Security Desk · live log
AI Risk Radar
266 AI-security incidents logged since 1 Jan 2026
The emerging risks of frontier AI, logged as they are reported: prompt injection, jailbreaks, hijacked agents, poisoned and leaked models, deepfake fraud and the first vulnerabilities found by AI itself. What was hit, how serious it was, and whether it was seen in the wild, with the source on every record.
Showing 266 of 266 incidents
Overview
Incidents loggedSince 1 Jan 2026266Cumulative, Jan 2026 to date
Exploited in the wildStatus218% of 266 · the rest patched, contained, research or proof-of-concept
Critical severityDesk assessment60122 more rated high
PatchedFix shipped140126 in other recorded statuses
Most common typeAll timeInfra Vuln132 of 266 incidents
Days since lastLogged–Days between the last 13 incidents
Incidents · by attack type
Where they sit · lab to live
- In the wild21
- Proof-of-concept35
- Research50
- Patched140
- Contained20
Incidents · by month
Severity · all time
266total
- Critical
- 6022.6%
- High
- 12245.9%
- Medium
- 7528.2%
- Low
- 93.4%
- DroidMind tools can pass unvalidated commands to AndroidHigh
- llama.cpp fixes an overflow in RDMA server connectionsCritical
- An ai-sdlc tool could run injected shell commandsHigh
- An ATXP extension can turn tool input into commandsHigh
- Salesforce MCP tool flags can inject shell commandsHigh
- MLflow fixes unauthenticated requests to internal servicesMedium
- Microsoft links ARTEX-assisted attacks to Storm-0940High
- Unit 42 documents AI-assisted scripts in criminal operationsHigh
- LangGraph patches checkpoint namespace collisionsMedium
- LiteLLM withdraws a compromised package and container releaseHigh
- vLLM default browser policy allowed cross-origin accessLow
- Phi-4 audio input could crash a vLLM engineMedium
- vLLM image loading could reach a vulnerable GhostscriptHigh
- Invalid token IDs could crash a vLLM GPU workerMedium
- DeepSeek OCR image input could stop a vLLM engineMedium
- vLLM chat templates could block shared renderingMedium
- Forged vLLM shared-memory handles could execute codeHigh
- Firecrawl patches access to internal network servicesHigh
- Attacker probes Sekoia’s decoy Flowise agentLow
- Shared MCP server objects could mix clients’ messagesHigh
- MCP tool validation could exhaust server memoryHigh
- MCP HTTP servers accepted oversized bodies and batchesHigh
- OpenAI test agent spent another wallet’s test-network fundsMedium
- OpenAI evaluation model changed a dashboard’s internal settingsHigh
- OpenAI training model accessed a statistics site’s server secretsHigh
- OpenAI training model used an external browser to bypass restrictionsMedium
- Claude Desktop preview flaw could expose local filesHigh
- Visual Studio Copilot settings bypass enabled code executionHigh
- Docker MCP Gateway tool names could divert argumentsMedium
- LMCache distributed transport allowed unauthenticated code executionCritical
- EdgeEver preview content can execute scripts in the appHigh
- Anthropic tests model replication in an isolated device fleetHigh
- AI Content Generator plugin exposes WordPress administration settingsCritical
- BotSharp’s default signing key permits forged login tokensCritical
- JeecgBoot users can run other users’ prompt experimentsMedium
- JeecgBoot exposes MCP connection secrets to authenticated usersMedium
- Open Multi-Agent can create files outside its workspaceMedium
- Tabularis MCP can approve database writes as readsMedium
- OpenLIT can expose another project’s model tracesMedium
- 9router configuration injection can add a Hermes shell hookMedium
- Phi subagents can bypass the parent’s workspace restrictionsMedium
- InnoShop MCP uploads can disclose server filesMedium
- mini-swe-agent’s Bubblewrap sandbox inherits sensitive environment variablesMedium
- 1MCP tag filters can bypass OAuth tool restrictionsMedium
- Argo CD MCP application deletion can reach other resourcesMedium
- zotero-mcp webpage imports can reach internal servicesMedium
- GenOffice MCP uploads can be read by local usersMedium
- AI Puffer role settings can expose global indexing controlsLow
- AI Puffer role settings can expose semantic-search controlsLow
- Anthropic reports unintended external actions during model evaluationsMedium
- OpenAI research model tries deleting its task environmentMedium
- OpenAI reports research models bypassing request restrictionsMedium
- Hermes Agent fixes login-code theft through redirectsHigh
- Hermes Agent fixes disk exhaustion through login requestsMedium
- Hermes Agent fixes memory exhaustion before authenticationMedium
- OpenAI reports models bypassing web-request restrictionsMedium
- vLLM fixes a connector that could leak cached requestsHigh
- Docker MCP Gateway fixes crashes from hostile resource addressesMedium
- Ollama fixes model-file writes outside its storage directoryCritical
- Splunk fixes user-token leaks through custom MCP toolsMedium
- PoeLLM malware targets exposed AI servicesHigh
- AI Gateway session flaw allowed another user’s tool callsHigh
- Copilot CLI test leaks secrets through encrypted web contentHigh
- Progress fixes command injection in its GenAI generatorCritical
- AIWU plugin allows subscribers to gain higher privilegesCritical
- Jotform AI Chatbot plugin exposes a script-injection flawHigh
- AstronRPA gateway accepts unverified bearer tokensHigh
- Suna fixes an IPv6 bypass in outbound-request checksMedium
- Grafana k6 MCP tool exposes files outside its directoryMedium
- SGLang information responses expose API and admin keysLow
- NextChat proxy lets callers reach internal network addressesHigh
- LangChain MongoDB fixes access to other users’ chat historiesMedium
- IBM fixes critical code injection in Maximo AI ServiceCritical
- R2R completion requests can reach attacker-chosen addressesHigh
- Anyone could read and write Mooncake's memory over the networkCritical
- Mooncake's metadata server lets anyone redirect AI cache transfersCritical
- GitLab fixes AI gateway command executionCritical
- Mooncake fixes a handshake that crashes AI workersHigh
- MCP Fetch tool can request private network addressesHigh
- Mindio Magic MCP fixes subscriber access to sensitive dataMedium
- Airano MCP Bridge lets contributors make unauthorised changesMedium
- IBM patches 25 vulnerabilities in Langflow OSSCritical
- IATO MCP exposes changes to low-privilege WordPress usersMedium
- WDS MCP exposes content actions to low-privilege WordPress usersMedium
- MCP Python clients could forward credentials through redirectsMedium
- n8n patches 16 flaws that expose stored data and credentialsCritical
- pgvector flaw let database users run code on the serverHigh
- PowerPoint MCP tools can read and overwrite outside filesMedium
- Manus resolves credential exposure through an encoded emailHigh
- IBM fixes denial of service in Maximo AI ServiceHigh
- Claude Code could skip an organisation's managed security settingsLow
- AI agents probed US and Canadian government sites with SQL injectionHigh
- OpenAI ties hidden-reasoning extraction to people linked to Moonshot AIHigh
- Next.js fixes development data exposed to malicious websitesMedium
- MCP SDK fixes credentials sent to untrusted authentication serversHigh
- MCP Python servers could accumulate sessions until memory ran outHigh
- Ollama's agent mode ran extra shell commands after one approvalHigh
- Unpatched MetaMCP flaws expose other tenants' tools and the serverCritical
- Coding agents published thousands of internal screenshotsHigh
- Zscaler's MCP server let one approval token unlock other resourcesMedium
- GPT-6 Astra ran supply-chain attacks in 29% of AISI simulationsHigh
- Unpatched LiteLLM flaw lets one login take over admin accountsHigh
- Langflow fixes access to other users’ flowsMedium
- Langflow fixes requests reaching private network servicesMedium
- Langflow restricts unsandboxed Python in its REPL componentCritical
- vLLM fixes crashes after rejected media requestsMedium
- vLLM fixes cross-customer cache inference after tool callsLow
- Octop exposes stored provider keys to authenticated usersMedium
- vLLM fixes a crafted-audio crash in transcriptionMedium
- Obot's quickstart gave anyone on the network full admin accessCritical
- Network-AI fixes a bypass of denied tool targetsHigh
- Network-AI fixes unauthorised dashboard WebSocket accessMedium
- Open WebUI fixes access to disabled model providersMedium
- Graphify indexing could copy local files into agent dataHigh
- Six Flowise flaws let users reach other workspaces' chats, keys and accountsHigh
- OpenClaw let other chat members approve Claude Code actions meant for its ownerHigh
- Fake bots are posing as ChatGPT, Claude and Perplexity to hunt for passwordsMedium
- vLLM fixes five flaws, four that crash the serving engineMedium
- OpenClaw publishes 87 flaws in its AI agent gatewayHigh
- OpenAI training agent reached a public chatbot through DNSHigh
- OpenAI model leaked a researcher's GitHub token while cheatingHigh
- OpenAI found prompt injections that copy themselves like wormsMedium
- A web page could hijack an open-source hacking agent into running its commandsCritical
- A malicious MCP server could make the mcp-remote bridge request internal addressesCritical
- An OpenAI research agent broke into an Australian government Medicare statistics siteHigh
- Salesforce fixes Agentforce data leak through poisoned lead recordsHigh
- vLLM fixes excessive video loading in Qwen modelsMedium
- vLLM fixes video requests that exhaust CPU and memoryMedium
- vLLM validates media features in split inference deploymentsMedium
- vLLM fixes malformed requests that stop shared inferenceMedium
- vLLM fixes interference between document-scoring requestsMedium
- vLLM fixes shared-engine crashes in LMCache deploymentsMedium
- A Jira and Confluence MCP server let any network caller act as its operatorCritical
- SGLang's diffusion server runs code sent by anyone who can reach its portCritical
- Langflow fixes file leaks between projectsHigh
- Payload fixes access to other users’ MCP keysHigh
- Nine vLLM flaws let one request crash a server or corrupt other users' outputHigh
- IBM's payments software let anyone plant instructions in its AI agent's knowledge baseHigh
- Google's Gemini broke into three real companies during Irregular's safety testHigh
- vLLM prompt embeddings can crash shared inferenceMedium
- Injected tickets exposed credentials in an AgentCore demonstrationHigh
- A rejected request with max_tokens=0 exhausts decode-worker memory in disaggregated vLLMHigh
- Azure AI Foundry carried a CVSS 10 missing-authentication flaw, mitigated in the service before customers heard of itCritical
- Microsoft closed four Copilot command-injection flaws, one scored 9.9 for privilege escalationCritical
- Coding-agent plugins could bypass a pinned versionHigh
- vLLM requests crash hybrid Mamba2 deploymentsMedium
- Continue CLI command chains can bypass permission rulesHigh
- One malicious extension hijacked the built-in AI agents in five browsers, including Claude in Chrome and CometHigh
- PraisonAI's jobs API took any caller's YAML and let it pre-approve its own commandsCritical
- A forum exploit chained with an SSO flaw walked researchers into OpenAI internal codeCritical
- Four vLLM advisories in one day, each an unauthenticated request that stalls or bloats the serverMedium
- Claude Agent SDK resume input could execute commandsCritical
- Anthropic disrupts four operations that ran their attacks through AI agentsCritical
- Langflow fixes command execution through MCP settingsCritical
- Google's Agent Development Kit took a replayed test session straight to code executionCritical
- VS Code agent network filters bypassed by alternate URL and address representationsHigh
- Untrusted VS Code repositories could configure a remote agent host with local-file accessHigh
- DeepSeek Harness accepted a spoofed loopback Host header as proof a request was localCritical
- Roo-Code's auto-approve gate read a command one way while bash ran anotherHigh
- n8n patches a 17-CVE batch led by an expression-sandbox escape to backend code executionHigh
- Two Triton Inference Server flaws let unauthenticated callers exhaust compute or reach unguarded functionsHigh
- SQL Server's Copilot could be tricked into writing to databasesCritical
- ChatGPT sandbox metadata enabled cross-account data transferHigh
- Agno orchestration can execute attacker-supplied codeHigh
- Agno delegation can grant a member agent excessive privilegesMedium
- Astron Agent fixes root code execution through workflow nodesCritical
- IBM's MCP Gateway carried four separate holes, all fixed nowHigh
- Langflow's localhost-only MCP install check fell for a spoofed headerHigh
- AWS's own Postgres MCP server let read-only sessions write past their scopeHigh
- OGX’s MCP connector accepted unchecked destinations, exposing internal servicesHigh
- Postgres MCP Pro's restricted mode had a hole a FROM clause fits throughCritical
- OWL's document tool fetched whatever URL a prompt injection handed itHigh
- AgentScope copied any directory on the server into an agent's workspace if askedHigh
- Google's Agent Development Kit let an unauthenticated caller read files off the builder endpointHigh
- Goose recipe security scan misses executable extension and retry fieldsHigh
- Nous Research's Hermes Agent ran an attacker's command the moment it checked git statusHigh
- One negative token ID crashes the GPU behind vLLM's embeddings routes until a restartHigh
- Grafana’s MCP server accepted a session ID that looked valid but was never issuedCritical
- CISA puts a LiteLLM authentication bypass on the exploited list and gives agencies two weeksCritical
- A preprint shows a third-party agent skill can steer decisions while passing every scannerHigh
- LiteLLM let signed-in users send the proxy's API keys elsewhereMedium
- MaxKB fixes prompt-driven command execution and sandbox escapeCritical
- An agent’s own memory can grant it permissions its history never gaveHigh
- Hugging Face Transformers wrote remote code to disk before asking whether to trust itHigh
- Codex read PowerShell’s stop-parsing token differently to PowerShell, and approval was skippedHigh
- Eclipse Theia’s agent mode wrote wherever the model pointed itHigh
- MCPHub let any signed-in user rewrite the prompt templates served to everyone elseHigh
- Coder registry compromise exposes provisioning and AI-tool credentialsCritical
- An Argo CD MCP server listened on every interface and lent out the operator’s tokenCritical
- Hermes Agent shipped an MCP catalogue pinned to a branch instead of a commitCritical
- LangGraph SDK fixes action-level authorisation bypassHigh
- ESET finds malware carrying a fake nuclear-weapon request to derail AI analysisMedium
- ServiceNow patches two AI Platform flaws, both scored a flat tenCritical
- The Agno agent framework passed model output straight into exec()Critical
- GitLab Duo could be pointed at an attacker’s endpoint and hand over cloud model credentialsCritical
- A ToolUniverse sandbox let a caller walk from a literal to the subprocess moduleCritical
- Google’s langfun ran model output through exec() by defaultCritical
- A cyber-capable model escaped a virtual machine three times, chaining unknown bugsCritical
- OpenAI says its own agents reward-hacked their way onto Hugging Face production systemsCritical
- A web page walks Claude Code's Auto Mode into running an attacker's payloadHigh
- NemoClaw lets a visited web page poison the model template behind a developer's agentHigh
- A pair of critical escapes in OpenShell, the sandbox NVIDIA built to contain AI agentsCritical
- A crafted prompt slips past the human approval gate on Amazon's Strands agent toolkitCritical
- Chainlit's MCP endpoint took shell commands from anyone who could reach itCritical
- Four hundred AI-enabled malware samples, twelve of them on anyone's machineMedium
- An inference server ran every model's own Python, and offered no way to stop itHigh
- Poisoned monitoring data talks an AI site-reliability agent into deploying ransomwareHigh
- Unsloth patches code execution through model configurationHigh
- Encrypted instructions on a web page make Grok hand a reader's chat history to an attackerHigh
- Knowns fixes code execution from malicious project settingsHigh
- An unmonitored Anthropic agent deleted jobs inside a cluster holding sensitive resourcesHigh
- Z.ai holds back GLM-5.3's open weights after the model's exploit chaining outgrew its trainingHigh
- Dream documents a near-autonomous multi-agent framework used against Taiwanese government systemsHigh
- Resemble AI ties Grok to 87 per cent of the deepfake files behind documented fraud attacks in H1 2026High
- Langflow fixes weak protection for stored credentialsCritical
- Langflow fixes unauthenticated execution through webhook settingsCritical
- Langflow fixes code execution during Python validationHigh
- Encrypted chains of thought replay into weaker sibling models and come back readableHigh
- Kimi K3 escapes its sandbox and reads a UK AISI benchmark's answers off GitHubMedium
- OpenAI pauses internal work on Astra after it cannot rule out a Critical cyber capability thresholdCritical
- LangChain fixes Redis filters that could expose extra documentsLow
- Black Hat 2026: a single GitHub issue reaches CI secrets in Claude Code, Gemini CLI and CodexCritical
- Meta says its Muse Spark 1.1 model breached an outside company during a cyber testHigh
- Poison Claude resells Claude access through a proxy that reads every customer promptMedium
- AISI cyber-range agents took 19 unsanctioned actions on the live internetHigh
- ChainDrop npm worm plants a Claude Code startup hook to run before a developer types a promptCritical
- OpenAI models exploited a real website after a third-party CTF evaluation misconfigurationHigh
- Langflow fixes prompt-driven execution in Smart TransformHigh
- Anthropic revises its assessment after identifying a fourth unauthorised-access incidentHigh
- Flowise fixes prompt-driven leaks from CSV and Airtable agentsCritical
- Claude Mythos Preview breaks new ground in cryptanalysis: HAWK and reduced-round AESMedium
- Kimi K3 finds a Redis zero-day and writes a working exploitCritical
- Criminal turns a jailbroken Claude into a commercial offensive-security toolMedium
- AWS Kiro agentic IDE flaw let a poisoned web page rewrite its config and run codeHigh
- OpenAI models escape a sandbox and breach Hugging FaceCritical
- FBI warns of deepfake videos impersonating IC3 and FBI leadershipMedium
- Nginx UI MCP tools bypassed additional authenticationHigh
- Nginx UI configuration checks missed chained directivesHigh
- Nginx UI MCP add tool skipped configuration validationHigh
- Researcher back-doors an open-weight AI model for under $100Medium
- Bought search ads steered Mac users to weaponised shared Claude chats and a pasted Terminal commandHigh
- AG2 code executor can write outside its working directoryMedium
- Grok Build CLI uploaded entire developer repositories, secrets included, to a Google Cloud Storage bucketHigh
- CKAN MCP table could accept messages from other framesLow
- Workflow-level jailbreak makes GitHub Copilot write code it would otherwise refuseMedium
- HalluSquatting: attackers register the names AI assistants inventMedium
- Agent data injection corrupts the data AI agents trust, across major assistantsHigh
- DuneSlide: critical Cursor AI editor flaws allow OS-level code executionCritical
- PraisonAI fixes a prompt-injection blocking gapHigh
- PraisonAI fixes crawler access to private network addressesHigh
- PraisonAI fixes code injection during API deploymentCritical
- PraisonAI fixes unauthorised deletion of issue dependenciesMedium
- PraisonAI fixes forged messages reaching AgentMail agentsHigh
- PraisonAI AICoder fixes unrestricted file and command toolsCritical
- BioShocking technique tricks six AI browsers into stealing credentialsHigh
- SearchLeak: one-click Microsoft 365 Copilot flaw could exfiltrate emails and codesHigh
- AI vulnerability pipeline finds a SQL-injection flaw in a WordPress pluginHigh
- LiteLLM AI gateway flaw exploited in the wild for unauthenticated RCECritical
- Google says criminals used an AI-built zero-day in a planned mass-hack campaignHigh
- FAR.AI finds DeepSeek V4 Pro's safeguards collapse under three simple jailbreaksHigh
- Google Antigravity IDE prompt-injection flaw enabled code executionHigh
- OpenAI patches ChatGPT data-exfiltration flaw and Codex token vulnerabilityHigh
- Popular LiteLLM PyPI package backdoored in a supply-chain attackHigh
- PerplexedBrowser: Perplexity Comet agent leaks local files via calendar-invite injectionHigh
- Group-IB documents a maturing market for AI-enabled fraud and deepfakesMedium
- Google Gemini tricked into leaking private meeting data via poisoned calendar invitesHigh
No incidents match those filters.
Each row opens the incident's own record page, with the detail and the sources. Download the data: CSV ·JSON ·RSS · CC BY 4.0 with attribution to YFarmX.
Severity is the Security Desk's assessment at the time of logging, from public reporting. Attribution claims are reported as claims, not findings.Last update · 28 Oct 2026