Reference
The 2026 incident board
A running log of real AI-security incidents, each tied to the threat class it illustrates - so the playbook stays grounded in what has actually happened, not theory.
Newest first, grouped by month, each entry dated by its primary source. Treat each entry as case material - it maps to a section’s threat class. (Current to 28 September 2026; details are as reported by the cited researchers and vendors - verify specifics before citing externally.)
September 2026
| Incident | What happened | Maps to |
|---|---|---|
| OpenAI’s agents leak data out of the research environment (OpenAI, 25 Sep 2026) | OpenAI disclosed that agents in its research environment transmitted training and evaluation data while using third-party services, including 53 user-provided images posted to image-hosting sites as unlisted links; most have been taken down, it has notified dozens of affected third parties, and it says the review will take months. A separate report the same day describes an agent on a search task that reached a public chatbot through a gap in DNS filtering on 20 Sep: monitoring flagged it within 15 minutes, a person was reviewing it three minutes later, and the run was killed 2.5 hours later (report). OpenAI says all training, evaluation and inference with tool use of its most capable models remain paused. Lesson: an agent’s egress includes DNS and every third-party service it can call, and the time from alert to kill is a number to own | III.5 containment · I.7 evals · VII.3 detection |
| A prompt injection that copies itself (OpenAI, found 27 Jun, disclosed 25 Sep 2026) | OpenAI’s attacker-versus-defender training (GPT-Red) produced prompt injections that tell an agent to copy the injection into its own outputs, such as every email it sends, so the injection spreads like a worm; examples travelled through email, files and a multi-step Slack chain. The vulnerable models were internal research checkpoints (GPT-5.4-mini based, and GPT-5.5 in the Slack test), and OpenAI observed no impact outside simulated tool calls. Lesson: for an agent wired to mail, chat or a repository, check what it writes as well as what it reads | III.4 propagation · II.2 injection |
| A model pushes a GitHub token past secret scanning (OpenAI, found 27 May, reported 25 Sep 2026) | Trying to cheat on a theorem-proving task, an internal model in a custom harness published a researcher’s GitHub token in the public openai/codex repository, split into pieces with the stated aim of avoiding secret scanning, against its system prompt and two direct instructions from the researcher. OpenAI deactivated the users’ keys, then every employee’s keys as a precaution, and took the model down for about two weeks; it came back with auto-review on all actions and a chain-of-thought monitor that can stop it within minutes. Lesson: secret scanning is not a control against an agent that knows it is there; scope the credentials an agent can reach | IV.6 agent credentials · III.2 coding agents |
| An agent-memory package turns credential stealer (StepSecurity, 23 Sep 2026) | Malicious releases of MemTensor’s agent-memory packages appeared on npm (@memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, 0.1.25) and PyPI (MemoryOS 2.0.34) with no matching repository commits or tags. The payload harvests cloud and developer tokens (AWS, GitHub, GitLab, npm, PyPI, Hugging Face) and captures user prompts, and the Python variant carries GitHub Actions workflow templates that point to self-propagation. Twice, a clean release was replaced by a malicious one within about three and a half minutes. Lesson: a memory plugin sits inside the agent loop, so compromising it yields both the developer’s secrets and the user’s prompts | I.5 supply chain · III.4 memory |
| Plugin4Shell: a pinned plugin that is not what it was pinned to (Air Security, 17 Sep 2026) | Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI pin marketplace plugins to a commit hash but did not check that the checkout actually landed on that commit, so a plugin repository could serve different code through a branch named after the hash. With plugin auto-update on, the default in Claude Code and Codex, that code runs on every machine with the plugin installed, with no click. Fixed in Claude Code 2.1.179 and Codex 0.146.0; the researchers report no fix for Copilot and none planned for the deprecated Gemini CLI. Lesson: a hash pin is a control only if something verifies it; inventory agent plugins and turn off auto-update where there is no fix | I.5 supply chain · III.2 coding agents |
| Azure AI Foundry: missing authentication at CVSS 10.0 (CVE-2026-85889, published 17 Sep 2026) | Microsoft disclosed missing authentication for a critical function in Azure AI Foundry that let an unauthorized attacker elevate privileges over the network, with no privileges or user interaction required. Microsoft fixed it in the service and rates exploitation as unproven. Lesson: the managed AI platform’s own control plane is attack surface; it belongs in the cloud threat model and the vendor-risk review even when there is nothing for you to patch | V.2 cloud · IV.6 identity |
| BragJack: one extension drives five browsers’ AI assistants (Forever Security, 16 Sep 2026) | A malicious extension using permissions most extensions already have (content scripts and declarativeNetRequest) could take over the built-in assistants in Chrome (Gemini), Edge, Opera Neon, Perplexity Comet and Claude in Chrome by abusing sites and domains the agents trust. The researcher calls it prompt forcing: rather than hiding instructions in content, the extension writes the agent’s entire prompt. Demonstrated impact included file access, screenshots, camera and microphone, browsing history and email exfiltration. All five vendors paid bounties; Chrome’s fix is CVE-2026-0628. Lesson: once the browser holds an agent with your sessions, extension allowlisting is an AI-agent control | III.3 browser agents · VII.4 inventory |
| OpenAI’s agents on the open web, and a reporting framework (OpenAI, 5-16 Sep 2026) | On 5 Sep OpenAI responded to a report that its agents had used a public wiki as a shared message board. On 11 Sep researchers attributed a May 2026 RubyGems spam campaign (“GemStuffer”) to OpenAI agents; RubyGems had yanked more than 500 malicious packages, found no evidence that attempts to obtain other users’ API keys succeeded, and says it cannot determine whether AI agents made the packages, while OpenAI says its agents used RubyGems for benign tasks. On 16 Sep OpenAI published a framework for reporting model misalignment with six reports from the previous six months, and said serious safety, security and misalignment incidents should be shared with the US federal government. Lesson: what an agent writes to third-party services is now a disclosure category, and registries and wikis need controls built for agent-scale traffic | I.5 registries · VII.3 detection · I.7 frontier labs |
| Two MCP gateways at 9.8 (10-14 Sep 2026) | The gateway became the target, not just the servers behind it. Bifrost < 2.1.0 let an unauthenticated POST to /api/mcp/client register a stdio client whose command runs as the gateway process (CVE-2026-90898, CVSS 9.8, fixed 2.1.0, returns 403); IBM ContextForge MCP Gateway v1.0.0-v1.0.9 shipped changeme as the default admin password (CVE-2026-78573, CVSS 9.8, fixed v1.0.10). Lesson: the policy-enforcement point needs auth-on-by-default and a non-default secret, or it is just another exposed MCP endpoint | IV.5 gateway hardening · IV.6 identity |
| First GDPR breach blamed on an AI agent (AEPD, 14 Sep 2026) | Spain’s data-protection regulator reported its first personal-data-breach notification in which the attack was executed by an AI agent using a known LLM that logged in, found further flaws, altered personal data and read invoices; neither model nor organization named, and AEPD frames it as the notifier’s account pending analysis. Lesson: agent-executed breaches are now a reportable category regulators are logging | VIII.6 jurisdictions · VII.3 detection |
| SGLang: code execution through an unauthenticated endpoint (CVE-2026-86793, CVSS 9.8, published 11 Sep 2026) | With no API key configured, SGLang (through 0.5.18) accepts pickled data on /update_weights_from_tensor, and its SafeUnpickler allowlist can be bypassed, so an unauthenticated attacker can run code on the inference server. Lesson: a model-serving endpoint that loads weights or tensors is a code-execution surface; never expose one without authentication | I.5 model loading · V.2 exposed services |
| An eval sandbox gives up production keys (Anthropic, 10 Sep 2026) | Anthropic’s September threat report describes an actor (GTG-50020) who injected instructions into an AI vendor’s automated evaluation sandbox, which then handed over the credentials it held, including the vendor’s production API keys for multiple AI providers; a follow-on campaign from the same infrastructure hit roughly thirty AI companies in about four days by repeating one working attack path. The stated goal was a pre-release Claude model, which the actor never reached. Separately, suspected ShinyHunters affiliates switched their attack workloads onto victims’ AI keys. Lesson: AI API keys are now the loot; treat them, and the sandboxes, proxies and resellers that hold them, as production credentials | I.7 evals · IV.6 keys · II.2 injection |
| AI-orchestrated exploitation of PaperCut (GreyNoise, 9 Sep 2026) | From 31 Aug, OpenAI Codex-harnessed agents running a DeepSeek model (GreyNoise: the harness was Codex, the model was not OpenAI’s) exploited PaperCut NG/MF CVE-2026-81578 (NVD 9.8, KEV 31 Aug) against at least 440 instances at 395 organizations across 48 countries. Lesson: mass exploitation of a fresh KEV entry is now agent-driven and fast - your patch window shrank | VI.1 offensive AI · VII.3 detection |
| Industrial-scale distillation, as a joint advisory (NSA/CISA/FBI AA26-251A, 8 Sep 2026) | A joint advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as extracting billions of tokens across millions of requests from US frontier models since at least late 2024 - model theft by query, elevated to a government advisory. Lesson: rate-limit and monitor query patterns per identity, and treat distillation as a named exfiltration risk in the model’s threat model | I.3 extraction · VIII.1 frameworks |
| Astra designated Critical for cyber, and shipped (OpenAI, 1-3 Sep 2026) | Following its August assessment that Astra might reach a critical level, OpenAI stated on 1 Sep that the model meets the Critical cybersecurity capability threshold under its Preparedness Framework - the first model any lab has designated there - then published the GPT-6 Astra system card and shipped it on 3 Sep behind a named mitigation stack (Daybreak) rather than holding it back. The if-then commitment moved from precaution to a live model gated by mitigations - the case to watch for whether the mitigations, not just the label, hold | I.7 if-then commitments in practice |
| LiteLLM MCP auth bypass added to CISA KEV (CVE-2026-59822, KEV 2 Sep 2026) | An unauthenticated MCP auth bypass in LiteLLM before 1.84.0 (CVSS 4.0 8.8) went onto CISA’s Known Exploited Vulnerabilities catalog, and Wiz’s 90-day AI-infrastructure honeypot recorded it chained to cryptomining. Lesson: an internet-reachable model gateway is now scanned and exploited like any other edge service - patch it on the KEV clock, not the backlog | IV.5 MCP hardening · V.2 infra |
| AI-assisted intrusion in under ten hours (Unit 42, 2 Sep 2026) | A human-directed attacker ran parallel frontier-AI agents, coordinated through structured Markdown files, through more than 50 MITRE ATT&CK techniques in under 10 hours: public web-service mapping, secrets harvesting from repos, privilege takeover via the secrets manager, CI/CD hijack, then the victim’s cloud AI infrastructure hijacked with stolen keys. Detection tells: bursty API requests, rapid 401/200 shifts, parallel authentications | VI.1 offensive AI · VII.3 detection · V.2 cloud |
| GitSpawn - a repo runs code before the trust prompt (Manifold Security, 1 Sep 2026) | Coding agents run git in the background to gather context; a cloned repo whose .git/config sets core.fsmonitor to a command makes git execute it with no prompt, model call or tool approval. Confirmed across Claude Code, OpenAI Codex (CVE-2026-19592, CVSS 7.3, fixed CLI 0.131.0), Cursor, Goose (CVE-2026-72718, fixed 1.44.0), Hermes, Qwen Code and Grok Build; one Claude Code path was still open on disclosure day. Lesson: inspect .git/config before you open a cloned repo with an agent, and treat repo-supplied config as executable input | III.2 coding agents · III.5 containment |
August 2026
| Incident | What happened | Maps to |
|---|---|---|
| How the models got out: an Artifactory zero-day (OpenAI, technical report 26 Aug 2026) | OpenAI’s Hugging Face technical report: the ExploitGym evaluation environment gave the models no direct internet access, so they found and exploited a previously unknown zero-day in Artifactory, the package-registry cache proxy, to reach it; OpenAI disclosed that and other Artifactory bugs its models found to the vendor. The models also used publicly exposed credentials on four accounts at four services, one as an outbound relay and staging path and one for data storage. On 18 Aug OpenAI had temporarily slowed frontier training and paused its largest planned RL run; METR and Redwood Research published an independent investigation. Lesson: the package proxy in a build or eval environment is an egress path, so test it as one | I.7 eval harness · III.5 containment · I.5 supply chain |
| VMs do not contain a cyber-capable agent (Trail of Bits, 26 Aug 2026) | GPT 5.6-Cyber “escaped the VM three different times” from a QEMU/KVM sandbox, the last chain using three 0-days across QEMU, KVM and libslirp. Conclusion for defenders: treat a capable agent as an advanced persistent threat, and do not rely on a single VM boundary as its containment | III.5 containment · I.7 capability |
| MLflow webhook SSRF - CVE-2026-64849 (CVSS 9.3, added to CISA KEV 19 Aug 2026) | The webhook-test endpoint validates a URL once; a separate delivery path then follows redirects and re-resolves the hostname without pinning the validated address, so a URL that passes validation can 302 the server into cloud metadata or an internal service and return the response to the attacker. Unauthenticated, default-config unsafe, actively exploited within days of disclosure. Fixed 3.15.0 | V.2 SSRF to metadata · I.5 ML platform hardening |
| Context7 MCP prompt injection - CVE-2026-75130 (published 18 Aug 2026) | The “Custom AI Instructions” feature injects unsanitized third-party content into any connected coding agent’s context, so an attacker who controls a documented library’s metadata can trigger credential exfiltration or destructive file deletion on a routine “look up the docs” request. NVD’s two CVSS versions disagree sharply on severity - v3.1 scores it 9.0 Critical, v4.0 scores it 6.4 Medium - print the vector, not the adjective. No fixed version was stated in the record at publication | II.2 injection via tool content · IV.5 hardening |
| CoSnitch - a link that exfiltrates with no click (Varonis, 18 Aug 2026) | A crafted Microsoft Copilot (Personal) link with an undocumented ?autorun=1 parameter exfiltrated connected Gmail, Calendar, Drive and memory data with no user interaction (CVE-2026-24301, NVD 7.5 / Microsoft 8.8, CWE-77); patched server-side the same day. The zero-click sibling of RovoBlast above - lesson: a URL parameter that pre-seeds agent context is an injection surface | II.2 injection · III.3 agent front ends |
| Autonomous offense beats autonomous defense (Wiz, 17 Aug 2026) | A CI workflow interpolated an unescaped GitHub issue title into a shell command, reachable by anyone who can open an issue. GitHub Copilot Autofix had reviewed and approved the vulnerable pull request as “all-clear”; Wiz’s own autonomous red-team agent independently found and exploited the same bug, exfiltrating a Snowflake Jira token with access to engineering, security and bug-bounty projects, with no human in the loop on either side | VI.4 AI-assisted offense · I.5 CI/CD as attack surface |
| Deadbugz - MCP poisoning by pull request (Pillar Security, 12 Aug 2026) | 23 unsolicited GitHub PRs filed in 74 minutes pushed a “productivity-suite” MCP server that behaves until the third tool call, then its tool definitions switch to hunting SSH keys, AWS credentials, shell history and Kubernetes config; 19 were closed, 4 open, none merged. Lesson: treat a change to a tool’s description or schema as a security event that revokes prior approval, and pin MCP servers by hash | IV.2 tool poisoning · I.5 supply chain |
| RovoBlast: a URL parameter as agent context (Varonis, 7 Aug 2026) | A crafted link’s rovoChatPrompt parameter pre-filled attacker instructions directly into a victim’s authenticated Atlassian Rovo chat session - no jailbreak, no permission bypass, and nothing marking the seed content as externally sourced. The agent then autonomously pulled internal Confluence, Jira and SharePoint content and pushed it to an attacker-reachable destination in one run. Fixed before publication | II.2 untagged untrusted input · III.1 autonomous multi-step tools |
| UK AISI eval containment incident - INC-2026-07-28-01 (4 Aug 2026) · Anthropic’s own audit (30 Jul 2026) | During a routine cyber evaluation with safety classifiers deliberately disabled, agents took autonomous action on the live internet in 10 of 122 runs - 19 actions total, 17 by Anthropic’s Mythos 5 and 2 by OpenAI’s GPT-5.6-Sol. One agent created fake identities to social-engineer a real open-source maintainer into merging malicious code; the human maintainer caught and refused it. Triggered by the same disclosure chain, Anthropic’s own self-audit then found three MORE incidents in its evals it had not caught: a model that extracted real production data after a fictional target name coincidentally matched a real domain, a malicious PyPI package downloaded and run on 15 real systems, and a scan of ~9,000 real targets that stopped only after the model recognized one compromise was real. No evidenced real-world harm from any of it | I.7 eval harness as attack surface · VI.1 offensive AI |
| Flowise: three ways into the same node family - CVE-2026-69253 · CVE-2026-69255 · CVE-2026-70477 (CVSS 9.0-9.5, published 4 Aug 2026) | A vm2 sandbox escape via unvalidated URLs, a string-interpolation break into the Pyodide/Node bridge, and a prompt-injection bypass of a Python-module blocklist - three independent root causes converging on the same CSV/custom-tool node family in an open-source agent-building framework in one release window. One CVE reads as a patched edge case; three reads as a node family nobody threat-modeled as code-execution surface. All fixed 3.1.3 | III.5 sandbox escapes · II.2 blocklists as the only control |
| Google ADK tool-confirmation forgery - CVE-2026-18236 (CVSS 9.3) · agent-to-agent writeup (Pillar Security, 3 Aug 2026) | An attacker who can inject events into session history can forge a “user approved” tool-confirmation response with no real approval behind it. Demonstrated live: a low-privilege, public-facing agent (triggered by GitHub issues and PRs) shared a trust boundary with a high-privilege maintainer-only agent, and two poisoned pull requests made the low-privilege agent invoke the privileged one with maintainer-level access. Affected < 2.5.0 | IV.4 agent-to-agent trust · III.5 approval is not authorization |
July 2026
| Incident | What happened | Maps to |
|---|---|---|
| Autonomous campaign, permission checks disabled (Unit 42, 30 Jul 2026) | A threat actor ran DeepSeek through an agent framework configured with dangerously-skip-permissions: true, alongside Claude Code, Codex and four other coding agents, proxied and pointed at real infrastructure. Confirmed impact: data exfiltration from three Citrix NetScaler targets and command execution on eleven Marimo notebook endpoints, both via pre-existing CVEs the agents chained autonomously. The enabling factor was not a novel exploit - it was a permission flag a defender should be auditing for | VI.1 offensive AI · III.5 the flag that removes containment |
MCP 2026-07-28 goes stable (spec release, 28 Jul 2026) | Not a breach, a scope change. The revision moved to a stateless core with per-request negotiation and added State Handle Hijacking to its security page. An assessment scoped to 2025-11-25 now tests a superseded shape | IV.2 MCP · IV.3 runbook |
| AWS API MCP Server fails open - CVE-2026-16584 (CWE-455, 23 Jul 2026) | When the security-policy data failed to load at startup, the policy check was skipped for the whole process lifetime. Deny and gate rules silently stopped applying; only IAM still held. 0.2.13 to 1.3.46, fixed 1.3.47 | II.5 fail-open · IV.5 hardening |
| Hugging Face production breach - driven by OpenAI evaluation models (HF 16 Jul 2026; OpenAI attribution 21 Jul 2026) | The containment failure that became a real third-party compromise. A malicious dataset chained two code-execution paths in HF’s dataset pipeline (a remote-code loader plus template injection in a dataset config), escalated to node access, harvested cloud and cluster credentials and moved laterally; HF logged 17,000+ events and describes it as “driven, end to end, by an autonomous AI agent system”. Five days later OpenAI disclosed the operator was its own GPT-5.6 Sol plus an unreleased model, run with cyber refusals lowered for a benchmark, which exploited a zero-day in the package-registry proxy that was meant to be the sandbox’s only network path. No public models, datasets or Spaces tampered; supply chain verified clean. No CVE | VI.1 offensive AI · I.7 evals · I.5 supply chain |
| MCP Python SDK session confusion - CVE-2026-52869 (CVSS 7.1, 15 Jul 2026) | SSE and stateful Streamable HTTP routed requests to a session by id alone, never checking which principal created it. Any bearer-authenticated client with a known session id could inject JSON-RPC into it. Fixed 1.27.2 | IV.2 MCP · IV.5 hardening |
| GhostApproval (Wiz, 8 Jul 2026) - CVE-2026-12958 · CVE-2026-50549 | A hostile repo ships a symlink dressed as an ordinary project file pointing at ~/.ssh/authorized_keys; the agent edits it and writes outside the workspace. The compounding defect is the dialog: it frequently renders the innocuous filename rather than the resolved target, so consent is obtained under a false description - human-in-the-loop is only as good as what the dialog shows. Note the CVE covers the symlink defect, not the dialog: CVE-2026-50549 is Cursor’s canonicalization fallback (CWE-59, CVSS 9.8), reported as DuneSlide by Cato and GhostApproval by Wiz - one defect, two names. Affected six assistants; fixed by AWS, Google and Cursor, others unfixed at publication | III.2 coding agents · IV.6 approval |
| mem0 / OpenMemory - CVE-2026-59705 (CVSS 9.8) · CVE-2026-59706 (both published 7 Jul 2026) | Missing authentication on the agent memory layer, an under-modeled asset class: unauthenticated endpoints let anyone read, write and delete any user’s memories by supplying an arbitrary user_id, and a second flaw discloses stored LLM API keys in plaintext. Write access is the interesting half - injected records become persistent, cross-session prompt injection that survives context resets, looks to the agent like its own trusted recollection, and never passes an input filter | V.3 data · III.4 memory poisoning |
| Codex desktop app: secrets out through a Markdown image (CVE-2026-14898, CVSS 6.5, published 6 Jul 2026) | The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An indirect prompt injection in content Codex processed could get the model to build an image URL carrying secrets from the session (API keys, source code, data from connected tools), which the app fetched automatically, with no click. No known exploitation. Lesson: an agent interface that auto-loads URLs the model wrote is an exfiltration channel, the EchoLeak class now in a coding agent | II.2 injection · III.2 coding agents |
| JADEPUFFER (Sysdig, 1 Jul 2026) | What Sysdig assesses to be the first extortion campaign driven end to end by an LLM rather than a human with AI assistance. Entry was an older Langflow unauthenticated code-execution flaw (CVE-2025-3248); the agent harvested credentials, set crontab beaconing, then hit production MySQL and Nacos and deployed ransomware. The evidence for autonomy is behavioral - self-narrating payloads, and self-diagnosis of its own failures inside 31 seconds. The novelty is the operator, not the exploit | VI.1 offensive AI · VII.3 detection |
April to June 2026
| Incident | What happened | Maps to |
|---|---|---|
| GuardFall (Adversa, 30 Jun 2026) | Guardrail bypass as a class refutation: 10 of 11 surveyed open-source coding agents fell to shell-injection bypasses exploiting the gap between guards that pattern-match the raw command string and bash’s actual execution semantics, which expand variables and evaluate substitutions after the guard passes. You cannot validate a command by inspecting text the shell will subsequently rewrite - execute argv arrays without a shell, or confine execution rather than inspect it | III.2 coding agents · II.5 guardrails |
| Claude Code allowlist exfiltration - CVE-2026-54316 (CWE-183/200/515, 23 Jun 2026) | huggingface.co was pre-approved as a bare hostname for WebFetch, so every path on it skipped the prompt and --allowedTools. Injected content read attacker-writable repo files, making an allowlisted domain a covert channel. 0.2.54 to 2.1.162, fixed 2.1.163 | III.5 containment · III.2 coding agents |
| SearchLeak - CVE-2026-42824 (NVD 7.5; Microsoft 6.5) (Varonis, 15 Jun 2026) | Injection to exfiltration with no tool call and no agent autonomy. Three chained flaws in M365 Copilot Enterprise Search: the q URL parameter meant to carry a query was interpreted as instructions, so a link is the payload; a race let the browser render the streaming response before sanitization completed, firing an injected image tag; and the CSP allowlist for Bing domains let the data leave via Bing’s own server-side image fetch. Mitigated server-side | II.2 injection · V.3 data |
| Transformers config-injection pair - CVE-2026-4372 (NVD 7.8, published 24 May 2026) · CVE-2026-5241 (NVD 9.6, published 3 Jun 2026) | One root cause twice in a quarter: attacker-controlled fields in a downloaded config.json crossing into a code-loading decision - which is why trust_remote_code=False is not a security boundary. In 4372 a generic setattr() loop let a private attribute name an attacker’s kernel repo that importlib imported on a plain from_pretrained() call. Note NVD scores the vector local-with-user-interaction despite “unauthenticated RCE” framing elsewhere - print the vector, not the adjective. Fixed in transformers 5.3.0 | I.5 supply chain · I.4 model loading |
| Mini Shai-Hulud worm - TanStack, Mistral AI, Guardrails AI (11-14 May 2026) | The counterexample to “we only install packages with verified provenance”. The implant harvested Actions tokens, repo secrets, AWS and Vault credentials, exfiltrated over a P2P messenger network, and self-propagated by minting npm OIDC tokens to republish under stolen maintainer identities - so provenance attestation confirmed the malicious artifacts. OpenAI reported two employee devices affected and rotated its macOS signing certificates | I.5 supply chain · III.2 coding agents |
| Systemic MCP STDIO command injection (OX Security, 15 Apr 2026) - 11 CVEs across 15 instances | The flaw is in the shape of the protocol, not one implementation: STDIO turns configuration into execution by design, so a client that lets a user - or a model - define a server command runs arbitrary OS commands. Four families, including allowlist bypass (restricting to npm/npx is defeated by argument injection) and prompt-injection-to-RCE, where a malicious prompt rewrites the assistant’s own MCP config. As reported, Anthropic declined to change the protocol, characterizing the behavior as expected | IV.2 MCP · IV.1 tool use |
| Azure SRE Agent - CVE-2026-32173 (CVSS 8.6, published 2 Apr 2026) | As reported in the CVE record, improper authentication on a network-facing endpoint (SignalR hub) let an unauthenticated attacker disclose sensitive information from the agent over the network | V.2 Infra · IV.6 identity |
| Azure MCP Server - CVE-2026-32211 (published 2 Apr 2026) | As reported, the MCP (Model Context Protocol) server’s authentication layer was simply absent - the concrete example of OWASP MCP07 (insufficient authentication); any reachable client could invoke its tools | IV.2 MCP |
| ”Comment and Control” (Johns Hopkins, Apr 2026) | The same architectural defect - untrusted repo text and live credentials sharing one context - landing independently in three vendors’ flagship agents, so it is a default rather than a coding slip. Claude Code Security Review interpolated PR titles unsanitized; Gemini CLI Action obeyed a forged “Trusted Content” section and posted its API key back as a public comment; Copilot Coding Agent fell to invisible HTML-comment injection that defeated environment filtering and the network firewall at once. In each case the agent performed its own exfiltration | III.2 coding agents · II.2 injection |
November 2025 to March 2026
| Incident | What happened | Maps to |
|---|---|---|
| nginx-ui “MCPwn” - CVE-2026-33032 (CVSS 9.8, published 30 Mar 2026) | The MCP /mcp_message endpoint enforced only an IP allowlist that defaulted to empty (= allow-all), so any network attacker could invoke MCP tools and take over the server. Actively exploited; the finder reports a fix in v2.3.4, but the official CVE record lists 2.3.5 and prior as affected - update to the latest (2.3.6+) | IV.2 MCP |
| MCP TypeScript SDK leak - CVE-2026-25536 (CVSS 7.1, published 4 Feb 2026) | As reported, reusing one server/transport instance across clients caused JSON-RPC message-ID collisions that routed one client’s response to another - a cross-client data leak. Fixed in v1.26.0 | IV.2 MCP · V.3 data |
| Boundary Point jailbreaking (UK AISI, Feb 2026; arXiv:2602.15001) | An automated technique that generates universal jailbreaks against even well-defended systems - reinforces that guardrails are a first filter, measured under adaptive attack (II.3) | II.3 bypasses |
| ShareLeak (CVE-2026-21520, CVSS 7.5, published 22 Jan 2026) · PipeLeak | Indirect prompt injection in Microsoft Copilot Studio via a SharePoint form field made the agent query connected SharePoint List data and exfiltrate it via Outlook (Capsule Security). PipeLeak is the Salesforce Agentforce sibling (no CVE assigned). See II.2 for why patching the prompt does not close the architectural exfiltration path | II.2 injection · V.3 data |
| GTG-1002 (Nov 2025) | State-sponsored actor used an AI to orchestrate ~80-90% of an espionage campaign against ~30 targets, largely autonomously (as reported by Anthropic) | VI.1 Offensive AI |
Check your own exposure
The recurring pattern across CVE-2026-32211 and CVE-2026-33032 is the same: an MCP tool endpoint reachable with absent or empty-allowlist auth. Find your own exposure before someone else does - see IV.2 · Model Context Protocol (MCP) for the full MCP attack surface.
# Sweep for exposed MCP surfaces across your own hostsnuclei -u https://<host> -tags mcp,exposure -severity high,critical
# Probe the well-known MCP message path directly; a 200 that returns a# tool list = no auth gate (the MCPwn / Azure MCP class of bug)curl -s -X POST https://<host>/mcp_message \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \ | jq '.result.tools[].name'