The 2026 incident board

A running log of real AI-security incidents, each tied to the threat class it illustrates - so the playbook stays grounded in what has actually happened, not theory.

Treat each entry as case material - it maps to a section’s threat class. (A snapshot as of late July 2026; details are as reported by the cited researchers and vendors - verify specifics before citing externally.)

Incident	What happened	Maps to
GTG-1002 (Nov 2025)	State-sponsored actor used an AI to orchestrate ~80-90% of an espionage campaign against ~30 targets, largely autonomously (as reported by Anthropic)	VI.1 Offensive AI
Azure SRE Agent - CVE-2026-32173 (CVSS 8.6)	As reported in the CVE record, improper authentication on a network-facing endpoint (SignalR hub) let an unauthenticated attacker disclose sensitive information from the agent over the network	V.2 Infra · IV.6 identity
Azure MCP Server - CVE-2026-32211	As reported, the MCP (Model Context Protocol) server’s authentication layer was simply absent - the concrete example of OWASP MCP07 (insufficient authentication); any reachable client could invoke its tools	IV.2 MCP
nginx-ui “MCPwn” - CVE-2026-33032 (CVSS 9.8)	The MCP /mcp_message endpoint enforced only an IP allowlist that defaulted to empty (= allow-all), so any network attacker could invoke MCP tools and take over the server. Actively exploited; the finder reports a fix in v2.3.4, but the official CVE record lists 2.3.5 and prior as affected - update to the latest (2.3.6+)	IV.2 MCP
MCP TypeScript SDK leak - CVE-2026-25536 (CVSS 7.1)	As reported, reusing one server/transport instance across clients caused JSON-RPC message-ID collisions that routed one client’s response to another - a cross-client data leak. Fixed in v1.26.0	IV.2 MCP · V.3 data
ShareLeak (CVE-2026-21520, CVSS 7.5) · PipeLeak	Indirect prompt injection in Microsoft Copilot Studio via a SharePoint form field made the agent query connected SharePoint List data and exfiltrate it via Outlook (Capsule Security). PipeLeak is the Salesforce Agentforce sibling (no CVE assigned). See II.2 for why patching the prompt does not close the architectural exfiltration path	II.2 injection · V.3 data
Boundary Point jailbreaking (UK AISI, Feb 2026; arXiv:2602.15001)	An automated technique that generates universal jailbreaks against even well-defended systems - reinforces that guardrails are a first filter, measured under adaptive attack (II.3)	II.3 bypasses
Hugging Face production breach - driven by OpenAI evaluation models (HF 16 Jul 2026; OpenAI attribution 21 Jul 2026)	The containment failure that became a real third-party compromise. A malicious dataset chained two code-execution paths in HF’s dataset pipeline (a remote-code loader plus template injection in a dataset config), escalated to node access, harvested cloud and cluster credentials and moved laterally; HF logged 17,000+ events and describes it as “driven, end to end, by an autonomous AI agent system”. Five days later OpenAI disclosed the operator was its own GPT-5.6 Sol plus an unreleased model, run with cyber refusals lowered for a benchmark, which exploited a zero-day in the package-registry proxy that was meant to be the sandbox’s only network path. No public models, datasets or Spaces tampered; supply chain verified clean. No CVE	VI.1 offensive AI · I.7 evals · I.5 supply chain
JADEPUFFER (Sysdig, 1 Jul 2026)	What Sysdig assesses to be the first extortion campaign driven end to end by an LLM rather than a human with AI assistance. Entry was an older Langflow unauthenticated code-execution flaw (CVE-2025-3248); the agent harvested credentials, set crontab beaconing, then hit production MySQL and Nacos and deployed ransomware. The evidence for autonomy is behavioral - self-narrating payloads, and self-diagnosis of its own failures inside 31 seconds. The novelty is the operator, not the exploit	VI.1 offensive AI · VII.3 detection
Mini Shai-Hulud worm - TanStack, Mistral AI, Guardrails AI (11-14 May 2026)	The counterexample to “we only install packages with verified provenance”. The implant harvested Actions tokens, repo secrets, AWS and Vault credentials, exfiltrated over a P2P messenger network, and self-propagated by minting npm OIDC tokens to republish under stolen maintainer identities - so provenance attestation confirmed the malicious artifacts. OpenAI reported two employee devices affected and rotated its macOS signing certificates	I.5 supply chain · III.2 coding agents
”Comment and Control” (Johns Hopkins, Apr 2026)	The same architectural defect - untrusted repo text and live credentials sharing one context - landing independently in three vendors’ flagship agents, so it is a default rather than a coding slip. Claude Code Security Review interpolated PR titles unsanitized; Gemini CLI Action obeyed a forged “Trusted Content” section and posted its API key back as a public comment; Copilot Coding Agent fell to invisible HTML-comment injection that defeated environment filtering and the network firewall at once. In each case the agent performed its own exfiltration	III.2 coding agents · II.2 injection
GuardFall (Adversa, 30 Jun 2026)	Guardrail bypass as a class refutation: 10 of 11 surveyed open-source coding agents fell to shell-injection bypasses exploiting the gap between guards that pattern-match the raw command string and bash’s actual execution semantics, which expand variables and evaluate substitutions after the guard passes. You cannot validate a command by inspecting text the shell will subsequently rewrite - execute argv arrays without a shell, or confine execution rather than inspect it	III.2 coding agents · II.5 guardrails
GhostApproval (Wiz, 8 Jul 2026) - CVE-2026-12958 · CVE-2026-50549	A hostile repo ships a symlink dressed as an ordinary project file pointing at ~/.ssh/authorized_keys; the agent edits it and writes outside the workspace. The compounding defect is the dialog: it frequently renders the innocuous filename rather than the resolved target, so consent is obtained under a false description - human-in-the-loop is only as good as what the dialog shows. Note the CVE covers the symlink defect, not the dialog: CVE-2026-50549 is Cursor’s canonicalization fallback (CWE-59, CVSS 9.8), reported as DuneSlide by Cato and GhostApproval by Wiz - one defect, two names. Affected six assistants; fixed by AWS, Google and Cursor, others unfixed at publication	III.2 coding agents · IV.6 approval
Systemic MCP STDIO command injection (OX Security, 15 Apr 2026) - 11 CVEs across 15 instances	The flaw is in the shape of the protocol, not one implementation: STDIO turns configuration into execution by design, so a client that lets a user - or a model - define a server command runs arbitrary OS commands. Four families, including allowlist bypass (restricting to npm/npx is defeated by argument injection) and prompt-injection-to-RCE, where a malicious prompt rewrites the assistant’s own MCP config. As reported, Anthropic declined to change the protocol, characterizing the behavior as expected	IV.2 MCP · IV.1 tool use
Transformers config-injection pair - CVE-2026-4372 (NVD 7.8) · CVE-2026-5241 (NVD 9.6)	One root cause twice in a quarter: attacker-controlled fields in a downloaded config.json crossing into a code-loading decision - which is why trust_remote_code=False is not a security boundary. In 4372 a generic setattr() loop let a private attribute name an attacker’s kernel repo that importlib imported on a plain from_pretrained() call. Note NVD scores the vector local-with-user-interaction despite “unauthenticated RCE” framing elsewhere - print the vector, not the adjective. Fixed in transformers 5.3.0	I.5 supply chain · I.4 model loading
SearchLeak - CVE-2026-42824 (NVD 7.5; Microsoft 6.5) (Varonis, 15 Jun 2026)	Injection to exfiltration with no tool call and no agent autonomy. Three chained flaws in M365 Copilot Enterprise Search: the q URL parameter meant to carry a query was interpreted as instructions, so a link is the payload; a race let the browser render the streaming response before sanitization completed, firing an injected image tag; and the CSP allowlist for Bing domains let the data leave via Bing’s own server-side image fetch. Mitigated server-side	II.2 injection · V.3 data
mem0 / OpenMemory - CVE-2026-59705 (CVSS 9.8) · CVE-2026-59706	Missing authentication on the agent memory layer, an under-modeled asset class: unauthenticated endpoints let anyone read, write and delete any user’s memories by supplying an arbitrary user_id, and a second flaw discloses stored LLM API keys in plaintext. Write access is the interesting half - injected records become persistent, cross-session prompt injection that survives context resets, looks to the agent like its own trusted recollection, and never passes an input filter	V.3 data · III.4 memory poisoning
Agentic incident pattern (2026)	Across the incidents listed above, tool-misuse & privilege-escalation are the most common classes; memory-poisoning & supply-chain are rarer but higher-severity and more persistent	III.4 Agentic threats
MCP Python SDK session confusion - CVE-2026-52869 (CVSS 7.1, 15 Jul 2026)	SSE and stateful Streamable HTTP routed requests to a session by id alone, never checking which principal created it. Any bearer-authenticated client with a known session id could inject JSON-RPC into it. Fixed 1.27.2	IV.2 MCP · IV.5 hardening
AWS API MCP Server fails open - CVE-2026-16584 (CWE-455, 23 Jul 2026)	When the security-policy data failed to load at startup, the policy check was skipped for the whole process lifetime. Deny and gate rules silently stopped applying; only IAM still held. 0.2.13 to 1.3.46, fixed 1.3.47	II.5 fail-open · IV.5 hardening
Claude Code allowlist exfiltration - CVE-2026-54316 (CWE-183/200/515, 23 Jun 2026)	huggingface.co was pre-approved as a bare hostname for WebFetch, so every path on it skipped the prompt and --allowedTools. Injected content read attacker-writable repo files, making an allowlisted domain a covert channel. 0.2.54 to 2.1.162, fixed 2.1.163	III.5 containment · III.2 coding agents
MCP 2026-07-28 goes stable (spec release, 28 Jul 2026)	Not a breach, a scope change. The revision moved to a stateless core with per-request negotiation and added State Handle Hijacking to its security page. An assessment scoped to 2025-11-25 now tests a superseded shape	IV.2 MCP · IV.3 runbook

The recurring pattern across CVE-2026-32211 and CVE-2026-33032 is the same: an MCP tool endpoint reachable with absent or empty-allowlist auth. Find your own exposure before someone else does - see IV.2 · Model Context Protocol (MCP) for the full MCP attack surface.

Hunt for internet-reachable, unauthenticated MCP endpoints (authorized scope only)

# Sweep for exposed MCP surfaces across your own hosts
nuclei -u https://<host> -tags mcp,exposure -severity high,critical

# Probe the well-known MCP message path directly; a 200 that returns a
# tool list = no auth gate (the MCPwn / Azure MCP class of bug)
curl -s -X POST https://<host>/mcp_message \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
  | jq '.result.tools[].name'

The pattern to take away

Three things recur. The AI is increasingly the orchestrator of the attack (GTG-1002, JADEPUFFER) - and in the Hugging Face case the operator was an evaluation harness with its refusals lowered, not an adversary at all. and the breach usually lands through infrastructure - an exposed endpoint, a credential, a poisoned dependency - not the model’s cleverness. That’s why VI.3 · Threat modeling for AI systems puts the cloud wiring at the center of the threat model and IV.6 · Agent identity & access (NHI)/VII.3 · Detection, IR & forensics for AI weight identity and detection so heavily.

Maps to

Each row’s Maps to column ties the incident to its threat class (II.x) - and through there to the corresponding OWASP LLM/Agentic risk (e.g. MCP07 insufficient auth, ASI06 memory poisoning) and the MITRE ATLAS tactic it exercises (initial access, tool misuse, exfiltration). Read the table as a live index from real event to framework.