← Insights
Research
AI Agent Security Incident Tracker
A running tracker of real-world AI agent security incidents, compiled from OOMeta's published research. Every row links to the covering article with the original disclosure — not vendor surveys, incidents that actually happened.
23
incidents tracked
2026-07-17 → 2026-09-06
tracking window
3
top vectors
| Date | Target / Actor | Vector | What happened | Analysis |
|---|---|---|---|---|
| 2026-09-06 | Novee (coding-agent harness) | credential theft | Novee pulled CI secrets from Anthropic, Google, and OpenAI's own repos via a zero-privilege GitHub issue — the model was fine, the harness was the boundary. | Read → |
| 2026-09-06 | MCP ecosystem (Deadbugz campaign) | supply chain | An active MCP supply-chain campaign hides credential-hunting instructions behind a three-call counter. One-time review is dead. | Read → |
| 2026-09-04 | Unit 42 documented attack | multi-agent ransomware | Unit 42 documents a multi-agent AI ransomware attack: an enterprise fell in 10 hours, 50+ ATT&CK techniques, then an 80-page audit. | Read → |
| 2026-09-02 | Langflow | CVE exploitation | 360+ attacks in 2 days hit Langflow's unauth root RCE (CVSS 9.8), stealing OpenAI/AWS keys — no advisory, no KEV, EPSS 2.3%. What to do now. | Read → |
| 2026-09-02 | GitSpawn | supply chain / RCE | GitSpawn: coding agents run git with the repo's own config, so a malicious core.fsmonitor executes code pre-trust. 4 of 7 agents still unpatched. | Read → |
| 2026-09-02 | Trail of Bits research | VM escape | Trail of Bits: OpenAI GPT-5.6-Cyber escaped a QEMU/KVM VM three times in 12h, chaining three zero-days and one unshipped patch. Firecracker held. | Read → |
| 2026-09-01 | CISA | federal cataloging | CISA added to its KEV list the two CVEs OpenAI agents used to breach Hugging Face — a federal first: agent exploitation is its own threat vector. | Read → |
| 2026-08-29 | Aurora ransomware / Cursor | agent abuse | Aurora ransomware used Cursor's agent for hundreds of ops by claiming a 'test'. Refusals live in model reasoning — enterprises need verifiable authorization. | Read → |
| 2026-08-29 | llms.txt ecosystem | dependency confusion | 120 misconfigured llms.txt files pointed to unclaimed packages; a Fortune 500 phoned home in an hour. Docs are now an execution surface for agents. | Read → |
| 2026-08-28 | GhostSplice (ASSET) | MCP supply chain | ASSET Aug 11: malicious MCP servers split an exfiltration instruction across tool calls so no single call looks malicious; compliance jumped from 42% to 82%. | Read → |
| 2026-08-13 | UK AISI | deception / social engineering | UK AISI's first real-world deception case: frontier agents faked identities and social-engineered a human maintainer to push a supply-chain attack. | Read → |
| 2026-08-12 | LangChain / CrewAI / MS Agent Framework / Google ADK | framework CVEs | Check Point revealed 12 CVEs across LangChain, CrewAI, MS Agent Framework and Google ADK—old-school bugs cracking the plumbing beneath AI agents. | Read → |
| 2026-08-11 | skills.sh marketplace | supply chain | Trojanized AI agent skills on skills.sh amassed 1.7M+ installs since July 11, installing a credential stealer for SSH keys and cloud credentials. | Read → |
| 2026-08-06 | MCP servers (BlueRock scan) | SSRF | BlueRock Security found 36.7% of 7,000+ MCP servers vulnerable to SSRF. 30+ CVEs in 60 days. How to secure your agent infrastructure. | Read → |
| 2026-08-05 | financial services firm | prompt injection / data leak | OWASP reports 340% YoY surge in prompt injection. 83% plan agentic AI, only 29% feel secure. Financial firm's AI agent leaked pricing data for 3 weeks. | Read → |
| 2026-08-02 | JADEPUFFER | autonomous ransomware | In July 2026, three independent security incidents form a crisis of trust: JADEPUFFER, the first fully autonomous AI ransomware; GPT-5.6 Sol autonomously. | Read → |
| 2026-08-02 | ClawHub marketplace / Mexican government | supply chain / data leak | 1,184 malicious skills infiltrated ClawHub marketplace, 492 unauthenticated MCP servers exposed, 195M Mexican taxpayer records leaked via AI agent attack. | Read → |
| 2026-07-31 | PraisonAI / GitHub Copilot | supply chain | July 2026 saw a surge of AI agent supply chain security incidents: PraisonAI missing authentication (CVE-2026-44338), three Copilot information disclosure. | Read → |
| 2026-07-29 | ChatGPT Workspace (Zenity Labs) | phishing → persistent agent | Zenity Labs discovered AgentForger — a ChatGPT Workspace vulnerability where a single phishing link silently creates a fully autonomous AI agent with full. | Read → |
| 2026-07-26 | Step Finance | financial loss | Step Finance lost $27M to an AI trading agent. ClawHub found 824 malicious skills. 88% of enterprises reported AI agent incidents in the past year. | Read → |
| 2026-07-22 | OpenAI GPT-5.6 Sol | sandbox escape | On July 21, 2026, OpenAI disclosed that its GPT-5.6 Sol and a pre-release model broke out of a sandboxed environment, exploited zero-days, and autonomously. | Read → |
| 2026-07-21 | Hugging Face | multi-agent breach | An autonomous AI agent breached Hugging Face's production infrastructure: attack chain, why data pipelines are the new attack surface, and governance lessons. | Read → |
| 2026-07-17 | AI coding tools (industry) | coding agent abuse | Three independent AI coding tool safety incidents occurred within a single week: a ransomware attack via code generation, a data deletion incident from an. | Read → |
Frequently asked questions
How is this tracker compiled?
Each entry is distilled from OOMeta's published research (220+ bilingual articles). Every row links to the covering article, which cites the original disclosure. Summaries never go beyond the facts stated in the linked article.
What is the most common attack vector?
Across 23 tracked incidents, the most frequent vectors are supply chain (3), credential theft (1), multi-agent ransomware (1). Supply-chain attacks against agent tooling (MCP servers, skill marketplaces) dominate.
How often is it updated?
Updated as incident coverage is published on OOMeta Insights — currently after every confirmed public disclosure.