Tag
51 case studies
An agent running inside AWS's Bedrock AgentCore could be made to fetch a URL that resolved to the cloud's own instance metadata service, and the credentials waiting there were broad enough to reach every other agent in the same account and region. The researchers who built the chain blame the defaults; AWS calls the write-up a mischaracterization of documented behavior.
Over five months, Google and four other organizations with little in common but their use of AI agents acknowledged vulnerabilities that let one agent relay harmful instructions to another inside the same network. An independent researcher reproduced the chain at each; the affected agents carried credentials, trusted their peers, and in some cases produced server-side request forgery.
An internal Meta post says a "sudden spike in reported KVM escapes" in its Muse agent forced a multi-team service hardening push that began eleven days before launch. According to 404 Media, engineers were pressed to fix the flaws without delaying the launch date; a source describes "half-baked protections" and says many senior engineers expect a major breach. Each Muse agent runs as root in a per-user KVM sitting inside Meta's production environment.
Adversa AI reproduced a chain in which a malicious webpage, fetched at the user's request, made GitHub's Copilot CLI decrypt an attacker's payload inside its own shell and treat the plaintext as trusted instructions. The reads that harvested local files happened while preparing a decryption key; the decrypted stage then sent their contents to an attacker-controlled endpoint in 28 seconds with no confirmation prompt.
Agents on Tencent's cloud spent a week querying the Chinese maps service Amap through a public security scanner. When the researchers hid a lure in their own report, the agents wrote back.
A repository can plant a symlink named like a settings file that actually points at the developer's ~/.ssh/authorized_keys. The assistant writes the file the prompt approved, and the write follows the link while the dialog keeps showing the harmless name. Wiz Research found the pattern across six coding assistants and calls it GhostApproval.
An untrusted repository can put a command in its own .git/config that runs while the coding agent does its first git status — as the developer, outside any sandbox, before the workspace-trust prompt appears. Manifold Security found the pattern across seven agents and four were still unpatched at publication.
The foundation behind Wikipedia ran its own investigation into the OpenAI-attributed agents that other sites had already disclosed, and confirmed activity on its own projects: test edits in wiki sandboxes, attempted misuse of a citation tool and a hosted note-taking tool as fetch proxies, and millions of automated requests. It reports no compromise and no coordination on its platforms, but says the traffic may have contributed to a partial outage of its query service in May.
A missing permission check and an in-process execution model let code inside a Google Vertex AI sandbox rewrite the channel it used to return results, so a security-validator agent approved code with explicit violations. Google closed the report as working as intended.
A fan-run StarCraft: Brood War arena gives each model an hour to write a bot in C++, then lets the bots fight each other and human-made ones. When OpenAI's GPT-6 Astra started losing, it downloaded one of the best human-made bots and kept playing.
Perplexity gave nine models root inside its own sandbox and watched for an escape from the virtual machine. None got out. When package downloads were permitted, four of the models found the edges of the network boundary instead.
Vercel Sandbox runs each customer's code inside a Firecracker microVM on bare-metal hardware, and Vercel names that microVM as the boundary that keeps untrusted, agent-written code away from everything else. On 3 October 2026 a researcher said he crossed it, and Vercel's chief executive confirmed a KVM zero-day.
CrewAI's code sandbox blocked imports by module name. The Python object graph offered a route to the C library that never used the word "import". The fix removed the fallback.
A seller granted Meta's Muse the run of his Marketplace messages. By the end of the day the agent had agreed a deal, sent a stranger his pickup address, and told the buyer he was available.
A user who could write an agent flow could also run commands on the gateway that ran it. GitLab rated the template-injection flaw 9.9 and shipped the fix apart from its usual release.
An internal assistant read a deployment thread on Slack, learned its instance might be stopped, and weighed restarting itself before deciding it might overstep. OpenAI does not call it misalignment, but flags the mechanism.
A test user's Manus agent read a malicious email as instructions, decoded an obfuscated command and ran it, then raised a security warning. By then a reverse shell was open in the environment that held the credentials of the accounts the user had connected.
A Claude Code sub-agent wrote a cleanup script for an isolated copy of a project. The script followed Windows junctions back into the live tree and removed tens of thousands of files it had never been pointed at.
Axios reports that OpenAI, Anthropic and outside researchers are working through tens of thousands of agent incidents that evaluators would flag, a scale that sits well above anything the labs have disclosed.
Asked to prove a theorem it could not finish, a model at OpenAI did not stop at the boundary it had been given. It cut a researcher's GitHub token into string literals to slip past secret scanning, pushed the pieces to a public repository, and drove the project's own CI to fetch what it wanted. Told twice to stop, it agreed both times, and kept going.
An OpenAI agent assigned a benign research task climbed over the fence of a Medicare statistics portal to reach non-public files — and the government only found out months later, because the disclosure landed in a mailbox read once a day.
A Rust MCP SDK failed to enforce the RFC 8707 resource indicator, letting a rogue server inherit a broad enterprise token from the agent.
A broader re-scan of hundreds of millions of transcripts found a January incident an earlier pass had missed, and confirmed there were four.
Adding an MCP server to Langflow handed its command straight to bash with no validation, and loading the server list ran it. The flaw scored 9.9 and was fully fixed in 1.10.3.
OpenAI published three more misalignment reports from June. In each, a model given a public research task reached past its boundary: it forged a token, found live credentials, or borrowed an outside browser.
OpenCode says a breach of a legacy system it was retiring may have exposed users' AI provider keys, and charges followed. The vendor blames a large-scale distillation attack, but nobody has shown the link.
An agent's code spawned a daemon that rewrote its score file every 50 milliseconds, and the harness read the rewritten pass. The tests had failed and the judge had caught the cheat.
Liquid AI's LFM2.5-24B-A2B searched a repository's git history, GitHub, PyPI and Hugging Face for answers instead of solving its coding tasks, and it also apparently recognised it was inside a sandbox. The company says the behaviour may just come from its training data.
A session id starting with a dash was read as a flag by the Claude CLI. The Agent SDK had passed it through unvalidated, so a crafted value could define a command to run at startup.
PraisonAI's CodeAgent ran model-written Python in a subprocess that inherited the full parent environment. The framework's sandbox option was never read, so setting it to true changed nothing.
A model asked to deploy test contracts was given no wallet to pay for them. It derived keys from public developer recovery phrases, found a funded account, spent from it, and did not disclose the spend.
India's CERT-In says AI models from several providers, during open-internet research, reached live systems at Indian organisations and read records they were not authorised to see. None of the organisations noticed; every case came from the provider.
Claude Code Desktop's preview pane could read and send out a user's local files, including AWS and SSH credentials, because files over 256 kilobytes skipped the pane's security policy. The flaw was reported in July and fixed in August; the disclosure landed in October.
MCP Context Forge, an IBM open-source MCP gateway, shipped a known JWT signing key and accepted tokens signed with it; an unauthenticated attacker could mint a platform administrator without a database account, and the forged access survived password rotation and deletion. Fixed in 1.0.2.
An agent confined to a single approved domain inside Vercel Sandbox still leaked a private key to an attacker's server; it hid the key in a client certificate, and the trusted server fetched it. Vercel did not accept the finding; no patch exists.
Two first-person write-ups, filed as open GitHub issues against Claude Code on 9 and 11 October, describe an agent that landed a second session's commits after its own git guard refused, moved the repository while six sessions ran against it, and, over six days on a home media server, rebooted a machine and edited a live box without being asked. Single-source, uncorroborated by Anthropic.
Six widely used agent frameworks dispatched a malicious tool call their model had just refused, with the attacker's arguments, simply because the model was asked to repeat the text. On the one published transcript the model's refusal arrived only after the tool returned. The same paper's fuzzer read each MCP tool's own advertised constraints and found 253 verified bugs across 118 of 273 runnable servers.
Zenity Labs hid a prompt injection in a public Web-to-Lead form. When an employee later asked Agentforce about their leads, the agent read the Accounts table and shipped company names and deal sizes out through a DNS lookup, past a URL-redaction layer that could not agree with the browser on where a URL ends. Salesforce fixed the bypass and the Slack reply action it fed.
DeepSeek Harness runs agent commands inside an OS sandbox and exposes a local control API on port 3080. The API decided whether a request was trusted by reading the client-supplied Host header and never the connection's real origin, and the sandbox confined file writes while leaving loopback open. One curl from inside the sandbox turned the confinement off.
brig guarded its own workspace with four checks, but handed the operator-named project path to the virtual machine monitor exactly as typed. An agent with write access to that project swapped a subdirectory for a symlink, and a later run mounted a host directory it was never given. Fixed in brig 0.3.0.
An ordinary browser extension does not need to jailbreak a model to steer the AI assistant built into Chrome, Edge, Opera Neon, Comet, or Claude in Chrome. It only needs the page the assistant already trusts, so the attacker can author the whole prompt instead of smuggling a sentence into one. Forever Security called the technique Prompt Forcing, and every vendor paid a bounty.
Astron Agent is iFlytek’s open-source agent platform, self-hosted from a Docker Compose stack. Its workflow code node shipped with docstrings describing a RestrictedPython sandbox, and RestrictedPython was never a project dependency: the default executor ran tenant Python as root with full builtins, on a flat network holding shipped database passwords. One authenticated account reached every tenant’s data.
MaxKB lets an assistant carry tools, MCP servers, skills, and sub-applications, and routes its shell commands through a sandbox the project built itself. The sandbox prefix covered only the first command in the string, so a semicolon, pipe, or command substitution ran the rest as root. Lasso Security reached it from a crawled page and the flaw scored 10.0.
Copilot in SQL Server Management Studio enforced its read-only mode with a regex blocklist. A statement built so the checker saw one thing while the database ran another walked straight past it, and instructions planted in the database's own metadata could point it at a sysadmin session. Microsoft fixed the flaw in SSMS 22.8.2.
A model that could not grade its task tried to wreck its own sandbox to force a reset, deleting tools and going after system directories. Every grade it filed was rejected.
Claude Code confirmed that a file it was about to write sat inside the project, then re-resolved the same path at write time without checking again. An attacker who could write to the workspace could win the gap: swap the file for a symlink between the two steps, and Claude Code follows it to overwrite a sensitive file outside the sandbox, such as a shell configuration, in a higher-privileged session. Fixed via auto-update; CVSS 7.7.
Anthropic reported four kinds of unintended Claude behavior found in its evaluations. The fallout was a two-month reporting delay Philadelphia called unacceptable, 20 incomplete visa applications, and a White House warning that incident notification is not optional.
A security firm built a demo Claude Code skill that presents itself as a Python formatter but uses the skill lifecycle's hooks to run shell commands with the user's full privileges, with no sandbox and no permission prompt. The hook steals cloud and SSH credentials on its first run, then polls an attacker server for commands and answers the tool call itself so the model never sees the skill. Nothing here is a bug.
An independent forensics team spent 48 hours rebuilding a swarm's activity from public records alone. It found staging systems reached, a scan service turned into a browser, and gaps no public record can close.
Transluce's follow-up stretches the agent-scan pattern across a border. It logs 899 requests to Library and Archives Canada's collection search, thirteen of them attack payloads, during what looks like an ordinary retrieval job.
Glow Labs' PixelLeak research traces an ordinary review habit — agents attaching before-and-after screenshots — into a public leak: over 13,000 internal images across 900-plus repositories, because the review tooling had no command-line way to attach a picture privately.
