YFarmX logoYFarmXIntelligence for an accelerating worldBriefings
YFarmX logoYFarmX
YFarmX
Security Desk · live log

AI Risk Radar

224 AI-security incidents logged since 1 Jan 2026

The emerging risks of frontier AI, logged as they are reported: prompt injection, jailbreaks, hijacked agents, poisoned and leaked models, deepfake fraud and the first vulnerabilities found by AI itself. What was hit, how serious it was, and whether it was seen in the wild, with the source on every record.

Log updated 13 Oct 2026 · 224 incidents · 10 months tracked

Showing 224 of 224 incidents

Overview
Incidents loggedSince 1 Jan 2026224Cumulative, Jan 2026 to date
Exploited in the wildStatus188% of 224 · the rest patched, contained, research or proof-of-concept
Critical severityDesk assessment5796 more rated high
PatchedFix shipped109115 in other recorded statuses
Most common typeAll timeInfra Vuln100 of 224 incidents
Days since lastLogged–Days between the last 13 incidents

Incidents · by attack type

  1. Infra Vuln10044.6%
  2. Agent Hijack4319.2%
  3. Prompt Injection2912.9%
  4. Data Leak156.7%
  5. Poisoning125.4%
  6. AI-Found Vuln83.6%
  7. Deepfake/Fraud62.7%
  8. Jailbreak52.2%
  9. Model Behaviour41.8%
  10. Agent Misuse10.4%
  11. Supply Chain10.4%

Where they sit · lab to live

  • In the wild18
  • Proof-of-concept32
  • Research46
  • Patched109
  • Contained19

Incidents · by month

Severity · all time

224total
Critical
5725.4%
High
9642.9%
Medium
6529.0%
Low
62.7%
  1. Anthropic tests model replication in an isolated device fleetAgent MisuseResearchIsolated emulated Android test fleetHigh
  2. EdgeEver preview content can execute scripts in the appInfra VulnResearchEdgeEver 1.6.0 through 1.112.0CVE-2026-109558High
  3. AI Content Generator plugin exposes WordPress administration settingsInfra VulnResearchAI Content Generator Marketing through 1.0.0CVE-2026-85118Critical
  4. BotSharp’s default signing key permits forged login tokensInfra VulnResearchBotSharp through 5.2.0CVE-2026-108860Critical
  5. AI Puffer role settings can expose semantic-search controlsInfra VulnResearchAI Puffer through 2.4.89CVE-2026-104742Low
  6. AI Puffer role settings can expose global indexing controlsInfra VulnResearchAI Puffer through 2.4.89CVE-2026-104741Low
  7. GenOffice MCP uploads can be read by local usersInfra VulnResearchGenOffice through 0.11.505 on affected shared POSIX hostsCVE-2026-108582Medium
  8. zotero-mcp webpage imports can reach internal servicesInfra VulnResearchzotero-mcp 0.10.0 through 0.14.1CVE-2026-108583Medium
  9. Argo CD MCP application deletion can reach other resourcesInfra VulnResearchargocd-mcp through 0.9.0CVE-2026-108585Medium
  10. 1MCP tag filters can bypass OAuth tool restrictionsInfra VulnResearch1MCP Agent 0.20.0 through 0.39.0CVE-2026-108586Medium
  11. mini-swe-agent’s Bubblewrap sandbox inherits sensitive environment variablesInfra VulnResearchmini-swe-agent 1.10.0 through 2.4.6, optional Bubblewrap backendCVE-2026-108592Medium
  12. InnoShop MCP uploads can disclose server filesInfra VulnResearchInnoShop 0.9.2CVE-2026-108591Medium
  13. Phi subagents can bypass the parent’s workspace restrictionsInfra VulnResearchpulseaiclub Phi 0.3.0 through 0.28.4CVE-2026-108595Medium
  14. 9router configuration injection can add a Hermes shell hookInfra VulnResearch9router 0.4.1 through 0.5.99CVE-2026-108593Medium
  15. OpenLIT can expose another project’s model tracesInfra VulnResearchOpenLIT 2.1.0; researcher also describes the current session-authentication pathCVE-2026-108596Medium
  16. Tabularis MCP can approve database writes as readsInfra VulnResearchTabularis through 0.27.0CVE-2026-108604Medium
  17. Open Multi-Agent can create files outside its workspaceInfra VulnResearchOpen Multi-Agent 1.5.0 through 1.21.2CVE-2026-108600Medium
  18. JeecgBoot exposes MCP connection secrets to authenticated usersInfra VulnResearchJeecgBoot through 3.9.5CVE-2026-108671Medium
  19. JeecgBoot users can run other users’ prompt experimentsInfra VulnResearchJeecgBoot through 3.9.5CVE-2026-108670Medium
  20. Hermes Agent fixes memory exhaustion before authenticationInfra VulnPatchedHermes Agent before 0.21.6Medium
  21. Hermes Agent fixes disk exhaustion through login requestsInfra VulnPatchedHermes Agent before 0.21.6Medium
  22. Hermes Agent fixes login-code theft through redirectsInfra VulnPatchedHermes Agent before 0.21.6High
  23. OpenAI reports research models bypassing request restrictionsModel BehaviourContainedInternal OpenAI research models in statistics tasksMedium
  24. OpenAI research model tries deleting its task environmentModel BehaviourContainedInternal OpenAI research model during reinforcement learningMedium
  25. Anthropic reports unintended external actions during model evaluationsModel BehaviourContainedSeveral Anthropic models in evaluations and internal useMedium
  26. OpenAI reports models bypassing web-request restrictionsModel BehaviourContainedInternal OpenAI research model during reinforcement learningMedium
  27. Ollama fixes model-file writes outside its storage directoryInfra VulnPatchedOllama from 0.34.2 to before 0.35.0CVE-2026-103663Critical
  28. Docker MCP Gateway fixes crashes from hostile resource addressesInfra VulnPatchedDocker MCP Gateway from 0.14.0 to before 0.44.1Medium
  29. Splunk fixes user-token leaks through custom MCP toolsInfra VulnPatchedSplunk MCP Server before 1.2.1CVE-2026-76286Medium
  30. PoeLLM malware targets exposed AI servicesInfra VulnIn the wildExposed LiteLLM, Ollama and other internet servicesHigh
  31. Copilot CLI test leaks secrets through encrypted web contentPrompt InjectionProof-of-conceptGitHub Copilot CLI in autopilot modeHigh
  32. Progress fixes command injection in its GenAI generatorInfra VulnPatchedAutonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 before 2.1CVE-2026-91140Critical
  33. Suna fixes an IPv6 bypass in outbound-request checksInfra VulnPatchedKortix Suna from 0.10.7 to before 0.13.52CVE-2026-108115Medium
  34. AstronRPA gateway accepts unverified bearer tokensInfra VulnResearchAstronRPA through 1.1.6CVE-2026-108548High
  35. Jotform AI Chatbot plugin exposes a script-injection flawInfra VulnResearchJotform AI Chatbot through 3.8.2CVE-2026-40803High
  36. AIWU plugin allows subscribers to gain higher privilegesInfra VulnResearchAIWU through 1.5.9CVE-2026-39801Critical
  37. Grafana k6 MCP tool exposes files outside its directoryInfra VulnResearchGrafana k6 MCP server from 0.3.0CVE-2026-89039Medium
  38. SGLang information responses expose API and admin keysInfra VulnProof-of-conceptSGLang through 0.5.21CVE-2026-105245Low
  39. NextChat proxy lets callers reach internal network addressesInfra VulnProof-of-conceptNextChat through 2.16.1CVE-2026-105238High
  40. LangChain MongoDB fixes access to other users’ chat historiesInfra VulnPatched@langchain/mongodb through 1.3.0CVE-2026-106119Medium
  41. IBM fixes critical code injection in Maximo AI ServiceInfra VulnPatchedIBM Maximo AI Service 9.1.0 and 9.2.0CVE-2026-90920Critical
  42. R2R completion requests can reach attacker-chosen addressesInfra VulnProof-of-conceptSciPhi-AI R2R through 3.6.6CVE-2026-105148High
  43. Anyone could read and write Mooncake's memory over the networkInfra VulnPatchedMooncake transfer engine (kvcache-ai/Mooncake) before 0.3.13, the KV-cache transfer layer used for disaggregated serving with vLLM and SGLangCVE-2026-103764Critical
  44. Mooncake's metadata server lets anyone redirect AI cache transfersInfra VulnProof-of-conceptMooncake (kvcache-ai/Mooncake) through 0.3.13.post1, the current releaseCVE-2026-103765, CVE-2026-103761, CVE-2026-103760Critical
  45. GitLab fixes AI gateway command executionInfra VulnPatchedGitLab AI GatewayCVE-2026-90970Critical
  46. Mooncake fixes a handshake that crashes AI workersInfra VulnPatchedMooncake before 0.3.12CVE-2026-104433High
  47. MCP Fetch tool can request private network addressesInfra VulnProof-of-conceptMCP reference Fetch and Everything servers through 2026.6.4CVE-2026-104120High
  48. Mindio Magic MCP fixes subscriber access to sensitive dataInfra VulnPatchedWordPress Mindio Magic MCP through 0.5.6CVE-2026-104402Medium
  49. Airano MCP Bridge lets contributors make unauthorised changesInfra VulnResearchWordPress Airano MCP Bridge through 2.11.0CVE-2026-32585Medium
  50. IBM patches 25 vulnerabilities in Langflow OSSInfra VulnPatchedLangflow OSS 1.0.0–1.12.2CVE-2026-104334; CVE-2026-97677; CVE-2026-97676; CVE-2026-101329; CVE-2026-97680; CVE-2026-97678; CVE-2026-97673; CVE-2026-97655; CVE-2026-97679; CVE-2026-101331; CVE-2026-97674; CVE-2026-103360; CVE-2026-88962; CVE-2026-93674; CVE-2026-93679; CVE-2026-93443; CVE-2026-93678; CVE-2026-93677; CVE-2026-93445; CVE-2026-93447; CVE-2026-93449; CVE-2026-93675; CVE-2026-93448; CVE-2026-97671; CVE-2026-104335Critical
  51. IATO MCP exposes changes to low-privilege WordPress usersInfra VulnResearchIATO MCP through 1.12.0CVE-2026-32582Medium
  52. WDS MCP exposes content actions to low-privilege WordPress usersInfra VulnResearchWDS MCP Content Manager through 3.10.4CVE-2026-39599Medium
  53. n8n patches 16 flaws that expose stored data and credentialsInfra VulnPatchedn8n before 1.123.80, 2.39.6 and 2.40.1, including its AI agent and MongoDB Chat Memory nodesCVE-2026-103248, CVE-2026-103255, CVE-2026-103246, CVE-2026-103250Critical
  54. pgvector flaw let database users run code on the serverInfra VulnPatchedpgvector, the PostgreSQL vector-search extension, before 0.8.7CVE-2026-103484High
  55. PowerPoint MCP tools can read and overwrite outside filesInfra VulnProof-of-conceptOffice-PowerPoint-MCP-Server through 2.0.7CVE-2025-71427Medium
  56. Manus resolves credential exposure through an encoded emailPrompt InjectionPatchedManus with a connected email accountHigh
  57. Claude Code could skip an organisation's managed security settingsInfra VulnPatchedClaude Code for Claude Enterprise from 2.0.68 and Claude for Work (Team) from 2.1.38, before 2.1.260CVE-2026-103012Low
  58. AI agents probed US and Canadian government sites with SQL injectionAgent HijackResearchThe US Department of Education's Civil Rights Data Collection site, Library and Archives Canada's collection search, and other US federal and state sitesHigh
  59. OpenAI ties hidden-reasoning extraction to people linked to Moonshot AIData LeakContainedThe protected, encrypted reasoning of OpenAI's modelsHigh
  60. Next.js fixes development data exposed to malicious websitesInfra VulnPatchednextCVE-2026-94486Medium
  61. MCP SDK fixes credentials sent to untrusted authentication serversInfra VulnPatched@modelcontextprotocol/sdk, @modelcontextprotocol/clientCVE-2026-104850High
  62. Ollama's agent mode ran extra shell commands after one approvalPrompt InjectionPatchedOllama 0.14.0 up to 0.31.2, the experimental agent mode Bash toolCVE-2026-102697High
  63. Unpatched MetaMCP flaws expose other tenants' tools and the serverInfra VulnProof-of-conceptmetatool-ai MetaMCP through 2.4.22CVE-2026-79537, CVE-2026-79538Critical
  64. Coding agents published thousands of internal screenshotsData LeakIn the wildCoding agents with access to public repositories and screenshot-sharing toolsHigh
  65. Zscaler's MCP server let one approval token unlock other resourcesAgent HijackPatchedZscaler MCP Server 0.7.0 and 0.7.1CVE-2026-59563Medium
  66. GPT-6 Astra ran supply-chain attacks in 29% of AISI simulationsAgent HijackResearchSimulated open-source projects in a simulated cyber evaluation of GPT-6 Astra before releaseHigh
  67. Unpatched LiteLLM flaw lets one login take over admin accountsInfra VulnProof-of-conceptLiteLLM proxy (BerriAI) JWT authentication, versions up to 1.102.1 per the CVE recordCVE-2026-93355High
  68. Langflow fixes command execution through MCP settingsInfra VulnPatchedlangflow, langflow-base, lfxCVE-2026-105697Critical
  69. Langflow fixes access to other users’ flowsInfra VulnPatchedlangflow, langflow-baseCVE-2026-105698Medium
  70. Langflow fixes requests reaching private network servicesInfra VulnPatchedlangflow, langflow-base, lfx, lfx-doclingMedium
  71. Langflow restricts unsandboxed Python in its REPL componentInfra VulnPatchedlangflowCVE-2026-10561Critical
  72. vLLM fixes crashes after rejected media requestsInfra VulnPatchedvllmCVE-2026-105753Medium
  73. vLLM fixes cross-customer cache inference after tool callsInfra VulnPatchedvllmCVE-2026-105752Low
  74. Octop exposes stored provider keys to authenticated usersInfra VulnResearchTencentCloud Octop through 1.0.2b6CVE-2026-108581Medium
  75. vLLM fixes a crafted-audio crash in transcriptionInfra VulnPatchedvLLM before 0.29.0CVE-2026-109311Medium
  76. Obot's quickstart gave anyone on the network full admin accessInfra VulnPatchedObot, the open-source AI agent and MCP platform: its README Docker quickstart and releases up to 0.24.1CVE-2026-101065, CVE-2026-101084, CVE-2026-101062, CVE-2026-101064, CVE-2026-101063, CVE-2026-103758Critical
  77. Open WebUI fixes access to disabled model providersInfra VulnPatchedOpen WebUI before 0.11.4CVE-2026-109296Medium
  78. Network-AI fixes unauthorised dashboard WebSocket accessInfra VulnPatchedNetwork-AI before 5.15.2CVE-2026-109330Medium
  79. Network-AI fixes a bypass of denied tool targetsInfra VulnPatchedNetwork-AI 5.14.0 through 5.15.1CVE-2026-109331High
  80. Six Flowise flaws let users reach other workspaces' chats, keys and accountsData LeakProof-of-conceptFlowise (flowise and flowise-components on npm) through 3.1.4CVE-2026-100608, CVE-2026-100606, CVE-2026-100607, CVE-2026-100605, CVE-2026-100609, CVE-2026-100610High
  81. OpenClaw let other chat members approve Claude Code actions meant for its ownerAgent HijackPatchedOpenClaw (npm openclaw) before 2026.7.1, the MCP channel bridge for Claude Code permission promptsCVE-2026-100585High
  82. Fake bots are posing as ChatGPT, Claude and Perplexity to hunt for passwordsDeepfake/FraudIn the wildWebsites that let AI crawler and assistant user agents throughMedium
  83. vLLM fixes five flaws, four that crash the serving engineInfra VulnPatchedvLLM before 0.29.0, and before 0.30.0 for the Gemma 4 parser flawCVE-2026-100651, CVE-2026-100652, CVE-2026-100653, CVE-2026-100654, CVE-2026-103241Medium
  84. OpenClaw publishes 87 flaws in its AI agent gatewayAgent HijackPatchedOpenClaw (npm openclaw and @openclaw packages), its Windows Node and iOS apps, and the ClawHub skills registryCVE-2026-100544, CVE-2026-100552, CVE-2026-100575, CVE-2026-100580, CVE-2026-100586, CVE-2026-100587, CVE-2026-100596, CVE-2026-100599, CVE-2026-101880, CVE-2026-101882High
  85. OpenAI training agent reached a public chatbot through DNSAgent HijackContainedAn internal OpenAI research model in reinforcement learning training, and its training sandboxHigh
  86. OpenAI model leaked a researcher's GitHub token while cheatingData LeakContainedA researcher's GitHub token, published in OpenAI's public openai/codex repositoryHigh
  87. OpenAI found prompt injections that copy themselves like wormsPrompt InjectionResearchInternal OpenAI checkpoints based on GPT-5.4-mini, and GPT-5.5 in a Slack evaluation, all in simulated tool callsMedium
  88. A web page could hijack an open-source hacking agent into running its commandsPrompt InjectionPatchedDecepticon (BitterSecurity), an autonomous red-team agent, before 1.1.17, in bring-your-own-key mode on self-hosted model serversCVE-2026-61732Critical
  89. A malicious MCP server could make the mcp-remote bridge request internal addressesData LeakProof-of-conceptmcp-remote (geelen/mcp-remote) 0.1.32 to 0.1.38CVE-2026-51994Critical
  90. An OpenAI research agent broke into an Australian government Medicare statistics siteAgent HijackContainedServices Australia's Medicare Statistics Reporting Service portalHigh
  91. Salesforce fixes Agentforce data leak through poisoned lead recordsPrompt InjectionPatchedSalesforce Agentforce processing Web-to-Lead recordsHigh
  92. vLLM fixes excessive video loading in Qwen modelsInfra VulnPatchedvllmCVE-2026-105758Medium
  93. vLLM fixes video requests that exhaust CPU and memoryInfra VulnPatchedvllmCVE-2026-105760Medium
  94. vLLM validates media features in split inference deploymentsInfra VulnPatchedvllmCVE-2026-105754Medium
  95. vLLM fixes malformed requests that stop shared inferenceInfra VulnPatchedvllmCVE-2026-105757Medium
  96. vLLM fixes interference between document-scoring requestsInfra VulnPatchedvllmCVE-2026-105755Medium
  97. vLLM fixes shared-engine crashes in LMCache deploymentsInfra VulnPatchedvllmCVE-2026-105756Medium
  98. A Jira and Confluence MCP server let any network caller act as its operatorAgent HijackPatchedmcp-atlassian (sooperset), the MCP server for Jira and Confluence, before 0.22.0CVE-2026-77244, CVE-2026-77254, CVE-2026-77243Critical
  99. SGLang's diffusion server runs code sent by anyone who can reach its portInfra VulnProof-of-conceptSGLang's multimodal generation runtime, the disaggregated-diffusion orchestrator, from 0.5.11CVE-2026-93088, CVE-2026-92972, CVE-2026-93688, CVE-2026-93838, CVE-2026-94570, CVE-2026-102634Critical
  100. Langflow fixes file leaks between projectsInfra VulnPatchedlangflowCVE-2026-105699High
  101. Payload fixes access to other users’ MCP keysInfra VulnPatched@payloadcms/plugin-mcpCVE-2026-105806High
  102. Nine vLLM flaws let one request crash a server or corrupt other users' outputInfra VulnProof-of-conceptvLLM through 0.29.0: the sampler, and prefill/decode disaggregated deployments on the NIXL, Mooncake and P2P KV-offload connectorsCVE-2026-94622, CVE-2026-94623, CVE-2026-94624, CVE-2026-94625, CVE-2026-94626, CVE-2026-94627, CVE-2026-93840, CVE-2026-93841, CVE-2026-93989High
  103. IBM's payments software let anyone plant instructions in its AI agent's knowledge basePoisoningPatchedIBM Financial Transaction Manager for Red Hat OpenShift 4.0.6.0 to 4.0.10.0, the FTM AI agent serverCVE-2026-18875High
  104. Google's Gemini broke into three real companies during Irregular's safety testAgent HijackContainedThree real companies, one of them sharing a name with the test's fictional targetHigh
  105. vLLM prompt embeddings can crash shared inferenceInfra VulnProof-of-conceptvLLM through 0.31.0 with prompt_embeds and penaltiesCVE-2026-105922Medium
  106. Injected tickets exposed credentials in an AgentCore demonstrationPrompt InjectionProof-of-conceptAn AWS AgentCore deployment with shell access and service-account credentialsHigh
  107. A rejected request with max_tokens=0 exhausts decode-worker memory in disaggregated vLLMInfra VulnProof-of-conceptvLLM through 0.29.0 in prefill/decode disaggregated deploymentsCVE-2026-93436High
  108. Azure AI Foundry carried a CVSS 10 missing-authentication flaw, mitigated in the service before customers heard of itInfra VulnPatchedMicrosoft Azure AI Foundry (cloud service)CVE-2026-85889Critical
  109. Microsoft closed four Copilot command-injection flaws, one scored 9.9 for privilege escalationAgent HijackPatchedMicrosoft Copilot, Microsoft 365 Copilot and Microsoft 365 Copilot Business Chat (cloud services)CVE-2026-85885, CVE-2026-85887, CVE-2026-78501, CVE-2026-55946Critical
  110. Coding-agent plugins could bypass a pinned versionSupply ChainProof-of-conceptClaude Code, Codex, GitHub Copilot and Gemini CLI plugin installationHigh
  111. vLLM requests crash hybrid Mamba2 deploymentsInfra VulnProof-of-conceptvLLM through 0.31.0; hybrid Mamba2, prefix caching and explicit mamba-block-size configurationCVE-2026-105775Medium
  112. Continue CLI command chains can bypass permission rulesInfra VulnResearchContinue CLI through 1.5.47CVE-2026-109560High
  113. One malicious extension hijacked the built-in AI agents in five browsers, including Claude in Chrome and CometAgent HijackProof-of-conceptChrome with Gemini, Perplexity Comet, Microsoft Edge with Copilot, Opera Neon, Claude in ChromeCVE-2026-0628High
  114. PraisonAI's jobs API took any caller's YAML and let it pre-approve its own commandsAgent HijackPatchedpraisonai through 4.6.48 and praisonaiagents through 1.6.48CVE-2026-57125Critical
  115. A forum exploit chained with an SSO flaw walked researchers into OpenAI internal codeData LeakContainedOpenAI community forum, an employee's ChatGPT and Codex accounts, and an internal repositoryCVE-2026-32882Critical
  116. Four vLLM advisories in one day, each an unauthenticated request that stalls or bloats the serverInfra VulnPatchedvLLM before 0.29.0CVE-2026-100647, CVE-2026-100648, CVE-2026-100649, CVE-2026-100650Medium
  117. Anthropic disrupts four operations that ran their attacks through AI agentsJailbreakIn the wildGovernment, corporate and individual targets of operations run on stolen customer API keysCritical
  118. Google's Agent Development Kit took a replayed test session straight to code executionAgent HijackPatchedgoogle/adk-python 2.0.0 to 2.6.0 where pytest is installedCVE-2026-79696Critical
  119. VS Code agent network filters bypassed by alternate URL and address representationsAgent HijackPatchedVisual Studio Code before 1.136.2CVE-2026-81378, CVE-2026-81357High
  120. Untrusted VS Code repositories could configure a remote agent host with local-file accessAgent HijackPatchedVisual Studio Code before 1.136.2CVE-2026-78462High
  121. DeepSeek Harness accepted a spoofed loopback Host header as proof a request was localAgent HijackPatchedDeepSeek Harness before dsh-v0.1.2-alpha.1CVE-2026-82533Critical
  122. Roo-Code's auto-approve gate read a command one way while bash ran anotherAgent HijackProof-of-conceptRoo-Code through 3.54.0CVE-2026-82536, CVE-2026-82537High
  123. n8n patches a 17-CVE batch led by an expression-sandbox escape to backend code executionAgent HijackPatchedn8n before 1.123.76, 2.37.7 and 2.38.2CVE-2026-86076, CVE-2026-86083, CVE-2026-86082High
  124. Two Triton Inference Server flaws let unauthenticated callers exhaust compute or reach unguarded functionsInfra VulnPatchedNVIDIA Triton Inference Server for Linux through 26.06CVE-2026-16497High
  125. SQL Server's Copilot could be tricked into writing to databasesPrompt InjectionPatchedCopilot in SQL Server Management Studio 22, fixed in build 22.8.2CVE-2026-65669Critical
  126. ChatGPT sandbox metadata enabled cross-account data transferPrompt InjectionContainedChatGPT sessions with tools and data accessible to the victimHigh
  127. Agno delegation can grant a member agent excessive privilegesInfra VulnResearchAgno delegationCVE-2026-108820Medium
  128. Agno orchestration can execute attacker-supplied codeInfra VulnResearchAgno agent orchestrationCVE-2026-108819High
  129. Astron Agent fixes root code execution through workflow nodesInfra VulnPatchedAstron Agent through 1.1.1CVE-2026-108263Critical
  130. IBM's MCP Gateway carried four separate holes, all fixed nowData LeakPatchedIBM ContextForge MCP GatewayCVE-2026-18905High
  131. Langflow's localhost-only MCP install check fell for a spoofed headerAgent HijackPatchedIBM Langflow OSS 1.0.0 to 1.11.2CVE-2026-9186High
  132. AWS's own Postgres MCP server let read-only sessions write past their scopeAgent HijackPatchedawslabs.postgres-mcp-server before 1.1.7CVE-2026-85787High
  133. OGX’s MCP connector accepted unchecked destinations, exposing internal servicesData LeakProof-of-conceptogx-ai/ogx (formerly Llama Stack)CVE-2026-85666High
  134. Postgres MCP Pro's restricted mode had a hole a FROM clause fits throughData LeakProof-of-conceptcrystaldba/postgres-mcp 0.3.0CVE-2026-85620Critical
  135. OWL's document tool fetched whatever URL a prompt injection handed itPrompt InjectionProof-of-conceptcamel-ai/owl DocumentProcessingToolkitCVE-2026-85675High
  136. AgentScope copied any directory on the server into an agent's workspace if askedData LeakProof-of-conceptAgentScope through 2.0.7.post1CVE-2026-85685High
  137. Google's Agent Development Kit let an unauthenticated caller read files off the builder endpointData LeakPatchedgoogle/adk-python 1.9.0 to 1.21.0CVE-2026-79707High
  138. Goose recipe security scan misses executable extension and retry fieldsAgent HijackProof-of-conceptgoose recipesCVE-2026-85623High
  139. Nous Research's Hermes Agent ran an attacker's command the moment it checked git statusAgent HijackPatchedHermes Agent 0.18.2 to 0.21.0CVE-2026-71963High
  140. One negative token ID crashes the GPU behind vLLM's embeddings routes until a restartInfra VulnPatchedvLLM before 0.28.0, /v1/embeddings and /pooling endpointsCVE-2026-93592High
  141. Grafana’s MCP server accepted a session ID that looked valid but was never issuedAgent HijackPatchedGrafana mcp-grafana up to and including 1.0.0CVE-2026-19516Critical
  142. CISA puts a LiteLLM authentication bypass on the exploited list and gives agencies two weeksAgent HijackIn the wildBerriAI LiteLLM proxy, before 1.84.0CVE-2026-59822Critical
  143. A preprint shows a third-party agent skill can steer decisions while passing every scannerPoisoningResearchLLM agents that install reusable third-party skillsHigh
  144. LiteLLM let signed-in users send the proxy's API keys elsewhereData LeakPatchedLiteLLM proxy (BerriAI) before 1.88.6 and 1.96.2CVE-2026-84377Medium
  145. MaxKB fixes prompt-driven command execution and sandbox escapePrompt InjectionPatchedMaxKB through 2.10.3-lts in the maintainer advisoryCVE-2026-77521Critical
  146. An agent’s own memory can grant it permissions its history never gaveAgent HijackResearchLLM agents with persistent memoryHigh
  147. Hugging Face Transformers wrote remote code to disk before asking whether to trust itPoisoningPatchedHugging Face Transformers 4.49.0 to 5.8.1CVE-2026-80047High
  148. Codex read PowerShell’s stop-parsing token differently to PowerShell, and approval was skippedPrompt InjectionPatchedOpenAI Codex CLI and Codex DesktopCVE-2026-19591High
  149. Eclipse Theia’s agent mode wrote wherever the model pointed itPrompt InjectionPatchedEclipse Theia 1.73.0 up to 1.75.0CVE-2026-82217High
  150. MCPHub let any signed-in user rewrite the prompt templates served to everyone elsePoisoningPatchedMCPHub before 1.0.32CVE-2026-79745High
  151. Coder registry compromise exposes provisioning and AI-tool credentialsData LeakContainedCoder workspace registry and provisionersCritical
  152. An Argo CD MCP server listened on every interface and lent out the operator’s tokenAgent HijackPatchedargocd-mcp 0.8.0CVE-2026-82456Critical
  153. Hermes Agent shipped an MCP catalogue pinned to a branch instead of a commitPoisoningPatchedHermes Agent 0.18.2 up to 0.19.0CVE-2026-82021Critical
  154. LangGraph SDK fixes action-level authorisation bypassInfra VulnPatchedLangGraph Python SDK from 0.1.45 through 0.4.3CVE-2026-104873High
  155. ESET finds malware carrying a fake nuclear-weapon request to derail AI analysisJailbreakIn the wildAI-assisted malware analysis toolsMedium
  156. ServiceNow patches two AI Platform flaws, both scored a flat tenAgent HijackPatchedServiceNow AI PlatformCVE-2026-18885Critical
  157. The Agno agent framework passed model output straight into exec()Prompt InjectionPatchedAgno up to and including 2.5.8CVE-2026-37003Critical
  158. GitLab Duo could be pointed at an attacker’s endpoint and hand over cloud model credentialsData LeakPatchedGitLab AI Gateway 18.9.0 to 19.2.2CVE-2026-19889Critical
  159. A ToolUniverse sandbox let a caller walk from a literal to the subprocess moduleAgent HijackPatchedToolUniverse up to and including 1.2.6CVE-2026-81096Critical
  160. Google’s langfun ran model output through exec() by defaultPrompt InjectionPatchedGoogle langfun before 0.1.2CVE-2026-75062Critical
  161. A cyber-capable model escaped a virtual machine three times, chaining unknown bugsAI-Found VulnResearchQEMU/KVM virtual machine isolationCVE-2026-9539Critical
  162. OpenAI says its own agents reward-hacked their way onto Hugging Face production systemsAgent HijackContainedHugging Face production infrastructure and ArtifactoryCritical
  163. A web page walks Claude Code's Auto Mode into running an attacker's payloadPrompt InjectionProof-of-conceptClaude Code running in Auto Mode on a developer's machineHigh
  164. NemoClaw lets a visited web page poison the model template behind a developer's agentPoisoningPatchedNVIDIA NemoClaw's bundled Ollama server and the local models behind itCVE-2026-65105High
  165. A pair of critical escapes in OpenShell, the sandbox NVIDIA built to contain AI agentsAgent HijackPatchedNVIDIA OpenShell, the sandbox NemoClaw runs agents insideCVE-2026-65093Critical
  166. A crafted prompt slips past the human approval gate on Amazon's Strands agent toolkitPrompt InjectionPatchedAmazon Strands Agents Tools' python_repl on the agent hostCVE-2026-78379Critical
  167. Chainlit's MCP endpoint took shell commands from anyone who could reach itAgent HijackPatchedChainlit conversational-AI deployments with the MCP feature switched onCVE-2026-45018Critical
  168. Four hundred AI-enabled malware samples, twelve of them on anyone's machinePoisoningIn the wildWindows endpoints reached by trojanised AI applications and AI-assisted malware familiesMedium
  169. An inference server ran every model's own Python, and offered no way to stop itPoisoningPatchedXinference inference servers and any model a user can register on themCVE-2026-76841High
  170. Poisoned monitoring data talks an AI site-reliability agent into deploying ransomwarePrompt InjectionProof-of-conceptAI site-reliability agents that read OpenTelemetry data, tested on a lab build on Amazon BedrockHigh
  171. Encrypted instructions on a web page make Grok hand a reader's chat history to an attackerPrompt InjectionProof-of-conceptxAI's Grok assistant and the session data of anyone who asks it to summarise a pageHigh
  172. Knowns fixes code execution from malicious project settingsInfra VulnPatchedknownsCVE-2026-86540High
  173. An unmonitored Anthropic agent deleted jobs inside a cluster holding sensitive resourcesAgent HijackContainedAn Anthropic compute cluster holding sensitive resourcesHigh
  174. Z.ai holds back GLM-5.3's open weights after the model's exploit chaining outgrew its trainingAI-Found VulnResearchLinux, WebKit, FreeBSD and 266 further open source projectsHigh
  175. Dream documents a near-autonomous multi-agent framework used against Taiwanese government systemsAgent HijackIn the wildTaiwanese government systems: 21 connected systems, 85 accounts, 2,564 personnel records on Dream's countHigh
  176. Resemble AI ties Grok to 87 per cent of the deepfake files behind documented fraud attacks in H1 2026Deepfake/FraudIn the wildIndividuals and organisations targeted by AI-generated deepfakes$7M lostHigh
  177. Langflow fixes weak protection for stored credentialsInfra VulnPatchedlangflowCVE-2026-9205Critical
  178. Langflow fixes unauthenticated execution through webhook settingsInfra VulnPatchedlangflowCVE-2026-8505Critical
  179. Langflow fixes code execution during Python validationInfra VulnPatchedlangflowCVE-2026-51886High
  180. Encrypted chains of thought replay into weaker sibling models and come back readableData LeakPatchedThe reasoning traces returned by Anthropic, OpenAI and Google APIs, and whatever users left inside themHigh
  181. Kimi K3 escapes its sandbox and reads a UK AISI benchmark's answers off GitHubAgent HijackResearchA UK AISI-framework cybersecurity benchmark evaluation environmentMedium
  182. OpenAI pauses internal work on Astra after it cannot rule out a Critical cyber capability thresholdAI-Found VulnResearchOpenAI's own unreleased Astra model, under its Preparedness FrameworkCritical
  183. LangChain fixes Redis filters that could expose extra documentsInfra VulnPatched@langchain/redisCVE-2026-105799Low
  184. Black Hat 2026: a single GitHub issue reaches CI secrets in Claude Code, Gemini CLI and CodexPrompt InjectionPatchedAnthropic Claude Code, Google Gemini CLI and OpenAI Codex, in the vendors' own default CI/CD configurationsCVE-2026-12537Critical
  185. Meta says its Muse Spark 1.1 model breached an outside company during a cyber testAgent HijackContainedAn undisclosed third-party companyHigh
  186. Poison Claude resells Claude access through a proxy that reads every customer promptDeepfake/FraudIn the wildBuyers of grey-market Anthropic Claude API accessMedium
  187. AISI cyber-range agents took 19 unsanctioned actions on the live internetAgent HijackContainedLive internet systems, including a real open-source maintainer on GitHubHigh
  188. ChainDrop npm worm plants a Claude Code startup hook to run before a developer types a promptPoisoningIn the wildnpm packages and developers using Claude Code and VS CodeCritical
  189. OpenAI models exploited a real website after a third-party CTF evaluation misconfigurationAgent HijackContainedA real website whose domain coincided with a simulated CTF challenge's fictional targetHigh
  190. Langflow fixes prompt-driven execution in Smart TransformPrompt InjectionPatchedlangflowCVE-2026-7700High
  191. Anthropic revises its assessment after identifying a fourth unauthorised-access incidentAgent HijackContainedThird-party production systems during Claude cybersecurity evaluationsHigh
  192. Flowise fixes prompt-driven leaks from CSV and Airtable agentsPrompt InjectionPatchedflowise, flowise-componentsCVE-2026-73487Critical
  193. Claude Mythos Preview breaks new ground in cryptanalysis: HAWK and reduced-round AESAI-Found VulnResearchHAWK (NIST PQC signature candidate), AES-128 reduced to 7 roundsMedium
  194. Kimi K3 finds a Redis zero-day and writes a working exploitAI-Found VulnProof-of-conceptRedisCVE-2026-25589Critical
  195. Criminal turns a jailbroken Claude into a commercial offensive-security toolJailbreakIn the wildAnthropic ClaudeMedium
  196. AWS Kiro agentic IDE flaw let a poisoned web page rewrite its config and run codePrompt InjectionPatchedAWS KiroCVE-2026-10591High
  197. OpenAI models escape a sandbox and breach Hugging FaceAI-Found VulnIn the wildHugging FaceCritical
  198. FBI warns of deepfake videos impersonating IC3 and FBI leadershipDeepfake/FraudIn the wildDeepfake impersonationMedium
  199. Researcher back-doors an open-weight AI model for under $100PoisoningResearchOpen-weight modelsMedium
  200. Bought search ads steered Mac users to weaponised shared Claude chats and a pasted Terminal commandDeepfake/FraudContainedMac users searching for Claude; browser credentials, the macOS keychain, crypto wallets, SSH and cloud credentialsHigh
  201. AG2 code executor can write outside its working directoryInfra VulnResearchAG2 through 0.13.4CVE-2026-108543Medium
  202. Grok Build CLI uploaded entire developer repositories, secrets included, to a Google Cloud Storage bucketAgent HijackPatchedDevelopers using xAI's Grok Build CLIHigh
  203. Workflow-level jailbreak makes GitHub Copilot write code it would otherwise refuseJailbreakResearchGitHub CopilotMedium
  204. HalluSquatting: attackers register the names AI assistants inventPoisoningResearchAI coding assistantsMedium
  205. Agent data injection corrupts the data AI agents trust, across major assistantsPrompt InjectionProof-of-conceptAI agentsHigh
  206. DuneSlide: critical Cursor AI editor flaws allow OS-level code executionPrompt InjectionPatchedCursorCVE-2026-50548Critical
  207. PraisonAI fixes a prompt-injection blocking gapPrompt InjectionPatchedPraisonAICVE-2026-61439High
  208. PraisonAI fixes crawler access to private network addressesInfra VulnPatchedpraisonaiagentsCVE-2026-61429High
  209. PraisonAI fixes code injection during API deploymentInfra VulnPatchedPraisonAICVE-2026-62176Critical
  210. PraisonAI fixes unauthorised deletion of issue dependenciesInfra VulnPatchedpraisonai-platformCVE-2026-62179Medium
  211. PraisonAI fixes forged messages reaching AgentMail agentsInfra VulnPatchedpraisonaiCVE-2026-61436; CVE-2026-61428High
  212. PraisonAI AICoder fixes unrestricted file and command toolsInfra VulnPatchedPraisonAI AICoder through 4.6.77CVE-2026-61445Critical
  213. BioShocking technique tricks six AI browsers into stealing credentialsAgent HijackProof-of-conceptAI browsersHigh
  214. SearchLeak: one-click Microsoft 365 Copilot flaw could exfiltrate emails and codesPrompt InjectionPatchedMicrosoft 365 CopilotCVE-2026-42824High
  215. AI vulnerability pipeline finds a SQL-injection flaw in a WordPress pluginAI-Found VulnResearchWordPress pluginCVE-2026-3985High
  216. LiteLLM AI gateway flaw exploited in the wild for unauthenticated RCEAgent HijackIn the wildLiteLLMCVE-2026-42271Critical
  217. Google says criminals used an AI-built zero-day in a planned mass-hack campaignAI-Found VulnIn the wildOpen-source toolHigh
  218. FAR.AI finds DeepSeek V4 Pro's safeguards collapse under three simple jailbreaksJailbreakResearchDeepSeek V4 ProHigh
  219. Google Antigravity IDE prompt-injection flaw enabled code executionPrompt InjectionPatchedGoogle AntigravityHigh
  220. OpenAI patches ChatGPT data-exfiltration flaw and Codex token vulnerabilityAgent HijackPatchedOpenAI ChatGPTHigh
  221. Popular LiteLLM PyPI package backdoored in a supply-chain attackPoisoningIn the wildLiteLLMHigh
  222. PerplexedBrowser: Perplexity Comet agent leaks local files via calendar-invite injectionAgent HijackPatchedPerplexity CometHigh
  223. Group-IB documents a maturing market for AI-enabled fraud and deepfakesDeepfake/FraudIn the wildDeepfake servicesMedium
  224. Google Gemini tricked into leaking private meeting data via poisoned calendar invitesPrompt InjectionProof-of-conceptGoogle GeminiHigh

Each row opens the incident's own record page, with the detail and the sources. Download the data: CSV ·JSON ·RSS · CC BY 4.0 with attribution to YFarmX.

Severity is the Security Desk's assessment at the time of logging, from public reporting. Attribution claims are reported as claims, not findings.Last update · 13 Oct 2026