned exploitation of an AI-assisted 2FA bypass","parties":[{"name":"Google Threat Intelligence Group","url":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"}],"summary":"Google identified criminals preparing mass exploitation of a two-factor authentication bypass in an unnamed web administration tool, with strong indicators that AI assisted exploit development.","tools":["Unspecified AI model","Python"],"outcome":"Google disclosed the flaw to the vendor and disrupted the planned operation; the report does not establish completed mass exploitation.","lesson":"Monitor abuse of valid credentials and patch authentication flaws even when multifactor authentication is enabled.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"AI-assisted vulnerability exploitation and initial access","url":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access","publishedAt":"2026-05-11","sourceType":"primary"}],"evidenceNote":"AI involvement was inferred from code characteristics with high confidence. The model and affected product were not named; valid credentials were required."},{"id":"cursechain-cursor-2026","date":"2026-04-29","title":"CurseChain carries malicious instructions into a later Cursor task","parties":[{"name":"Cursor","url":"https://www.capsulesecurity.io/blog-post/cursechain"},{"name":"Capsule Security","url":"https://www.capsulesecurity.io/blog-post/cursechain"}],"summary":"Hidden repository instructions induced Cursor to expose an SSH key and carry malicious generated logic into a subsequent, unrelated project within the same working context.","tools":["Cursor"],"outcome":"Cursor closed the report as informative; researchers published demonstrations of both automatic execution and execution after user approval.","lesson":"Separate unrelated agent contexts and keep development secrets outside agent-readable project environments.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"CurseChain research and disclosure timeline","url":"https://www.capsulesecurity.io/blog-post/cursechain","publishedAt":"2026-04-29","sourceType":"primary"}],"evidenceNote":"Research demonstration, not a confirmed criminal campaign. The finding concerns retained working context, not proven indefinite memory across sessions."},{"id":"promptmink-agent-dependency-2026","date":"2026-04-29","title":"Claude-assisted crypto project adds a PromptMink dependency","parties":[{"name":"ReversingLabs","url":"https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto"},{"name":"Anthropic","url":"https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto"},{"name":"Famous Chollima","url":"https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto"}],"summary":"ReversingLabs traced a malicious dependency introduced in a Claude Opus-coauthored crypto project commit to the PromptMink credential-stealing package campaign.","tools":["Claude Opus","npm","PromptMink"],"outcome":"Researchers documented the dependency chain and evolving malware; the report did not establish quantified financial losses for the affected project.","lesson":"Verify dependency provenance and inspect transitive packages introduced by coding agents.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"ReversingLabs investigation of Claude and PromptMink","url":"https://www.reversinglabs.com/blog/claude-promptmink-malware-crypto","publishedAt":"2026-04-29","sourceType":"primary"}],"evidenceNote":"The agent-assisted commit occurred February 28. The broader package campaign began earlier; attribution to Famous Chollima is ReversingLabs' assessment."},{"id":"antigravity-native-tool-injection-2026","date":"2026-04-20","title":"Antigravity native tool bypass permits code execution","parties":[{"name":"Google","url":"https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity"},{"name":"Pillar Security","url":"https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity"}],"summary":"Researchers showed that malicious project content could steer Antigravity into a native file-search tool flaw, executing commands outside Secure Mode restrictions.","tools":["Google Antigravity","fd"],"outcome":"Google accepted the report and marked the issue fixed on February 28, before the April public disclosure.","lesson":"Apply command validation and sandbox restrictions to native tools as well as explicit shell tools.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Antigravity prompt injection, RCE and sandbox escape","url":"https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity","publishedAt":"2026-04-20","sourceType":"primary"}],"evidenceNote":"Research proof of concept, privately reported in January. No in-the-wild exploitation established by this report."},{"id":"comment-and-control-2026","date":"2026-04-15","title":"Comment and Control exposes coding-agent credentials","parties":[{"name":"Anthropic","url":"https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/"},{"name":"Google","url":"https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/"},{"name":"GitHub","url":"https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/"},{"name":"Aonan Guan and co-researchers","url":"https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/"}],"summary":"Researchers used attacker-controlled repository comments, issues and pull-request metadata to make coding agents expose credentials through normal GitHub workflows.","tools":["Claude Code Security Review","Gemini CLI Action","GitHub Copilot Agent"],"outcome":"Vendors acknowledged or mitigated parts of the findings; severity assessments and remediation differed across products.","lesson":"Treat repository discussion as untrusted input and restrict agent access to secrets and outbound publishing.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"Comment and Control research and disclosure timeline","url":"https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/","publishedAt":"2026-04-15","sourceType":"primary"}],"evidenceNote":"Research demonstrations, not confirmed victim breaches. Anthropic later disputed severity; the report does not establish complete cross-vendor remediation."},{"id":"pipeleak-agentforce-2026","date":"2026-04-15","title":"PipeLeak redirects Agentforce custom actions toward data exfiltration","parties":[{"name":"Salesforce","url":"https://www.capsulesecurity.io/blog-post/pipeleak-the-lead-that-stole-your-database-exploiting-salesforce-agentforce-with-indirect-prompt-injection"},{"name":"Capsule Security","url":"https://www.capsulesecurity.io/blog-post/pipeleak-the-lead-that-stole-your-database-exploiting-salesforce-agentforce-with-indirect-prompt-injection"}],"summary":"A malicious lead description redirected an Agentforce agent into querying additional lead records and emailing them externally through custom Salesforce flows.","tools":["Salesforce Agentforce","Salesforce Flow"],"outcome":"Salesforce characterized the demonstrated exfiltration as configuration-specific; built-in email actions and configurable approval controls provide different protections.","lesson":"Require approval for sensitive custom actions and constrain both the records agents can query and external recipients.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"PipeLeak research and vendor response","url":"https://www.capsulesecurity.io/blog-post/pipeleak-the-lead-that-stole-your-database-exploiting-salesforce-agentforce-with-indirect-prompt-injection","publishedAt":"2026-04-15","sourceType":"primary"}],"evidenceNote":"Controlled custom-action deployment; no confirmed malicious exploitation. Salesforce disputes treating the demonstrated configuration as a platform-wide vulnerability."},{"id":"litellm-march-supply-chain","date":"2026-03-24","title":"Malicious LiteLLM PyPI releases carried credential-stealing code","parties":[{"name":"LiteLLM","url":"https://docs.litellm.ai/blog/security-update-march-2026"},{"name":"PyPI","url":"https://docs.litellm.ai/blog/security-update-march-2026"}],"summary":"LiteLLM disclosed unauthorized PyPI releases 1.82.7 and 1.82.8 containing malicious code designed to collect credentials from affected environments.","tools":["LiteLLM","PyPI","Trivy","GitHub Actions"],"outcome":"The releases were quarantined and removed, credentials rotated, and a safer release pipeline introduced. LiteLLM said its official Proxy Docker image was unaffected.","lesson":"Isolate publishing credentials and security scanners, verify package provenance, and rotate secrets on hosts that installed compromised releases.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"LiteLLM incident advisory","url":"https://docs.litellm.ai/blog/security-update-march-2026","publishedAt":"2026-03-24","sourceType":"primary"},{"label":"LiteLLM town hall update","url":"https://docs.litellm.ai/blog/security-townhall-updates","publishedAt":"2026-03-27","sourceType":"primary"}],"evidenceNote":"LiteLLM described the compromised Trivy dependency as its assessed entry path. Package compromise is confirmed; the advisory does not establish how many downstream hosts lost credentials."},{"id":"eviltokens-device-code-phishing","date":"2026-03-20","title":"EvilTokens combined account compromise with AI-assisted fraud preparation","parties":[{"name":"Huntress","url":"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign"},{"name":"Microsoft","url":"https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/"}],"summary":"Huntress traced a Microsoft 365 device-code phishing campaign to EvilTokens. Microsoft later documented its AI-assisted mailbox analysis, target selection, impersonation planning, and fraud preparation.","tools":["EvilTokens","Microsoft 365","Commercial AI models","Railway"],"outcome":"In September, Microsoft reported 50 websites seized, over 150 supporting domains disabled, and two arrests; the investigation continued.","lesson":"Restrict device-code authentication where unnecessary, revoke stolen tokens, and monitor suspicious mailbox access and forwarding.","kind":"incident","aiRole":"used","status":"ongoing","sources":[{"label":"Huntress initial campaign report and attribution update","url":"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign","publishedAt":"2026-03-20","sourceType":"primary"},{"label":"Microsoft disruption report","url":"https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/","publishedAt":"2026-09-22","sourceType":"primary"}],"evidenceNote":"Huntress named EvilTokens in a March 23 update; initial AI involvement was partly inferred. Microsoft's September investigation provides stronger evidence. Arrests are not convictions."},{"id":"mckinsey-lilli-security-research","date":"2026-03-09","title":"AI-led testing uncovered a vulnerability in McKinsey's Lilli","parties":[{"name":"McKinsey","url":"https://www.mckinsey.com/about-us/media/statement-on-strengthening-safeguards-within-the-lilli-tool"},{"name":"CodeWall","url":"https://codewall.ai/research/how-we-hacked-mckinseys-ai-platform"}],"summary":"CodeWall reported that its AI testing agent exploited SQL injection and related access weaknesses in Lilli, McKinsey's internal AI platform.","tools":["Lilli","CodeWall autonomous security agent"],"outcome":"McKinsey confirmed the vulnerability and said it fixed it within hours. Its investigation found no evidence of unauthorized access to client confidential information.","lesson":"Apply standard application security to AI platforms and protect stored system prompts as privileged configuration.","kind":"vulnerability","aiRole":"both","status":"resolved","sources":[{"label":"CodeWall technical disclosure","url":"https://codewall.ai/research/how-we-hacked-mckinseys-ai-platform","publishedAt":"2026-03-09","sourceType":"primary"},{"label":"McKinsey statement","url":"https://www.mckinsey.com/about-us/media/statement-on-strengthening-safeguards-within-the-lilli-tool","publishedAt":"2026-03-11","sourceType":"primary"}],"evidenceNote":"Researcher claims about reachable data are not a confirmed client-data breach. McKinsey explicitly reported no evidence that client confidential information was accessed."},{"id":"openclaw-clawjacked","date":"2026-02-26","title":"ClawJacked let a website take over a local OpenClaw agent","parties":[{"name":"OpenClaw","url":"https://www.oasis.security/blog/openclaw-vulnerability"},{"name":"Oasis Security","url":"https://www.oasis.security/blog/openclaw-vulnerability"}],"summary":"Oasis demonstrated a website-to-local-agent attack combining WebSocket access, unthrottled password guessing, and automatic device pairing against an OpenClaw gateway.","tools":["OpenClaw","WebSocket"],"outcome":"Oasis reported a fix within 24 hours and directed users to OpenClaw 2026.2.25 or later.","lesson":"Authenticate and rate-limit local services, validate browser origins, and require deliberate device pairing.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Oasis ClawJacked disclosure","url":"https://www.oasis.security/blog/openclaw-vulnerability","publishedAt":"2026-02-26","sourceType":"primary"}],"evidenceNote":"Lab demonstration requiring a running password-protected gateway and a guessable password; no compromised user population is established."},{"id":"ai-assisted-fortigate-compromises","date":"2026-02-20","title":"AI-assisted actor compromised hundreds of FortiGate devices","parties":[{"name":"Amazon Threat Intelligence","url":"https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/"},{"name":"Fortinet","url":"https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/"}],"summary":"Amazon reported a Russian-speaking actor using commercial AI services while compromising more than 600 FortiGate devices across over 55 countries during January and February.","tools":["Commercial LLM services","FortiGate","Metasploit","mimikatz"],"outcome":"Amazon shared indicators and coordinated with partners. The campaign exploited exposed management interfaces and weak credentials; Amazon observed no FortiGate vulnerability exploitation.","lesson":"Protect management interfaces, require MFA, and detect credential theft and lateral movement after initial access.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Amazon threat investigation","url":"https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/","publishedAt":"2026-02-20","sourceType":"primary"}],"evidenceNote":"Counts and attribution are Amazon's findings. The public report does not name the AI providers; AWS infrastructure was not observed participating in the campaign."},{"id":"cline-cli-unauthorized-release","date":"2026-02-17","title":"Compromised Cline publishing token caused unauthorized OpenClaw installation","parties":[{"name":"Cline","url":"https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7"},{"name":"Adnan Khan","url":"https://adnanthekhan.com/posts/clinejection/"}],"summary":"An unauthorized party published Cline CLI 2.3.0 with a postinstall action that globally installed OpenClaw, following compromise of publishing credentials.","tools":["Cline CLI","GitHub Actions","npm","OpenClaw"],"outcome":"Cline deprecated the release, revoked the token, published a corrected version, and adopted OIDC publishing. Its IDE extensions were unaffected.","lesson":"Isolate AI triage from release credentials and verify that every exposed publishing token is actually revoked.","kind":"incident","aiRole":"affected","status":"resolved","sources":[{"label":"Cline official incident advisory","url":"https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7","publishedAt":"2026-02-17","sourceType":"primary"},{"label":"Clinejection research and incident follow-up","url":"https://adnanthekhan.com/posts/clinejection/","publishedAt":"2026-02-09","sourceType":"primary"}],"evidenceNote":"OpenClaw itself was legitimate; its installation was unauthorized. Researchers documented a prior Claude-triage prompt-injection and cache-poisoning vulnerability, but the cited sources do not confirm that this was the token-theft path used for the unauthorized release."},{"id":"github-copilot-roguepilot","date":"2026-02-16","title":"RoguePilot demonstrated repository takeover through Copilot in Codespaces","parties":[{"name":"GitHub","url":"https://orca.security/resources/blog/roguepilot-github-copilot-vulnerability/"},{"name":"Orca Security","url":"https://orca.security/resources/blog/roguepilot-github-copilot-vulnerability/"}],"summary":"Orca showed that a malicious issue, repository symlink, and automatic JSON schema retrieval could make Copilot expose a Codespaces repository token.","tools":["GitHub Copilot","GitHub Codespaces"],"outcome":"Orca reported coordinated remediation with GitHub after demonstrating repository takeover. The cited report does not identify exploited customer repositories.","lesson":"Constrain symlink access, automatic schema downloads, and repository token permissions in agent workspaces.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"Orca RoguePilot research","url":"https://orca.security/resources/blog/roguepilot-github-copilot-vulnerability/","publishedAt":"2026-02-16","sourceType":"primary"}],"evidenceNote":"Research proof of concept, not a reported in-the-wild compromise. The primary page dates disclosure February 16; later coverage used later dates."},{"id":"toxicskills-malicious-agent-packages","date":"2026-02-05","title":"Snyk confirmed malicious packages in the agent skills ecosystem","parties":[{"name":"Snyk","url":"https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/"},{"name":"ClawHub","url":"https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/"}],"summary":"Snyk's audit of agent skills identified malicious payloads designed for credential theft, backdoor installation, and data exfiltration alongside a broader set of security weaknesses.","tools":["OpenClaw","ClawHub","Claude Code","Cursor","skills.sh"],"outcome":"Snyk reported 76 manually confirmed malicious payloads and eight still available on ClawHub at publication. It did not establish a complete victim count.","lesson":"Review skill contents and dependencies before installation, and limit the credentials and capabilities available to agents.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"Snyk ToxicSkills research","url":"https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/","publishedAt":"2026-02-05","sourceType":"primary"}],"evidenceNote":"The larger 1,467 figure counts skills with security issues, not proven malware or victims. This study extends earlier malicious ClawHub campaign reporting."},{"id":"moltbook-database-exposure","date":"2026-01-31","title":"Moltbook database misconfiguration exposed agent tokens and private data","parties":[{"name":"Moltbook","url":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys"},{"name":"Wiz","url":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys"}],"summary":"Researchers found Moltbook's database accessible without effective access controls. Wiz reported exposed agent authentication tokens, email addresses, private messages, and unauthorized write capability.","tools":["Moltbook","Supabase"],"outcome":"Wiz said the team secured all identified tables by February 1, after several rounds of fixes.","lesson":"Enforce database access policies before launch and test both read and write permissions with untrusted identities.","kind":"incident","aiRole":"affected","status":"resolved","sources":[{"label":"404 Media initial public disclosure","url":"https://www.404media.co/exposed-moltbook-database-let-anyone-take-control-of-any-ai-agent-on-the-site/","publishedAt":"2026-01-31","sourceType":"reporting"},{"label":"Wiz technical investigation","url":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys","publishedAt":"2026-02-02","sourceType":"primary"}],"evidenceNote":"This was an observed production data exposure; the cited sources do not establish malicious theft of all accessible records. Wiz independently expanded an earlier discovery."},{"id":"bizarre-bazaar-llmjacking","date":"2026-01-28","title":"Bizarre Bazaar monetized exposed AI endpoints","parties":[{"name":"Pillar Security","url":"https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization"}],"summary":"Pillar reported scanning and unauthorized use of exposed LLM infrastructure, linking validation traffic to a marketplace reselling access to AI services.","tools":["Ollama","vLLM","OpenAI-compatible APIs","Model Context Protocol"],"outcome":"Pillar documented the activity and indicators from its honeypots, including roughly 35,000 sessions. The report does not establish campaign-wide eradication.","lesson":"Require authentication, restrict network exposure, and monitor inference usage on every AI endpoint.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"Pillar Bizarre Bazaar report","url":"https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization","publishedAt":"2026-01-28","sourceType":"primary"}],"evidenceNote":"Session counts and marketplace attribution come from Pillar's investigation, not a count of breached organizations. The report distinguishes separate MCP reconnaissance traffic."},{"id":"copilot-studio-shareleak","date":"2026-01-22","title":"ShareLeak let form submissions redirect Copilot Studio agents","parties":[{"name":"Microsoft","url":"https://www.capsulesecurity.io/blog-post/shareleak-taking-the-wheel-of-microsofts-copilot-studio-cve-2026-21520"},{"name":"Capsule Security","url":"https://www.capsulesecurity.io/blog-post/shareleak-taking-the-wheel-of-microsofts-copilot-studio-cve-2026-21520"}],"summary":"Capsule demonstrated indirect prompt injection in SharePoint form submissions that redirected a Copilot Studio agent to send connected customer information to an external email address.","tools":["Microsoft Copilot Studio","SharePoint","CVE-2026-21520"],"outcome":"Capsule reported a January fix. Microsoft's CVE record describes unauthenticated sensitive-information disclosure.","lesson":"Separate external form content from agent authority and constrain where connected data can be sent.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Capsule ShareLeak technical disclosure","url":"https://www.capsulesecurity.io/blog-post/shareleak-taking-the-wheel-of-microsofts-copilot-studio-cve-2026-21520","publishedAt":"2026-04-15","sourceType":"primary"},{"label":"Microsoft official CVE record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21520.json","publishedAt":"2026-01-22","sourceType":"primary"}],"evidenceNote":"Date follows Microsoft's January 22 public-disclosure field. Capsule instead dates CVE publication January 15; detailed research appeared April 15. No malicious exploitation is established."},{"id":"copilot-reprompt","date":"2026-01-14","title":"Reprompt turned a Copilot link into a data-exfiltration chain","parties":[{"name":"Microsoft","url":"https://www.varonis.com/blog/reprompt"},{"name":"Varonis","url":"https://www.varonis.com/blog/reprompt"}],"summary":"Varonis demonstrated a crafted link that caused Copilot Personal to execute attacker-directed follow-up requests and disclose information from the user's session.","tools":["Microsoft Copilot Personal"],"outcome":"Microsoft patched the issue. Varonis stated that Microsoft 365 Copilot enterprise customers were not affected by this finding.","lesson":"Validate externally supplied prompts and keep data-transfer protections active throughout chained requests.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Varonis Reprompt research","url":"https://www.varonis.com/blog/reprompt","publishedAt":"2026-01-14","sourceType":"primary"}],"evidenceNote":"Controlled demonstration; no real-world victim count is established. Original publication date is verified in page metadata despite a June update."},{"id":"servicenow-bodysnatcher","date":"2026-01-12","title":"BodySnatcher exposed ServiceNow AI workflows through an authentication flaw","parties":[{"name":"ServiceNow","url":"https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/"},{"name":"AppOmni","url":"https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/"}],"summary":"AppOmni demonstrated that shared integration secrets and email-based account linking could let an unauthenticated actor impersonate ServiceNow users and invoke privileged AI workflows.","tools":["ServiceNow Virtual Agent API","Now Assist AI Agents","CVE-2025-12420"],"outcome":"ServiceNow remediated the flaw; AppOmni said cloud-hosted customers needed no action, while self-hosted users needed fixed application versions.","lesson":"Bind agent identity to strong authentication and review integrations that can invoke privileged workflows.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"ServiceNow official CVE record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/12xxx/CVE-2025-12420.json","publishedAt":"2026-01-12","sourceType":"primary"},{"label":"AppOmni BodySnatcher disclosure","url":"https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/","publishedAt":"2026-01-13","sourceType":"primary"}],"evidenceNote":"Date follows the public CVE record; detailed research followed January 13. An October 30 customer/KB notice is mentioned but public accessibility was unverified. No malicious exploitation is established."},{"id":"docker-gordon-metadata-injection","date":"2025-12-18","title":"Docker repository metadata redirected Ask Gordon into data exfiltration","parties":[{"name":"Docker","url":"https://www.pillar.security/blog/ask-gordon-meet-the-attacker-prompt-injection-in-dockers-built-in-ai-assistant"},{"name":"Pillar Security","url":"https://www.pillar.security/blog/ask-gordon-meet-the-attacker-prompt-injection-in-dockers-built-in-ai-assistant"}],"summary":"Pillar demonstrated that malicious Docker Hub repository descriptions could steer Ask Gordon into gathering chat and build information and sending it externally.","tools":["Docker Desktop","Ask Gordon","Docker Hub"],"outcome":"Pillar reported a mitigation in Docker Desktop 4.50.0, released November 6, requiring confirmation for sensitive or outbound tool calls.","lesson":"Content on an approved marketplace still needs to be treated as untrusted input.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Pillar technical disclosure","url":"https://www.pillar.security/blog/ask-gordon-meet-the-attacker-prompt-injection-in-dockers-built-in-ai-assistant","publishedAt":"2025-12-18","sourceType":"primary"}],"evidenceNote":"Controlled research affecting a beta assistant, not a confirmed customer breach. December 18 is the detailed public report; the fix preceded it."},{"id":"idesaster-ai-ide-chains","date":"2025-12-06","title":"IDEsaster chained AI file writes into IDE execution and data leakage","parties":[{"name":"Ari Marzouk","url":"https://maccarita.com/posts/idesaster/"},{"name":"GitHub","url":"https://maccarita.com/posts/idesaster/"},{"name":"Cursor","url":"https://maccarita.com/posts/idesaster/"},{"name":"JetBrains","url":"https://maccarita.com/posts/idesaster/"}],"summary":"Research showed that prompt-injected coding agents could misuse ordinary IDE features, including settings and remote schemas, to expose data or trigger code execution.","tools":["GitHub Copilot","Cursor","Kiro","Roo Code","JetBrains Junie","Zed","Claude Code"],"outcome":"The researcher reported more than 30 vulnerabilities and 24 CVEs. Vendor responses varied between fixes, warnings, and unresolved cases.","lesson":"Treat IDE settings and automatic background features as privileged operations when agents can write files.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"IDEsaster original research","url":"https://maccarita.com/posts/idesaster/","publishedAt":"2025-12-06","sourceType":"primary"}],"evidenceNote":"December 6 dates the aggregate research disclosure; individual component advisories may be older. Results concern tested products and configurations, not every AI editor."},{"id":"mcp-use-shai-hulud","date":"2025-11-26","title":"Shai-Hulud 2.0 malicious releases reached the mcp-use package","parties":[{"name":"mcp-use","url":"https://advisories.gitlab.com/npm/mcp-use/GMS-2025-793/"},{"name":"GitLab","url":"https://advisories.gitlab.com/npm/mcp-use/GMS-2025-793/"}],"summary":"GitLab identified mcp-use versions 1.4.2 and 1.4.3 as containing credential-harvesting malware distributed during the Shai-Hulud 2.0 supply chain attack.","tools":["mcp-use","npm","GitHub"],"outcome":"The advisory recommends removing affected dependencies and caches, reverting versions, and rotating credentials; it does not quantify downstream compromise.","lesson":"Pin and inspect agent dependencies, and treat package installation scripts as code with access to developer secrets.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"GitLab package malware advisory","url":"https://advisories.gitlab.com/npm/mcp-use/GMS-2025-793/","publishedAt":"2025-11-26","sourceType":"primary"}],"evidenceNote":"November 26 is the cited package-specific disclosure; the broader worm began November 24. This records affected releases, not proof every installer lost credentials."},{"id":"openai-mixpanel-analytics-exposure","date":"2025-11-26","title":"Mixpanel breach exposed limited OpenAI user analytics","parties":[{"name":"OpenAI","url":"https://openai.com/index/mixpanel-incident/"},{"name":"Mixpanel","url":"https://openai.com/index/mixpanel-incident/"}],"summary":"OpenAI said a Mixpanel intrusion exposed limited identifying and analytics information for some API users and a limited group of ChatGPT users.","tools":["OpenAI API platform","ChatGPT","Mixpanel"],"outcome":"OpenAI removed Mixpanel, notified affected users, and expanded vendor reviews. It reported no compromise of chats, API keys, passwords, or payment details.","lesson":"Minimize analytics data and include third-party telemetry providers in security reviews and incident response.","kind":"incident","aiRole":"affected","status":"disclosed","sources":[{"label":"OpenAI incident disclosure and clarification","url":"https://openai.com/index/mixpanel-incident/","publishedAt":"2025-11-26","sourceType":"primary"}],"evidenceNote":"The breach occurred in Mixpanel's systems, not OpenAI's infrastructure. A December 19 clarification described the limited ChatGPT user impact."},{"id":"antigravity-browser-subagent-exfiltration","date":"2025-11-20","title":"Antigravity browser subagent leaked credentials in a researcher demonstration","parties":[{"name":"Google","url":"https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data"},{"name":"PromptArmor","url":"https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data"}],"summary":"PromptArmor showed that a poisoned integration guide could make Antigravity read local credentials and code, then transmit them through its browser subagent.","tools":["Google Antigravity","Gemini","Browser subagent"],"outcome":"The demonstration bypassed a file-reading restriction through terminal access. The cited disclosure does not establish a complete fix.","lesson":"Apply the same file and outbound-network restrictions to every tool and subagent.","kind":"vulnerability","aiRole":"affected","status":"disclosed","sources":[{"label":"PromptArmor technical demonstration","url":"https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data","publishedAt":"2025-11-20","sourceType":"primary"}],"evidenceNote":"Research demonstration under described settings, with browser tools enabled; not an observed victim breach. Date comes from the primary page's datePublished metadata."},{"id":"anthropic-claude-espionage","date":"2025-11-13","title":"Anthropic disrupts a Claude-assisted espionage campaign","parties":[{"name":"Anthropic","url":"https://www.anthropic.com/news/disrupting-AI-espionage"}],"summary":"Anthropic reported that a suspected Chinese state-sponsored group manipulated Claude Code to attempt intrusions into roughly 30 organizations, succeeding in a small number.","tools":["Claude Code","Model Context Protocol"],"outcome":"Anthropic banned identified accounts, notified affected entities where appropriate, and coordinated with authorities.","lesson":"Monitor agent tool use and enforce permissions independently of the model's interpretation of a task.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Anthropic incident report","url":"https://www.anthropic.com/news/disrupting-AI-espionage","publishedAt":"2025-11-13","sourceType":"primary"}],"evidenceNote":"Campaign activity was detected in September; November 13 is the public report date. Attribution, autonomy, and successful-intrusion claims rely on Anthropic's limited platform visibility."},{"id":"gemini-campaign-abuse-promptflux","date":"2025-11-05","title":"Google documents Gemini misuse for intrusion support and experimental malware","parties":[{"name":"Google Threat Intelligence Group","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"summary":"Google reported China-nexus operators seeking Gemini assistance with phishing and exploitation, alongside PROMPTFLUX experiments that requested malware code mutations.","tools":["Gemini","PROMPTFLUX"],"outcome":"Google disabled associated assets and strengthened safeguards; it described PROMPTFLUX as experimental and unable to compromise a victim device in its observed state.","lesson":"Monitor malicious workflows and account behavior, including repeated attempts to disguise offensive requests as research.","kind":"incident","aiRole":"used","status":"disclosed","sources":[{"label":"Google threat intelligence report","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools","publishedAt":"2025-11-05","sourceType":"primary"}],"evidenceNote":"Attribution and AI-use findings are Google's assessment. Experimental malware activity is not evidence of a successful PROMPTFLUX intrusion."},{"id":"opera-neon-hidden-html-injection","date":"2025-10-23","title":"Hidden webpage instructions exposed Opera Neon account data","parties":[{"name":"Opera","url":"https://blogs.opera.com/security/2025/10/prompt-injection-in-opera-neon-rapid-response-through-responsible-disclosure/"},{"name":"Brave","url":"https://brave.com/blog/prompt-injection-flaw-opera-neon/"}],"summary":"Researchers demonstrated hidden webpage instructions that redirected Opera Neon's AI assistant into collecting account information and sending it to an external endpoint.","tools":["Opera Neon"],"outcome":"Opera deployed a fix on October 20; researchers confirmed their proof of concept stopped working.","lesson":"Keep page content untrusted and require explicit approval before an agent sends private information.","kind":"vulnerability","aiRole":"affected","status":"resolved","sources":[{"label":"Opera security response","url":"https://blogs.opera.com/security/2025/10/prompt-injection-in-opera-neon-rapid-response-through-responsible-disclosure/","publishedAt":"2025-10-23","sourceType":"primary"},{"label":"Brave technical disclosure","url":"https://brave.com/blog/prompt-injection-flaw-opera-neon/","publishedAt":"2025-10-31","sourceType":"primary"}],"evidenceNote":"Controlled demonstration, not a reported malicious breach. Opera measured a 10% reproduction rate and required a particular page and user command."}]}