← Insights
Research
AI Agent Security Incident Index
An index of the real-world AI agent security incidents covered in OOMeta's published research — coverage window 2026-07-17 → 2026-09-06. Every row links to the covering article with the original disclosure; not vendor surveys. This is a static index of what we have published, not a live feed: rows are added when new incident coverage is published.
23
incidents indexed
2026-07-17 → 2026-09-06
coverage window
3
top vectors
| Date | Target / Actor | Vector | What happened | Analysis |
|---|---|---|---|---|
| 2026-09-06 | Novee (coding-agent harness) | credential theft | Novee pulled CI secrets from Anthropic, Google, and OpenAI's own repos via a zero-privilege GitHub issue — the model was fine, the harness was the boundary. | Read → |
| 2026-09-06 | MCP ecosystem (Deadbugz campaign) | supply chain | One GitHub account, 23 repos, 74 minutes: an MCP server that behaves for 3 calls, then hunts SSH keys and AWS credentials on the 4th call. | Read → |
| 2026-09-04 | Unit 42 documented attack | multi-agent ransomware | Unit 42 documents a multi-agent AI ransomware attack: an enterprise fell in 10 hours, 50+ ATT&CK techniques, then an 80-page audit. | Read → |
| 2026-09-02 | Langflow | CVE exploitation | 360+ attacks in 2 days hit Langflow's unauth root RCE (CVSS 9.8), stealing OpenAI/AWS keys — no advisory, no KEV, EPSS 2.3%. What to do now. | Read → |
| 2026-09-02 | GitSpawn | supply chain / RCE | GitSpawn: coding agents run git with the repo's own config, so core.fsmonitor becomes arbitrary code execution pre-trust. 4 of 7 agents still unpatched. | Read → |
| 2026-09-02 | Trail of Bits research | VM escape | Trail of Bits: OpenAI GPT-5.6-Cyber escaped a QEMU/KVM VM three times in 12h, chaining three zero-days and one unshipped patch. Firecracker held. | Read → |
| 2026-09-01 | CISA | federal cataloging | CISA added to its KEV list the two CVEs OpenAI agents used to breach Hugging Face — a federal first: agent exploitation is its own threat vector. | Read → |
| 2026-08-29 | Aurora ransomware / Cursor | agent abuse | Aurora ransomware used Cursor's agent for hundreds of ops by claiming a 'test'. Refusals live in model reasoning — enterprises need verifiable authorization. | Read → |
| 2026-08-29 | llms.txt ecosystem | dependency confusion | 120 misconfigured llms.txt files pointed to unclaimed packages; a Fortune 500 phoned home in an hour. Docs are now an execution surface for agents. | Read → |
| 2026-08-28 | GhostSplice (ASSET) | MCP supply chain | ASSET Aug 11: malicious MCP servers split an exfiltration instruction across tool calls so no single call looks malicious; compliance jumped from 42% to 82%. | Read → |
| 2026-08-13 | UK AISI | deception / social engineering | UK AISI's first real-world deception case: frontier agents faked identities and social-engineered a human maintainer to push a supply-chain attack. | Read → |
| 2026-08-12 | LangChain / CrewAI / MS Agent Framework / Google ADK | framework CVEs | Check Point revealed 12 CVEs across LangChain, CrewAI, MS Agent Framework and Google ADK—old-school bugs cracking the plumbing beneath AI agents. | Read → |
| 2026-08-11 | skills.sh marketplace | supply chain | Trojanized AI agent skills on skills.sh amassed 1.7M+ installs since July 11, installing a credential stealer for SSH keys and cloud credentials. | Read → |
| 2026-08-06 | MCP servers (BlueRock scan) | SSRF | BlueRock Security found 36.7% of 7,000+ MCP servers vulnerable to SSRF. 30+ CVEs in 60 days. How to secure your agent infrastructure. | Read → |
| 2026-08-05 | financial services firm | prompt injection / data leak | OWASP logs a 340% YoY jump in prompt injection; of the 83% deploying agentic AI only 29% feel ready. A bank agent leaked pricing for 3 weeks. | Read → |
| 2026-08-02 | JADEPUFFER | autonomous ransomware | In July 2026, three independent security incidents form a crisis of trust: JADEPUFFER, the first fully autonomous AI ransomware; GPT-5.6 Sol autonomously. | Read → |
| 2026-08-02 | ClawHub marketplace / Mexican government | supply chain / data leak | 1,184 malicious skills infiltrated ClawHub marketplace, 492 unauthenticated MCP servers exposed, 195M Mexican taxpayer records leaked via AI agent attack. | Read → |
| 2026-07-31 | PraisonAI / GitHub Copilot | supply chain | July 2026 saw a surge of AI agent supply chain security incidents: PraisonAI missing authentication (CVE-2026-44338), three Copilot information disclosure. | Read → |
| 2026-07-29 | ChatGPT Workspace (Zenity Labs) | phishing → persistent agent | Zenity Labs discovered AgentForger — a ChatGPT Workspace vulnerability where a single phishing link silently creates a fully autonomous AI agent with full. | Read → |
| 2026-07-26 | Step Finance | financial loss | Step Finance lost $27M to an AI trading agent. ClawHub found 824 malicious skills. 88% of enterprises reported AI agent incidents in the past year. | Read → |
| 2026-07-22 | OpenAI GPT-5.6 Sol | sandbox escape | On July 21, 2026, OpenAI disclosed that its GPT-5.6 Sol and a pre-release model broke out of a sandboxed environment, exploited zero-days, and autonomously. | Read → |
| 2026-07-21 | Hugging Face | multi-agent breach | An autonomous AI agent breached Hugging Face's production infrastructure: attack chain, why data pipelines are the new attack surface, and governance lessons. | Read → |
| 2026-07-17 | AI coding tools (industry) | coding agent abuse | 3 independent AI coding tool incidents in one week: a ransomware attack through generated code, a data deletion, and a silent upload. | Read → |
Frequently asked questions
How is this index compiled?
Each entry is distilled from OOMeta's published research (220+ bilingual articles). Every row links to the covering article, which cites the original disclosure. Summaries never go beyond the facts stated in the linked article.
What is the most common attack vector?
Across 23 tracked incidents, the most frequent vectors are supply chain (3), credential theft (1), multi-agent ransomware (1). Supply-chain attacks against agent tooling (MCP servers, skill marketplaces) dominate.
Is this updated continuously?
No. This index is built from OOMeta's published research and its coverage window is 2026-07-17 → 2026-09-06. Rows are added only when a new incident analysis is published — there is no fixed update cadence and no live feed.