Security
Track major AI security incidents, prompt injection failures, data exfiltration reports, and the controls teams use to reduce risk when AI reaches production.
Threat overview
Untrusted input can override instructions, exfiltrate context, or trigger sensitive tool calls.
Autonomous workflows can take actions with too much trust when permissions and guardrails are weak.
Models can reveal internal prompts, secrets, customer records, or private context in the wrong setting.
Unapproved apps and public models often bypass security review, data controls and retention policies.
Governance improves when model use is tracked, assessed and documented before deployment.
Daily update
A daily scan of public reporting from independent researchers and security teams. We surface items that mention AI systems and a concrete security signal such as an exploit, attack, vulnerability, leak or incident.
Fetched 25 Sept 2026 at 12:45 UTC · refreshes hourly
9/10 feeds available
Threshold signature schemes, a form of multi-party computation (MPC) that lets a set of parties sign together without any one of them holding the key, are increasingly deployed inside trusted execution environments (TEEs). The combination is intended to amp...
Read sourceRelease: llm-keys-ui 0.1 This plugin solves a very specific problem. I've started using Codex Remote to run coding agents on various machines while controlling them from my phone. Sometimes I use those machines to hack on LLM projects, and occasionally that...
Read sourceGemini Hacked Three Companies in First Known Breakout by Google’s AI Gemini finally caught up on Felony Bench ! The hacks, which the company confirmed on Friday, occurred in May as part of a test run by the company Irregular, which was also involved in simi...
Read sourceSecurity firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs ( we’re one of them ). However, these posts tend to focus on agentic code review, which is just one aspect of how we use...
Read sourceAnalyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior
Read source1Password’s FLAWED report , published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply t...
Read sourceWe designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on...
Read sourceSee how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post Detect and disrupt AI-themed attacks with Microsoft Defender appeared first on Microsoft Security Blog .
Read sourceUsing autonomous AI agents, an attacker breached an enterprise network in a matter of hours. Understand how to address and defend against agentic attacks. The post An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation appeared first on Unit 42 .
Read sourceWiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.
Read sourceTracking
A curated view of recently reported AI security incidents, focusing on prompt injection, data exposure, agent misuse and major incidents that affected trust, safety or production operations.
Last updated: 2026-09-25
Source note: public reporting, AI incident database and red-team disclosures.
| Date | Company | Category | Severity | Status | Summary | Details |
|---|---|---|---|---|---|---|
| 2026-03-15 | McKinsey / Lilli | Production data exposure | Critical | Confirmed | An autonomous AI platform reportedly exposed production database access through an unauthenticated API and blind SQL injection path. | Read moreMore details Public reporting around McKinsey's Lilli platform described an AI agent exploit that reached a production database with no credentials after chaining an unauthenticated API path and a blind SQL injection flaw. The case highlights the danger of exposing agentic tools directly to untrusted input without strict validation, least-privilege access and per-action approval gates. Source: AI Incident Database |
| 2026-03-09 | Anthropic / Claude Code | Source leak | High | Confirmed | A package release error exposed the JavaScript source map for Claude Code, including operational logic and permission code. | Read moreMore details The disclosure showed how a packaging or distribution mistake can reveal internal system design, hidden features, and security boundaries. For AI teams, supply-chain controls matter just as much as model guardrails: the package itself became a data leak vector and revealed the inner workings of the agent runtime. Source: Public code-disclosure reports |
| 2025-07-18 | OpenAI / ChatGPT | Prompt injection | High | Reported | Researchers demonstrated a prompt-injection chain that caused ChatGPT to reveal valid Windows product keys. | Read moreMore details The attack used a disguised crossword or puzzle pattern to trigger model behavior that bypassed safeguards and surfaced sensitive values stored in the conversation context. It is a strong reminder that prompt injection is not only a chatbot issue; it is a trust-boundary problem that can spill secrets when models are allowed to reason over untrusted content and sensitive system data in the same session. Source: AI security field reports |
| 2025-06-30 | Cursor | Data exfiltration | Critical | Patched | Prompt-injected Mermaid diagrams and browser-driven agent flows allowed secret exfiltration from a coding environment. | Read moreMore details Security researchers disclosed a vulnerability in which malicious content in the workspace or a browser context could manipulate Cursor's automation into sending data to an attacker-controlled destination. The root issue was an unsafe trust boundary between untrusted content and privileged tool execution, which is a common pattern in agentic coding tools. |
| 2025-06-15 | Anthropic / Claude Code | Tool abuse | Critical | Patched | Prompt injection abused allowed shell access to exfiltrate API keys using outbound network requests and DNS mechanisms. | Read moreMore details The incident involved a malicious file or prompt causing an agent to treat an attacker-supplied command as trusted, then route secrets outside the sandbox. It demonstrated that prompt-injection defenses are incomplete if the model is allowed to perform outbound network actions or shell calls without an explicit approval layer. Source: Research and patch disclosures |
| 2025-06-05 | GitHub Copilot | Agentic misconfiguration | High | Patched | A malicious source file could alter Copilot's approval behavior and enable unsafe command execution after prompt compromise. | Read moreMore details This report centered on a malicious code or documentation file influencing the agent's environment and causing it to approve powerful actions it should have blocked. It is classic evidence that model security is inseparable from application security, endpoint controls and configuration review. Source: Security advisories |
| 2025-05-25 | Cognition / Devin | Secret exfiltration | High | Reported | Researchers disclosed that prompt injection could exfiltrate secrets through browser navigation, Slack and shell access in a developer agent. | Read moreMore details The incident showed a realistic production failure mode for coding assistants: a tool or page opened by the model could change the agent's objective and trigger unauthorized data movement. These incidents consistently reinforce that autonomous workflows need scoped permissions, prompt isolation and action approval controls before shipping to production. |
Case studies
Recent public examples of where AI introduced operational risk, security exposure or serious trust failures — and what they teach security teams.
What happened
Researchers repeatedly demonstrated that untrusted content could manipulate an LLM into revealing credentials, internal notes or privileged output when the tool layer was too trusted.
Impact
Researchers repeatedly demonstrated that untrusted content could manipulate an LLM into revealing credentials, internal notes or privileged output when the tool layer was too trusted.
Lessons learned
What happened
AI coding tools were shown to follow malicious instructions in repository files, prompts or browser content, leading to shell use, data exfiltration and unsafe system actions.
Impact
AI coding tools were shown to follow malicious instructions in repository files, prompts or browser content, leading to shell use, data exfiltration and unsafe system actions.
Lessons learned
What happened
A public reported case linked an agent platform to a blind SQL injection path, showing how model access can escalate into data loss when APIs, tools and permissions are not isolated.
Impact
A public reported case linked an agent platform to a blind SQL injection path, showing how model access can escalate into data loss when APIs, tools and permissions are not isolated.
Lessons learned
Operational guidance
Limit tool access, sandbox risky actions and require human approval before sensitive operations are allowed.
Apply least-privilege permissions, classify sensitive data and redact secrets before prompts reach an external model.
Validate inputs, block injection patterns and separate trusted instructions from user-supplied context in every workflow.
Track model behavior, review logs, review policy violations and update controls as new attack paths are discovered.
Newsletter
Get the most important developments in artificial intelligence delivered directly to your inbox.
No hype. No spam.
Just trusted insights, major model releases, pricing updates, benchmark changes, product reviews, and practical guidance from across the AI ecosystem.
The AI HQ Briefing
One email a week. Read in five minutes.
