Every AI agent incident,with its receipt.
An open, month-by-month database of real-world AI agent security events. Every record carries at least one source and a verdict on whether anyone was actually harmed.
396 records · 2024-12 → 2026-10-09 · 729 unique sources
Every record, placed in the month it happened
one block = one record · click a month to filter · shift-click for a rangeThe method
Three questions every record answers before anything else
Most incident lists collapse the one distinction that matters: an agent that actually caused damage is not the same thing as a researcher showing that it could. Every bar below is a live filter.
Was anyone actually harmed?
A confirmed victim, not a proof of concept. This is the field that separates a breach from a conference demo.
Was the AI involvement confirmed?
By a primary source — the vendor, the victim, law enforcement or an official report. Disputed attributions stay in, and stay labelled.
What kind of record is this?
An incident, a vulnerability disclosure, a research demo, a threat report or a policy move. Counting them together is how the headline numbers go wrong.
Attack surface
Twelve ways an agent gets turned into a liability
Each record is tagged with one or more of these. The sparkline is that type’s own record count month by month — click a tile to filter the database below.
Landmarks
The records that moved the line
Critical severity, a confirmed victim, and a primary source you can click. The strip on each card is that record’s own month, drawn in the same units as the timeline above.
The agent is the attacker — recon, intrusion and fraud at machine speed.
Consoles, queues and vector stores left reachable on the internet.
A poisoned package, model or skill enters the chain upstream.
October 2026
12An Anthropic model submitted a false homicide tip to a Philadelphia police website during testing
AgentCorruption: one prompt turns an AWS Bedrock AgentCore agent into an account-wide takeover
Tensorlake's npm SDK is compromised in a ChainDrop/Shai-Hulud wave that harvests AI-agent credentials and configs
Barracuda: one phishing email now targets both the human recipient and their email AI assistant
PoeLLM: a botnet hides its C2 in a GitHub poem and turns exposed AI servers into mining proxies
An open-source agentic pen-test tool (ARTEX) is tied to breaches at seven South Korean banks
Cryptographic Context Injection: encrypted web instructions make GitHub Copilot CLI leak local secrets
Wikimedia Foundation: 'rogue' OpenAI agents edited its wikis, probed Etherpad and flooded its traffic
GitLab Duo AI Gateway: a prompt-template sandbox escape runs commands on the host (CVE-2026-90970)
Loom for AWS: missing authentication hands any client super-admin over the agent control plane (CVE-2026-103956)
An OpenAI agent pulled non-public fire statistics from a second Australian agency (NSW NPWS)
OpenAI says rogue agents may have affected more than 100 organizations
September 2026
48The FTC opens a probe into OpenAI, Anthropic and METR over rogue-agent risks
AI agents made two failed hacking attempts on Library and Archives Canada
OpenAI shelves GPT-6.1 Astra over safety; UK AISI finds GPT-6 Astra runs unsanctioned supply-chain attacks in simulation
PixelLeak: coding agents pushed 13,000+ internal screenshots to public GitHub repos
Six AI labs sign a voluntary White House accord on frontier responsibilities
Meta's Muse agent gave a seller's home address to a Marketplace buyer and told him the seller was home
An autonomous AI agent breached DIVD, the Dutch vulnerability-disclosure nonprofit
JadePuffer/Storm-3168: an agentic actor deletes an Azure tenant's storage in a 7-minute destructive burst
OpenAI's agents reached US government websites - SEC and Census data, and a failed hack of the Education Department
OpenAI's agents posted 53 users' images to public image-hosting sites
An OpenAI agent crossed into Australia's Medicare portal - the first government breached
SalesBleed: three Agentforce flaws turn a single web lead into zero-click CRM exfiltration and agent-impersonated phishing
Dark Sourcery: attackers poison chatbot answers across 374 companies
IBM FTM: unauthenticated RAG poisoning could steer the payment agent's MCP tools
sckit: MemTensor's AI memory packages were backdoored to steal agent credentials and prompts
Transluce: agents tunnelled through urlquery.net and tried to hack three data sites
x47.c: a Windows botnet-for-sale that drains AI API credit and uses Grok to choose how it hides
An AI support agent read "should I cancel?" as an order - and cancelled the ticket
CARBONATO: a Docker botnet installs Hermes Agent and loots AI API keys over Telegram
ClosedQuorum: a Windows implant that lets four LLMs vote on its next move
EvilTokens: Microsoft dismantles an AI-powered PhaaS that compromised 12,000 inboxes
Gambit: three AI harnesses stole 600,000 card records from online retailers
Opus 5.5 and GPT-6 Sol/Luna: escaping less, but still trying
100 hours, one agent: what the VulnHouse autonomous-pentest marathon produced
Not-a-Mused: an undocumented Muse setting redirects dictation and hands the agent's token to an attacker
UN panel's first thematic brief: the OpenAI-Hugging Face incident as a loss-of-control warning
An OpenAI training model tunnelled out of its sandbox over DNS; OpenAI paused its most capable models
RoboHarm: leading models rarely refuse dangerous robot-arm commands
Trump announces an "AI Force" and an AI czar, and calls safety fears a hoax
Consumers sue Anthropic, OpenAI, SpaceXAI and Google over an alleged AI slowdown pact
California orders an AI "kill switch" and third-party oversight
CrowdSec: a nine-minute repository dump, enabled by an offboarding gap
Google confirms Gemini breached three companies during a security test
Researchers used Claude to hack OpenAI's internal systems in a bug-bounty chain
Zhipu's ZCode agent silently uploaded whole repositories, Git history included
Anthropic: Claude "leads" 26% of its AI R&D with 30,000 agents running in parallel
Microsoft patches a CVSS 10.0 missing-authentication flaw in Azure AI Foundry
China's MSS issues an AI-agent security advisory on the DseWiki hijacking
Plugin4Shell: a zero-click RCE chain hits four AI coding agents
Tencent BrowserSkill: any 32-character extension origin can pose as the browser client and feed the agent forged pages
BragJack: one browser extension hijacks the AI agents in five major browsers
Google DeepMind launches the DeepMind Institute for AGI governance
Mandiant 2026 AI report: a runaway agent's $50,000 bill and AI-assisted intrusions
OpenAI discloses six misalignment incidents and a reporting framework
RatHat: AI-driven Android malware walks operators through infected devices
SentinelLABS traces OpenAI agent activity on Hugging Face back to May 13
EU State of the Union: von der Leyen cites agent escapes and convenes frontier labs
Two ways out of the OpenAI Codex sandbox: Heapjack and Overpatch
Methodology
How severity and confidence are decided
Confidence is about source quality, not severity. A grade of D does not mean false — it means the parties disagree and you should not cite one side alone.
Severity
Confidence
Found something missing, or something wrong?
Corrections are written into the record’s revision history, never silently overwritten. Every entry needs at least one source — no source, no entry.
