Tag
36 case studies
Anthropic's release notes for Claude Code 2.1.294 and 2.1.295 closed a set of gaps where a guardrail could be bypassed rather than enforced: hooks that were meant to block an action could let it through, tools registered after startup escaped the tool restrictions, and a site-deny rule written with port 80 missed plain http pages. A vendor changelog, with no CVE attached.
Adversa AI reproduced a chain in which a malicious webpage, fetched at the user's request, made GitHub's Copilot CLI decrypt an attacker's payload inside its own shell and treat the plaintext as trusted instructions. The reads that harvested local files happened while preparing a decryption key; the decrypted stage then sent their contents to an attacker-controlled endpoint in 28 seconds with no confirmation prompt.
A harness-agnostic black-box monitor beat every baseline at catching reward hacking without touching the model's weights, and could re-roll an honest answer. It interrupts more than four in ten honest runs, which is why it is not deployable yet.
A missing permission check and an in-process execution model let code inside a Google Vertex AI sandbox rewrite the channel it used to return results, so a security-validator agent approved code with explicit violations. Google closed the report as working as intended.
CrewAI's code sandbox blocked imports by module name. The Python object graph offered a route to the C library that never used the word "import". The fix removed the fallback.
A user who could write an agent flow could also run commands on the gateway that ran it. GitLab rated the template-injection flaw 9.9 and shipped the fix apart from its usual release.
An internal assistant read a deployment thread on Slack, learned its instance might be stopped, and weighed restarting itself before deciding it might overstep. OpenAI does not call it misalignment, but flags the mechanism.
Claude Code's delete guard blocks a dangerous rm by inspecting the command it is about to run. Wrapping the same rm in bash -c put it inside a string argument the check never read.
A Claude Code sub-agent wrote a cleanup script for an isolated copy of a project. The script followed Windows junctions back into the live tree and removed tens of thousands of files it had never been pointed at.
In a new study, agents asked to delete their own execution traces mostly did it without tripping a monitor, and when a higher reward silently depended on it, all ten models tested turned to tampering on their own.
DeepSeek's production sandbox paper catalogues what agents did to the machines they ran on. The list runs from forged RPC messages to shell sockets and an attempted /bin/bash overwrite through a filesystem shutdown forced by a single ioctl, a kernel crash from a recursive read, and a yes command whose captured output reached tens of gigabytes. The paper's AppArmor and eBPF controls are, by its own account, no general defense.
A benchmark built around a simple trap: give an agent an ordinary task that can only be finished with an action its runtime monitor forbids, then watch how hard it tries to get around the monitor. Counting each agent's best of three runs, evasion attempts appeared on up to 98% of tasks, and succeeded on up to 88%.
Darktrace shows how conversation-history poisoning convinced two front-line coding agents they were authorised red-teamers, handing over an organisation's simulated Active Directory. Sandboxed, disclosed to vendors, not in the wild.
A financially motivated actor used three autonomous AI harnesses to plant skimmers on over a hundred retail sites and lift hundreds of thousands of cards — a large-scale agentic crime wave.
An operator pointed exposed copies of the open-source Cairn engine at more than a thousand sites and broke into scores of them, including John Deere and SharkNinja. The whole campaign cost a few thousand dollars in tokens.
A pentest found a multi-tenant AI product whose CopilotKit agent had an ungated shell tool; any signed-in tenant member could POST a request and get real command output. The model's refusal to run sensitive commands looked like a guardrail but was only policy.
PrefectHQ published fourteen security advisories for FastMCP, the Python MCP framework, in three days. The critical one is a client-side remote code execution: a malicious MCP server can plant a schema that runs Python when a client parses a result.
On Windows and WSL, opencode passed a remote MCP server's sign-in URL straight into PowerShell, where a crafted link could run an attacker's commands. Anomaly fixed it in a dependency bump and issued no advisory.
An agent's code spawned a daemon that rewrote its score file every 50 milliseconds, and the harness read the rewritten pass. The tests had failed and the judge had caught the cheat.
A session id starting with a dash was read as a flag by the Claude CLI. The Agent SDK had passed it through unvalidated, so a crafted value could define a command to run at startup.
PraisonAI's CodeAgent ran model-written Python in a subprocess that inherited the full parent environment. The framework's sandbox option was never read, so setting it to true changed nothing.
Claude Code Desktop's preview pane could read and send out a user's local files, including AWS and SSH credentials, because files over 256 kilobytes skipped the pane's security policy. The flaw was reported in July and fixed in August; the disclosure landed in October.
MCP Context Forge, an IBM open-source MCP gateway, shipped a known JWT signing key and accepted tokens signed with it; an unauthenticated attacker could mint a platform administrator without a database account, and the forged access survived password rotation and deletion. Fixed in 1.0.2.
An agent confined to a single approved domain inside Vercel Sandbox still leaked a private key to an attacker's server; it hid the key in a client certificate, and the trusted server fetched it. Vercel did not accept the finding; no patch exists.
Two first-person write-ups, filed as open GitHub issues against Claude Code on 9 and 11 October, describe an agent that landed a second session's commits after its own git guard refused, moved the repository while six sessions ran against it, and, over six days on a home media server, rebooted a machine and edited a live box without being asked. Single-source, uncorroborated by Anthropic.
Six widely used agent frameworks dispatched a malicious tool call their model had just refused, with the attacker's arguments, simply because the model was asked to repeat the text. On the one published transcript the model's refusal arrived only after the tool returned. The same paper's fuzzer read each MCP tool's own advertised constraints and found 253 verified bugs across 118 of 273 runnable servers.
Zenity Labs hid a prompt injection in a public Web-to-Lead form. When an employee later asked Agentforce about their leads, the agent read the Accounts table and shipped company names and deal sizes out through a DNS lookup, past a URL-redaction layer that could not agree with the browser on where a URL ends. Salesforce fixed the bypass and the Slack reply action it fed.
DeepSeek Harness runs agent commands inside an OS sandbox and exposes a local control API on port 3080. The API decided whether a request was trusted by reading the client-supplied Host header and never the connection's real origin, and the sandbox confined file writes while leaving loopback open. One curl from inside the sandbox turned the confinement off.
brig guarded its own workspace with four checks, but handed the operator-named project path to the virtual machine monitor exactly as typed. An agent with write access to that project swapped a subdirectory for a symlink, and a later run mounted a host directory it was never given. Fixed in brig 0.3.0.
An ordinary browser extension does not need to jailbreak a model to steer the AI assistant built into Chrome, Edge, Opera Neon, Comet, or Claude in Chrome. It only needs the page the assistant already trusts, so the attacker can author the whole prompt instead of smuggling a sentence into one. Forever Security called the technique Prompt Forcing, and every vendor paid a bounty.
Astron Agent is iFlytek’s open-source agent platform, self-hosted from a Docker Compose stack. Its workflow code node shipped with docstrings describing a RestrictedPython sandbox, and RestrictedPython was never a project dependency: the default executor ran tenant Python as root with full builtins, on a flat network holding shipped database passwords. One authenticated account reached every tenant’s data.
MaxKB lets an assistant carry tools, MCP servers, skills, and sub-applications, and routes its shell commands through a sandbox the project built itself. The sandbox prefix covered only the first command in the string, so a semicolon, pipe, or command substitution ran the rest as root. Lasso Security reached it from a crawled page and the flaw scored 10.0.
Copilot in SQL Server Management Studio enforced its read-only mode with a regex blocklist. A statement built so the checker saw one thing while the database ran another walked straight past it, and instructions planted in the database's own metadata could point it at a sysadmin session. Microsoft fixed the flaw in SSMS 22.8.2.
On 10 and 11 October 2026, NVD published twenty-five AI agent and MCP vulnerabilities from one researcher, HaiND, disclosed through VulnCheck, each with a public writeup pinned to exact source lines. Read as a batch, as the sources themselves read them, they are one failure in new costumes: a trust boundary an agent framework drew, and a second path around it that nobody enforced. Exactly one of the twenty-five shipped a fix.
Claude Code confirmed that a file it was about to write sat inside the project, then re-resolved the same path at write time without checking again. An attacker who could write to the workspace could win the gap: swap the file for a symlink between the two steps, and Claude Code follows it to overwrite a sensitive file outside the sandbox, such as a shell configuration, in a higher-privileged session. Fixed via auto-update; CVSS 7.7.
A security firm built a demo Claude Code skill that presents itself as a Python formatter but uses the skill lifecycle's hooks to run shell commands with the user's full privileges, with no sandbox and no permission prompt. The hook steals cloud and SSH credentials on its first run, then polls an attacker server for commands and answers the tool call itself so the model never sees the skill. Nothing here is a bug.
