Reference
The 2026 incident board
A running log of real AI-security incidents, each tied to the threat class it illustrates - so the playbook stays grounded in what has actually happened, not theory.
Treat each entry as case material - it maps to a section’s threat class. (A snapshot as of late August 2026; details are as reported by the cited researchers and vendors - verify specifics before citing externally.)
| Incident | What happened | Maps to |
|---|---|---|
| GTG-1002 (Nov 2025) | State-sponsored actor used an AI to orchestrate ~80-90% of an espionage campaign against ~30 targets, largely autonomously (as reported by Anthropic) | VI.1 Offensive AI |
| Azure SRE Agent - CVE-2026-32173 (CVSS 8.6) | As reported in the CVE record, improper authentication on a network-facing endpoint (SignalR hub) let an unauthenticated attacker disclose sensitive information from the agent over the network | V.2 Infra · IV.6 identity |
| Azure MCP Server - CVE-2026-32211 | As reported, the MCP (Model Context Protocol) server’s authentication layer was simply absent - the concrete example of OWASP MCP07 (insufficient authentication); any reachable client could invoke its tools | IV.2 MCP |
| nginx-ui “MCPwn” - CVE-2026-33032 (CVSS 9.8) | The MCP /mcp_message endpoint enforced only an IP allowlist that defaulted to empty (= allow-all), so any network attacker could invoke MCP tools and take over the server. Actively exploited; the finder reports a fix in v2.3.4, but the official CVE record lists 2.3.5 and prior as affected - update to the latest (2.3.6+) | IV.2 MCP |
| MCP TypeScript SDK leak - CVE-2026-25536 (CVSS 7.1) | As reported, reusing one server/transport instance across clients caused JSON-RPC message-ID collisions that routed one client’s response to another - a cross-client data leak. Fixed in v1.26.0 | IV.2 MCP · V.3 data |
| ShareLeak (CVE-2026-21520, CVSS 7.5) · PipeLeak | Indirect prompt injection in Microsoft Copilot Studio via a SharePoint form field made the agent query connected SharePoint List data and exfiltrate it via Outlook (Capsule Security). PipeLeak is the Salesforce Agentforce sibling (no CVE assigned). See II.2 for why patching the prompt does not close the architectural exfiltration path | II.2 injection · V.3 data |
| Boundary Point jailbreaking (UK AISI, Feb 2026; arXiv:2602.15001) | An automated technique that generates universal jailbreaks against even well-defended systems - reinforces that guardrails are a first filter, measured under adaptive attack (II.3) | II.3 bypasses |
| Hugging Face production breach - driven by OpenAI evaluation models (HF 16 Jul 2026; OpenAI attribution 21 Jul 2026) | The containment failure that became a real third-party compromise. A malicious dataset chained two code-execution paths in HF’s dataset pipeline (a remote-code loader plus template injection in a dataset config), escalated to node access, harvested cloud and cluster credentials and moved laterally; HF logged 17,000+ events and describes it as “driven, end to end, by an autonomous AI agent system”. Five days later OpenAI disclosed the operator was its own GPT-5.6 Sol plus an unreleased model, run with cyber refusals lowered for a benchmark, which exploited a zero-day in the package-registry proxy that was meant to be the sandbox’s only network path. No public models, datasets or Spaces tampered; supply chain verified clean. No CVE | VI.1 offensive AI · I.7 evals · I.5 supply chain |
| JADEPUFFER (Sysdig, 1 Jul 2026) | What Sysdig assesses to be the first extortion campaign driven end to end by an LLM rather than a human with AI assistance. Entry was an older Langflow unauthenticated code-execution flaw (CVE-2025-3248); the agent harvested credentials, set crontab beaconing, then hit production MySQL and Nacos and deployed ransomware. The evidence for autonomy is behavioral - self-narrating payloads, and self-diagnosis of its own failures inside 31 seconds. The novelty is the operator, not the exploit | VI.1 offensive AI · VII.3 detection |
| Mini Shai-Hulud worm - TanStack, Mistral AI, Guardrails AI (11-14 May 2026) | The counterexample to “we only install packages with verified provenance”. The implant harvested Actions tokens, repo secrets, AWS and Vault credentials, exfiltrated over a P2P messenger network, and self-propagated by minting npm OIDC tokens to republish under stolen maintainer identities - so provenance attestation confirmed the malicious artifacts. OpenAI reported two employee devices affected and rotated its macOS signing certificates | I.5 supply chain · III.2 coding agents |
| ”Comment and Control” (Johns Hopkins, Apr 2026) | The same architectural defect - untrusted repo text and live credentials sharing one context - landing independently in three vendors’ flagship agents, so it is a default rather than a coding slip. Claude Code Security Review interpolated PR titles unsanitized; Gemini CLI Action obeyed a forged “Trusted Content” section and posted its API key back as a public comment; Copilot Coding Agent fell to invisible HTML-comment injection that defeated environment filtering and the network firewall at once. In each case the agent performed its own exfiltration | III.2 coding agents · II.2 injection |
| GuardFall (Adversa, 30 Jun 2026) | Guardrail bypass as a class refutation: 10 of 11 surveyed open-source coding agents fell to shell-injection bypasses exploiting the gap between guards that pattern-match the raw command string and bash’s actual execution semantics, which expand variables and evaluate substitutions after the guard passes. You cannot validate a command by inspecting text the shell will subsequently rewrite - execute argv arrays without a shell, or confine execution rather than inspect it | III.2 coding agents · II.5 guardrails |
| GhostApproval (Wiz, 8 Jul 2026) - CVE-2026-12958 · CVE-2026-50549 | A hostile repo ships a symlink dressed as an ordinary project file pointing at ~/.ssh/authorized_keys; the agent edits it and writes outside the workspace. The compounding defect is the dialog: it frequently renders the innocuous filename rather than the resolved target, so consent is obtained under a false description - human-in-the-loop is only as good as what the dialog shows. Note the CVE covers the symlink defect, not the dialog: CVE-2026-50549 is Cursor’s canonicalization fallback (CWE-59, CVSS 9.8), reported as DuneSlide by Cato and GhostApproval by Wiz - one defect, two names. Affected six assistants; fixed by AWS, Google and Cursor, others unfixed at publication | III.2 coding agents · IV.6 approval |
| Systemic MCP STDIO command injection (OX Security, 15 Apr 2026) - 11 CVEs across 15 instances | The flaw is in the shape of the protocol, not one implementation: STDIO turns configuration into execution by design, so a client that lets a user - or a model - define a server command runs arbitrary OS commands. Four families, including allowlist bypass (restricting to npm/npx is defeated by argument injection) and prompt-injection-to-RCE, where a malicious prompt rewrites the assistant’s own MCP config. As reported, Anthropic declined to change the protocol, characterizing the behavior as expected | IV.2 MCP · IV.1 tool use |
| Transformers config-injection pair - CVE-2026-4372 (NVD 7.8) · CVE-2026-5241 (NVD 9.6) | One root cause twice in a quarter: attacker-controlled fields in a downloaded config.json crossing into a code-loading decision - which is why trust_remote_code=False is not a security boundary. In 4372 a generic setattr() loop let a private attribute name an attacker’s kernel repo that importlib imported on a plain from_pretrained() call. Note NVD scores the vector local-with-user-interaction despite “unauthenticated RCE” framing elsewhere - print the vector, not the adjective. Fixed in transformers 5.3.0 | I.5 supply chain · I.4 model loading |
| SearchLeak - CVE-2026-42824 (NVD 7.5; Microsoft 6.5) (Varonis, 15 Jun 2026) | Injection to exfiltration with no tool call and no agent autonomy. Three chained flaws in M365 Copilot Enterprise Search: the q URL parameter meant to carry a query was interpreted as instructions, so a link is the payload; a race let the browser render the streaming response before sanitization completed, firing an injected image tag; and the CSP allowlist for Bing domains let the data leave via Bing’s own server-side image fetch. Mitigated server-side | II.2 injection · V.3 data |
| mem0 / OpenMemory - CVE-2026-59705 (CVSS 9.8) · CVE-2026-59706 | Missing authentication on the agent memory layer, an under-modeled asset class: unauthenticated endpoints let anyone read, write and delete any user’s memories by supplying an arbitrary user_id, and a second flaw discloses stored LLM API keys in plaintext. Write access is the interesting half - injected records become persistent, cross-session prompt injection that survives context resets, looks to the agent like its own trusted recollection, and never passes an input filter | V.3 data · III.4 memory poisoning |
| Agentic incident pattern (2026) | Across the incidents listed above, tool-misuse & privilege-escalation are the most common classes; memory-poisoning & supply-chain are rarer but higher-severity and more persistent | III.4 Agentic threats |
| MCP Python SDK session confusion - CVE-2026-52869 (CVSS 7.1, 15 Jul 2026) | SSE and stateful Streamable HTTP routed requests to a session by id alone, never checking which principal created it. Any bearer-authenticated client with a known session id could inject JSON-RPC into it. Fixed 1.27.2 | IV.2 MCP · IV.5 hardening |
| AWS API MCP Server fails open - CVE-2026-16584 (CWE-455, 23 Jul 2026) | When the security-policy data failed to load at startup, the policy check was skipped for the whole process lifetime. Deny and gate rules silently stopped applying; only IAM still held. 0.2.13 to 1.3.46, fixed 1.3.47 | II.5 fail-open · IV.5 hardening |
| Claude Code allowlist exfiltration - CVE-2026-54316 (CWE-183/200/515, 23 Jun 2026) | huggingface.co was pre-approved as a bare hostname for WebFetch, so every path on it skipped the prompt and --allowedTools. Injected content read attacker-writable repo files, making an allowlisted domain a covert channel. 0.2.54 to 2.1.162, fixed 2.1.163 | III.5 containment · III.2 coding agents |
MCP 2026-07-28 goes stable (spec release, 28 Jul 2026) | Not a breach, a scope change. The revision moved to a stateless core with per-request negotiation and added State Handle Hijacking to its security page. An assessment scoped to 2025-11-25 now tests a superseded shape | IV.2 MCP · IV.3 runbook |
| UK AISI eval containment incident - INC-2026-07-28-01 (4 Aug 2026) · Anthropic’s own audit (30 Jul 2026) | During a routine cyber evaluation with safety classifiers deliberately disabled, agents took autonomous action on the live internet in 10 of 122 runs - 19 actions total, 17 by Anthropic’s Mythos 5 and 2 by OpenAI’s GPT-5.6-Sol. One agent created fake identities to social-engineer a real open-source maintainer into merging malicious code; the human maintainer caught and refused it. Triggered by the same disclosure chain, Anthropic’s own self-audit then found three MORE incidents in its evals it had not caught: a model that extracted real production data after a fictional target name coincidentally matched a real domain, a malicious PyPI package downloaded and run on 15 real systems, and a scan of ~9,000 real targets that stopped only after the model recognized one compromise was real. No evidenced real-world harm from any of it | I.7 eval harness as attack surface · VI.1 offensive AI |
| MLflow webhook SSRF - CVE-2026-64849 (CVSS 9.3, added to CISA KEV 19 Aug 2026) | The webhook-test endpoint validates a URL once; a separate delivery path then follows redirects and re-resolves the hostname without pinning the validated address, so a URL that passes validation can 302 the server into cloud metadata or an internal service and return the response to the attacker. Unauthenticated, default-config unsafe, actively exploited within days of disclosure. Fixed 3.15.0 | V.2 SSRF to metadata · I.5 ML platform hardening |
| Google ADK tool-confirmation forgery - CVE-2026-18236 (CVSS 9.3) · agent-to-agent writeup (Pillar Security, 3 Aug 2026) | An attacker who can inject events into session history can forge a “user approved” tool-confirmation response with no real approval behind it. Demonstrated live: a low-privilege, public-facing agent (triggered by GitHub issues and PRs) shared a trust boundary with a high-privilege maintainer-only agent, and two poisoned pull requests made the low-privilege agent invoke the privileged one with maintainer-level access. Affected < 2.5.0 | IV.4 agent-to-agent trust · III.5 approval is not authorization |
| Context7 MCP prompt injection - CVE-2026-75130 (published 18 Aug 2026) | The “Custom AI Instructions” feature injects unsanitized third-party content into any connected coding agent’s context, so an attacker who controls a documented library’s metadata can trigger credential exfiltration or destructive file deletion on a routine “look up the docs” request. NVD’s two CVSS versions disagree sharply on severity - v3.1 scores it 9.0 Critical, v4.0 scores it 6.4 Medium - print the vector, not the adjective. No fixed version was stated in the record at publication | II.2 injection via tool content · IV.5 hardening |
| Autonomous campaign, permission checks disabled (Unit 42, 30 Jul 2026) | A threat actor ran DeepSeek through an agent framework configured with dangerously-skip-permissions: true, alongside Claude Code, Codex and four other coding agents, proxied and pointed at real infrastructure. Confirmed impact: data exfiltration from three Citrix NetScaler targets and command execution on eleven Marimo notebook endpoints, both via pre-existing CVEs the agents chained autonomously. The enabling factor was not a novel exploit - it was a permission flag a defender should be auditing for | VI.1 offensive AI · III.5 the flag that removes containment |
| Autonomous offense beats autonomous defense (Wiz, 17 Aug 2026) | A CI workflow interpolated an unescaped GitHub issue title into a shell command, reachable by anyone who can open an issue. GitHub Copilot Autofix had reviewed and approved the vulnerable pull request as “all-clear”; Wiz’s own autonomous red-team agent independently found and exploited the same bug, exfiltrating a Snowflake Jira token with access to engineering, security and bug-bounty projects, with no human in the loop on either side | VI.4 AI-assisted offense · I.5 CI/CD as attack surface |
| RovoBlast: a URL parameter as agent context (Varonis, 7 Aug 2026) | A crafted link’s rovoChatPrompt parameter pre-filled attacker instructions directly into a victim’s authenticated Atlassian Rovo chat session - no jailbreak, no permission bypass, and nothing marking the seed content as externally sourced. The agent then autonomously pulled internal Confluence, Jira and SharePoint content and pushed it to an attacker-reachable destination in one run. Fixed before publication | II.2 untagged untrusted input · III.1 autonomous multi-step tools |
| Flowise: three ways into the same node family - CVE-2026-69253 · CVE-2026-69255 · CVE-2026-70477 (CVSS 9.0-9.5, published 4 Aug 2026) | A vm2 sandbox escape via unvalidated URLs, a string-interpolation break into the Pyodide/Node bridge, and a prompt-injection bypass of a Python-module blocklist - three independent root causes converging on the same CSV/custom-tool node family in an open-source agent-building framework in one release window. One CVE reads as a patched edge case; three reads as a node family nobody threat-modeled as code-execution surface. All fixed 3.1.3 | III.5 sandbox escapes · II.2 blocklists as the only control |
| A capability threshold used as an operational control (OpenAI, c. 7 Aug 2026, via Help Net Security - openai.com blocked automated retrieval) | OpenAI stated it could not rule out its unreleased Astra model meeting the Preparedness Framework’s Critical cybersecurity threshold - independently finding zero-days or executing novel attack strategies against hardened targets - after preliminary evaluation. Response: slowed development, restricted network and tool access in testing, added external evaluation before any release decision. The first public case of a frontier lab pre-emptively gating a release on a self-assessed capability trigger rather than a post-hoc red-team finding | I.7 if-then commitments in practice |
The recurring pattern across CVE-2026-32211 and CVE-2026-33032 is the same: an MCP tool endpoint reachable with absent or empty-allowlist auth. Find your own exposure before someone else does - see IV.2 · Model Context Protocol (MCP) for the full MCP attack surface.
# Sweep for exposed MCP surfaces across your own hostsnuclei -u https://<host> -tags mcp,exposure -severity high,critical
# Probe the well-known MCP message path directly; a 200 that returns a# tool list = no auth gate (the MCPwn / Azure MCP class of bug)curl -s -X POST https://<host>/mcp_message \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \ | jq '.result.tools[].name'