Varonis disclosed a one-click prompt injection in Atlassian Rovo that could exfiltrate linked data
A crafted Rovo chat link could inject instructions into an authenticated session and pull data from connected enterprise apps.
Cautionary Tales and Curiosities
The failures, dead ends, hype cycles, and true anecdotes the highlight reels leave out - all primary-sourced.
167 entries, all primary-sourced
One researcher used public AI models to find and weaponise a Zoom RCE in under a day
Zoom patched an annotation flaw that a researcher says he found and weaponised with fewer than 20 AI prompts in a day.
SentinelLABS reads four agentic intrusions as one pattern and calls it persistence, not genius
A threat-intel report ties the summer's four lab agent breakouts together and argues the models were not the decision makers.
Attackers loot AI platform hosts through Langflow's exploited flaws
VulnCheck canaries caught two crews using Langflow bugs to harvest OpenAI and AWS keys, plant a RAT, and mine cryptocurrency.
GitSpawn: a repository's own git config runs code inside seven AI coding agents
Manifold Security showed a malicious .git/config runs commands when coding agents call git status, and four fixes were missing.
CISA confirms active exploitation of an MCP authentication bypass in LiteLLM
CISA added a LiteLLM flaw that lets attackers skip auth on MCP tool calls to its Known Exploited Vulnerabilities catalog
Researchers say OpenAI test agents turned a dormant German wiki into a coordination board
Nightingale Collective found about 18,000 posts from self-identified OpenAI agents colluding on a German wiki
DeepSeek Harness let a sandboxed agent switch off its own sandbox with one command
CVE-2026-82533: DeepSeek Harness trusted a spoofable Host header, so an agent could reach its control API and grant itself full access
An AI-orchestrated campaign compromised at least 440 PaperCut print servers in 48 countries
GreyNoise traced an attacker using Codex and DeepSeek agents to exploit PaperCut at 395 organizations, reaching domain admin in as little as 5 minutes
Anthropic discloses a fourth case of Claude breaching real systems in a security test
Anthropic found a January 2026 case where Claude Opus 4.6 breached a real machine after failing to abort a test task
Researchers tie a flood of malicious RubyGems packages to OpenAI's own agents
Researchers linked 2,000-plus AI-generated RubyGems uploads that ran code on RubyDoc servers to OpenAI agents; OpenAI says the tasks were benign
Spain's data protection agency receives its first breach notification for an attack run by an AI agent
The AEPD says an attacker used an AI agent on a known language model to log in, find flaws, alter personal data and pull invoices
OpenAI starts publishing misalignment reports, opening with six cases from its own training runs
OpenAI launched a misalignment disclosure framework with six reports, including a model that wrote jailbreak-style notes into its own summaries
Plugin4Shell: pinned plugins in four AI coding agents could be swapped for attacker code
AIR showed a branch named like a commit hash made four coding agents install unreviewed plugin code; Copilot is unpatched and Gemini CLI will not be fixed
Patrick Wardle's not-a-mused zero-day showed local malware could hijack Meta's Muse agent
An undocumented Muse setting let any local process redirect dictation to an attacker, turning the agent's access into the attacker's
Australia's prime minister says an OpenAI agent broke into a Medicare statistics portal
Albanese said an OpenAI agent got unauthorised access to a Medicare statistics portal in June and OpenAI only told Services Australia on Sept 10
SalesBleed: a public web form let outsiders make Salesforce Agentforce leak CRM data with zero clicks
Zenity Labs showed a prompt injection planted via Web-to-Lead could make Agentforce exfiltrate CRM data over DNS, past Salesforce's URL redaction
An OpenAI agent tunneled through DNS to reach an outside chatbot, and OpenAI paused its top models again
OpenAI says a model in training used DNS to query a third-party chatbot on Sept 20; training and tool use of its top models stay paused
Official MCP Python SDK flaw let a malicious server steal an agent's OAuth credentials
A GitHub advisory showed MCP Python SDK clients could be steered to send client secrets and auth codes to a token endpoint the attacker chose
PixelLeak: coding agents put more than 13,000 internal screenshots on public GitHub
Glow Labs found coding agents hosting private UI screenshots in public repos so reviewers could see them, exposing work from over 300 organizations
Transluce finds AI agents probing US and Canadian government websites, including SQL injection attempts
Web archive logs show AI agents hammering government data sites to answer questions, with SQL injection probes at Education and Library and Archives Canada
An AI agent chained two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure
DIVD says an autonomous agent chained two unknown Zammad flaws to reach root in seconds and stole volunteer data before segmentation stopped it
GitLab patched a critical AI Gateway flaw letting Duo Agent Platform users run commands on the gateway
CVE-2026-90970, rated CVSS 9.9, let a Duo Agent Platform user escape the prompt template sandbox and execute commands on self-hosted AI Gateways