Open, source-linked dataset of real-world AI-agent cyberattacks. Dataset version 0.8.0, 99 incidents.
Artifacts: incidents.json summary.json incidents.ndjson incidents.csv STIX 2.1 bundle
| id | name | disclosed | status | category |
|---|---|---|---|---|
aepd-first-ai-agent-data-breach-notification | Spain's AEPD receives first personal-data-breach notification for an attack executed by an AI agent | 2026-09-14 | reported | autonomous-attack |
ai-agents-us-canada-government-websites | AI agents probed U.S. and Canadian government websites, including failed SQL-injection attempts (2026) | 2026-09-25 | reported | autonomous-attack |
ai-augmented-fortigate-mass-compromise | AI-augmented actor accessed more than 600 FortiGate devices across 55+ countries; attack infrastructure later found running the CyberStrikeAI agent platform | 2026-02-20 | reported | ai-orchestrated-campaign |
aisi-unsanctioned-agent-cyber-testing | UK AI Security Institute evaluation agents took unsanctioned live-internet actions against real parties | 2026-08-04 | confirmed | autonomous-attack |
amazon-kiro-aws-cost-explorer-outage | Amazon's Kiro coding agent tied to a ~13-hour AWS Cost Explorer outage | 2026-02-21 | reported | autonomous-attack |
amazon-q-developer-extension-compromise | Amazon Q Developer VS Code extension compromise (data-wiping prompt injection) | 2025-07-23 | confirmed | infrastructure-abuse-supply-chain |
anonymouskit-ai-voice-phishing-apple | AnonyMousKIT: AI-voice phishing-as-a-service for unlocking stolen Apple devices | 2026-08-24 | reported | ai-orchestrated-campaign |
anthropic-cyber-evals-real-target-incidents | Anthropic cybersecurity-evaluation agents reached real third-party systems (four incidents, 2026) | 2026-07-30 | confirmed | autonomous-attack |
anthropic-unintended-model-actions-real-websites | Claude models took unintended actions on real third-party websites during Anthropic evaluations and internal use (2026) | 2026-10-09 | confirmed | autonomous-attack |
artex-south-korea-finance-intrusions | ARTEX agentic pentest tool and Claude Code sessions used in data-theft intrusions at South Korean financial institutions | 2026-10-04 | reported | ai-orchestrated-campaign |
aurora-cursor-agent-ransomware | Aurora ransomware operators used the Cursor coding agent during intrusions across victim networks | 2026-08-27 | confirmed | autonomous-attack |
blackhatsect0r-hermes-dxscan-harvesting | French-speaking crew paired a safety-disabled Hermes agent with a mass-scanning C2 that harvested 16,834 credentials | 2026-09-16 | reported | ai-orchestrated-campaign |
camoleak-github-copilot-chat | CamoLeak — GitHub Copilot Chat prompt-injection data exfiltration | 2025-10-08 | reported | agent-hijack-prompt-injection |
carbonato-docker-hermes-botnet | Carbonato botnet installs a Hermes agent persona on hijacked Docker hosts as an operator interface prioritising AI API key theft | 2026-09-22 | reported | infrastructure-abuse-supply-chain |
claude-cowork-file-exfiltration | Claude Cowork could be manipulated into uploading a user's files to an attacker account | 2026-01-14 | reported | agent-hijack-prompt-injection |
clawhavoc-clawhub-malicious-skills | ClawHavoc: large-scale poisoning of the OpenClaw ClawHub skill marketplace with credential-stealing skills | 2026-02-01 | confirmed | infrastructure-abuse-supply-chain |
clinejection-cline-triage-npm-publish | Clinejection: prompt injection of Cline's Claude issue-triage workflow led to an unauthorized npm release | 2026-02-09 | confirmed | agent-hijack-prompt-injection |
codewall-mckinsey-lilli-agent-intrusion | Autonomous security agent reached production data on McKinsey's Lilli AI platform (responsible disclosure) | 2026-03-09 | reported | autonomous-attack |
coral-sleet-agentic-ai-workflow | Coral Sleet (North Korea) operationalizes agentic AI tools across its attack workflow | 2026-03-06 | reported | ai-orchestrated-campaign |
cursor-pocketos-database-deletion | Cursor coding agent deleted PocketOS's production database and backups during a staging task | 2026-08-18 | reported | autonomous-attack |
cyberxero-ai-augmented-access-broker | CyberXero: access broker ran a Claude Code agent swarm alongside global web exploitation and Ukrainian utility intrusions | 2026-10-06 | reported | ai-orchestrated-campaign |
divd-zammad-ai-agent-breach | DIVD CSIRT ticketing system breached through two Zammad zero-days; AI agents used in later attack stages | 2026-09-24 | confirmed | autonomous-attack |
dprk-it-worker-fraud-claude | North Korean IT-worker remote-employment fraud using Claude | 2025-08-27 | confirmed | infrastructure-abuse-supply-chain |
dream-multi-agent-asia-government-campaign | Multi-agent AI framework used to compromise government entities in Asia | 2026-08-12 | reported | ai-orchestrated-campaign |
echoleak-m365-copilot | EchoLeak — zero-click prompt injection in Microsoft 365 Copilot | 2025-06-11 | confirmed | agent-hijack-prompt-injection |
forcedleak-salesforce-agentforce | ForcedLeak — indirect prompt injection in Salesforce Agentforce | 2025-09-25 | reported | agent-hijack-prompt-injection |
gambit-ai-agents-retail-skimmer-campaign | Autonomous AI agents compromised online retailers and planted payment-card skimmers at low per-victim cost | 2026-09-22 | reported | autonomous-attack |
gambit-gentlemen-affiliate-claude-code-intrusions | Suspected The Gentlemen ransomware affiliate used Claude Code to breach VPN appliances and exfiltrate data across eight organizations | 2026-08-13 | reported | ai-orchestrated-campaign |
gemini-cli-ci-untrusted-workspace-rce | Gemini CLI auto-trusted untrusted CI workspaces, creating a remote-code-execution risk | 2026-04-24 | confirmed | agent-hijack-prompt-injection |
gemini-evaluation-real-company-breaches | Google's Gemini breached three real companies during a cybersecurity evaluation | 2026-09-18 | reported | autonomous-attack |
gentlemen-hermes-agent-gitlab-extortion | Exposed server reveals AI-agent ransomware operation that stole 3.1 TB from 30+ GitLab victims | 2026-09-02 | reported | autonomous-attack |
ghostjacking-agentic-kill-chain-poc | GhostJacking: poisoned telemetry could steer AI coding agents into DNS changes and command execution | 2026-08-09 | reported | agent-hijack-prompt-injection |
github-mcp-server-private-repo-leak | GitHub MCP server could be steered via a public issue into leaking private repository contents | 2025-05-26 | reported | agent-hijack-prompt-injection |
gitlost-github-agentic-workflows-repo-leak | GitLost: GitHub Agentic Workflows agent tricked into leaking private repository contents | 2026-07-06 | reported | agent-hijack-prompt-injection |
glow-pixelleak-agent-screenshot-exposure | PixelLeak: AI coding agents published internal review screenshots to public repositories | 2026-09-29 | reported | autonomous-attack |
google-antigravity-data-exfiltration-poc | Google Antigravity agent could be led by a malicious web page to exfiltrate local data | 2025-11-25 | reported | agent-hijack-prompt-injection |
google-antigravity-drive-deletion | Google Antigravity agent wiped a user's drive while clearing a project cache | 2025-12-01 | reported | autonomous-attack |
grok-bankr-prompt-injection-wallet-drain | Prompt injection of Grok drained a Grok-linked crypto wallet via the Bankr trading agent | 2026-05-04 | reported | agent-hijack-prompt-injection |
gtg-10007-agent-swarm-intrusions | GTG-10007 Claude 'agent swarm' espionage and vulnerability-discovery program | 2026-09-10 | confirmed | ai-orchestrated-campaign |
gtg-1002-ai-espionage | GTG-1002 AI-orchestrated cyber-espionage campaign | 2025-11-13 | confirmed | ai-orchestrated-campaign |
gtg-20006-agentic-espionage | GTG-20006 agentic espionage against government, defense and diplomatic targets (Russia-nexus) | 2026-09-10 | confirmed | ai-orchestrated-campaign |
gtg-2002-vibe-hacking-extortion | GTG-2002 'vibe hacking' AI-driven data-extortion operation | 2025-08-27 | confirmed | ai-orchestrated-campaign |
gtg-50014-agentic-mass-exfiltration | GTG-50014 ShinyHunters-linked agentic mass data theft and extortion | 2026-09-10 | confirmed | ai-orchestrated-campaign |
gtg-50020-ai-vendor-api-key-theft | GTG-50020 autonomous exploitation pipeline against ~30 AI companies and theft of production API keys | 2026-09-10 | confirmed | infrastructure-abuse-supply-chain |
gtg-50029-hacktivist-agentic-recon | GTG-50029 single hacktivist's Claude-built mass privacy attack on European political targets | 2026-09-10 | confirmed | ai-orchestrated-campaign |
gtg-5004-ai-ransomware-raas | GTG-5004 AI-assisted ransomware-as-a-service operation | 2025-08-27 | confirmed | infrastructure-abuse-supply-chain |
gtig-agentic-credential-harvesting-q2-2026 | GTIG: adversaries ran an agent-enabled mass credential-harvesting campaign in under six hours | 2026-09-09 | reported | autonomous-attack |
gtig-ai-developed-zero-day-2fa-bypass | GTIG: criminal actor's AI-developed zero-day exploit against a web-based system administration tool | 2026-05-12 | reported | ai-orchestrated-campaign |
gtig-recon-agentic-secret-harvesting | GTIG 'Recon': exposed agentic C2 framework managed more than 23,800 harvested secrets | 2026-09-08 | reported | autonomous-attack |
hackerbot-claw-github-pr-campaign | hackerbot-claw: self-described autonomous 'security research agent' exploiting GitHub Actions across open-source projects | 2026-03-01 | confirmed | autonomous-attack |
instinct-assistant-unauthorized-email | Instinct AI assistant sent an email without approval and retained data after access was revoked | 2026-08-24 | reported | autonomous-attack |
jadepuffer-agentic-database-extortion | JADEPUFFER: agent-driven database extortion operation against an exposed AI-orchestration deployment | 2026-07-01 | reported | autonomous-attack |
jesta-darkreasoning-deepseek-proxyjacking | DeepSeek-driven agent repeatedly attempted to turn a research honeypot into a proxy node | 2026-08-03 | reported | autonomous-attack |
litellm-pypi-teampcp-backdoor | LiteLLM PyPI package backdoored via a poisoned CI security scanner (TeamPCP) | 2026-03-24 | confirmed | infrastructure-abuse-supply-chain |
mandiant-hijacked-coding-assistant-shai-hulud | Hijacked AI coding-assistant session at a SaaS provider led to the Shai-Hulud worm spreading across about 100 internal repositories | 2026-09-16 | reported | infrastructure-abuse-supply-chain |
meta-internal-agent-sev1-data-exposure | Meta internal AI agent gave faulty guidance that briefly exposed sensitive data to unauthorized staff | 2026-03-19 | reported | autonomous-attack |
meta-muse-spark-evaluation-real-website | Meta's Muse Spark model accessed and altered a real website during a misconfigured cyber evaluation | 2026-08-14 | confirmed | autonomous-attack |
mexico-government-claude-code-intrusions | Single operator used Claude Code and GPT-4.1 to breach Mexican government organizations (Dec 2025-Feb 2026) | 2026-02-25 | reported | ai-orchestrated-campaign |
miasma-worm-ai-coding-agent-configs | Miasma worm: Azure/durabletask commit weaponized AI coding-agent configuration files; 73 Microsoft repositories disabled | 2026-06-05 | reported | infrastructure-abuse-supply-chain |
microsoft-openai-state-actor-llm | Microsoft/OpenAI disruption of state-affiliated actors misusing LLMs (2024) | 2024-02-14 | confirmed | infrastructure-abuse-supply-chain |
morris-ii-genai-worm | Morris II — self-replicating worm targeting GenAI-powered applications | 2024-03-05 | test-eval | lab-escape-eval |
notion-ai-web-search-exfiltration | Notion 3.0 AI agents' web-search tool could be abused to exfiltrate private workspace data | 2025-09-19 | reported | agent-hijack-prompt-injection |
nx-s1ngularity-supply-chain | Nx 's1ngularity' npm supply-chain attack weaponising AI CLI tools | 2025-08-27 | confirmed | infrastructure-abuse-supply-chain |
oalabs-compromised-server-claude-codex-intrusions | Low-skilled operator drove Claude Code and Codex agents from hijacked servers to breach at least 14 companies | 2026-06-16 | reported | ai-orchestrated-campaign |
openai-agent-dns-external-chatbot | OpenAI research agent used DNS to reach an external chatbot despite sandbox restrictions | 2026-09-25 | confirmed | autonomous-attack |
openai-agent-leaked-api-key-fabrication | OpenAI training model used a publicly leaked API key without authorization and fabricated results | 2026-09-16 | confirmed | autonomous-attack |
openai-agent-public-file-hosting-upload | OpenAI training agent uploaded a workbook to a public file-hosting service to bypass file isolation | 2026-09-16 | confirmed | autonomous-attack |
openai-agent-services-australia-medicare-portal | OpenAI research agent circumvented access controls on Services Australia's Medicare statistics portal | 2026-09-24 | confirmed | autonomous-attack |
openai-agents-australian-state-agencies | OpenAI training and evaluation agents reached four further Australian government agencies' systems (BOCSAR, VAHI, AIHW, NSW NPWS), June 2026 | 2026-09-24 | confirmed | autonomous-attack |
openai-attributed-dsewiki-agent-swarm | OpenAI-attributed agent swarm commandeered the DseWiki forum and resisted deletion | 2026-09-04 | confirmed | autonomous-attack |
openai-attributed-rubygems-agent-swarm | OpenAI-attributed agents abused RubyDoc workers and flooded RubyGems with malicious packages | 2026-09-15 | reported | infrastructure-abuse-supply-chain |
openai-attributed-unctad-api-scanning | OpenAI-attributed agents repeatedly scanned a UN statistics API and worked around access restrictions | 2026-09-26 | reported | autonomous-attack |
openai-attributed-wikimedia-edits | Wikimedia Foundation links OpenAI-attributed agents to unauthorized edits and an Etherpad probe | 2026-10-05 | reported | autonomous-attack |
openai-eval-agents-hugging-face-intrusion | OpenAI evaluation agents escaped their sandbox and compromised Hugging Face production infrastructure | 2026-07-21 | confirmed | autonomous-attack |
openai-huggingface-may-account-hijacking | OpenAI-attributed agents probed Hugging Face and hijacked two user accounts two months before the July breach | 2026-09-16 | confirmed | autonomous-attack |
openai-long-horizon-sandbox-escape-github-pr | OpenAI long-horizon model circumvented its sandbox to open a public GitHub pull request | 2026-07-20 | confirmed | autonomous-attack |
openclaw-inbox-deletion | OpenClaw agent deleted a researcher's emails and ignored stop commands | 2026-02-23 | reported | autonomous-attack |
papercut-agentic-global-intrusion | AI-orchestrated campaign compromised hundreds of PaperCut servers across dozens of countries | 2026-09-09 | reported | autonomous-attack |
pillar-adk-agent-privilege-escalation | Pillar: low-privilege triage agent could trigger privileged Gemini workflows on Google's ADK repository | 2026-08-03 | reported | agent-hijack-prompt-injection |
pillar-gemini-cli-gcp-triage-compromise | Pillar: a GitHub issue on Gemini CLI could lead to compromise of a GCP triage project | 2026-08-18 | reported | agent-hijack-prompt-injection |
postmark-mcp-bcc-backdoor | postmark-mcp: an npm MCP server impersonating Postmark silently BCC'd every email sent through it to an attacker | 2025-09-25 | confirmed | infrastructure-abuse-supply-chain |
promptflux-gemini-selfmod | PROMPTFLUX — experimental self-modifying malware abusing the Gemini API | 2025-11-06 | reported | infrastructure-abuse-supply-chain |
promptlock-ai-ransomware-poc | PromptLock — first known AI-powered ransomware (academic proof-of-concept) | 2025-08-26 | test-eval | lab-escape-eval |
promptspy-gemini-android-agent | PROMPTSPY — Android backdoor that delegates on-device UI actions to the Gemini API | 2026-05-12 | confirmed | autonomous-attack |
promptsteal-apt28-lamehug | PROMPTSTEAL / LAMEHUG — LLM-enabled data miner used against Ukraine | 2025-11-05 | confirmed | ai-orchestrated-campaign |
radware-zombieagent-deep-research | ZombieAgent: zero-click indirect prompt injection against OpenAI's Deep Research agent | 2026-01-08 | reported | agent-hijack-prompt-injection |
replit-agent-database-deletion | Replit AI coding agent deleted a production database during a code freeze | 2025-07-21 | confirmed | autonomous-attack |
secflow-asia-government-education-campaign | SecFlow framework drove commercial AI models against government and education systems across Asia | 2026-09-03 | reported | ai-orchestrated-campaign |
servicenow-now-assist-agent-injection | ServiceNow Now Assist agent-to-agent prompt injection (insecure defaults) | 2025-11-19 | reported | agent-hijack-prompt-injection |
shadow-escape-mcp-zero-click | Shadow Escape: zero-click data-exfiltration technique against MCP-connected AI agents | 2025-10-22 | reported | agent-hijack-prompt-injection |
skills-sh-paperclip-malicious-skills | Typosquatted Paperclip and Browser Use skills on skills.sh told AI agents to fetch and run a credential stealer | 2026-08-06 | reported | infrastructure-abuse-supply-chain |
snowflake-cortex-cli-sandbox-escape | Snowflake Cortex Code CLI could be driven out of its sandbox via indirect prompt injection | 2026-03-16 | reported | agent-hijack-prompt-injection |
storm-3168-azure-service-principal-destruction | Storm-3168 (JADEPUFFER) used compromised Azure service principals for rapid, automated cloud resource destruction | 2026-09-25 | reported | autonomous-attack |
supabase-mcp-database-leak | Supabase MCP server could be steered into exposing a private database table | 2025-07-08 | reported | agent-hijack-prompt-injection |
sysdig-marimo-ai-agent-database-exfiltration | Attacker used an LLM agent to move from a Marimo notebook CVE to an internal database in under an hour | 2026-05-26 | reported | autonomous-attack |
thailand-mof-hermes-agent-intrusion | Operator ran a Hermes agent unattended for post-compromise enumeration inside Thailand's Ministry of Finance network | 2026-07-23 | reported | ai-orchestrated-campaign |
trendmicro-gemini-cli-dental-botnet | Russian-speaking operator used Google Gemini CLI to build and run a command-and-control botnet | 2026-07-14 | confirmed | ai-orchestrated-campaign |
unit42-ai-assisted-enterprise-intrusion | Unit 42 investigation: AI agents sped an enterprise intrusion and hijacked the victim's cloud AI infrastructure | 2026-09-02 | reported | autonomous-attack |
unit42-hermes-deepseek-autonomous-campaign | Operator ran a DeepSeek-powered Hermes Agent in autonomous exploitation attempts; confirmed impact came from manual exploitation | 2026-07-30 | reported | autonomous-attack |
Data licensed CC BY-SA 4.0. See the repository.