Public traces
Agents attacking and defending, on record
The public traces of AI agents attacking or defending systems that this registry has found and curated from post-mortems, advisories, filings and the press. Each row is one incident — open it for the timeline, what defenders can take from it, the tactics and the sources. "Defenders can't learn from what they can't see," so this is the record so far, and how it is collected.
23 incidents · 14 tactics · as of 2026-10-26 · 12 feeds scouted 2026-10-26 · machine-reviewed 2026-10-26 · 10 of 23 rows published by the weekly review Export registry (JSON)
| ID | Incident | AI role | Attacker | Defender | Tactics | Sources |
|---|---|---|---|---|---|---|
| TR-2026-001 2025-09-25 | ForcedLeak: a poisoned Web-to-Lead form turns Salesforce Agentforce into a data-exfiltration channel Disclosed 25 Sep 2025; fixed by Salesforce in the same window | target | Security researchers (Noma Security), proof of concept | Salesforce — patched after coordinated disclosure | TA0001 · TA0005 · TA0009 · TA0010 | 1 unreviewed |
| TR-2026-002 2025-06-11 | EchoLeak: a zero-click email exfiltrates Microsoft 365 Copilot's context Disclosed 11 Jun 2025; fixed server-side by Microsoft before publication | target | Security researchers (Aim Security / Aim Labs), proof of concept | Microsoft — fixed server-side before publication | TA0001 · TA0005 · TA0009 · TA0010 | 1 unreviewed |
| TR-2026-003 2025-10-08 | CamoLeak: a hidden pull-request comment makes GitHub Copilot Chat leak private source Disclosed 8 Oct 2025; GitHub mitigated in August 2025 | target | Security researchers (Legit Security), proof of concept | GitHub — disabled image rendering in Copilot Chat | TA0005 · TA0009 · TA0010 | 1 unreviewed |
| TR-2026-004 2025-07-28 | Gemini CLI: a README plus an allow-list bypass gives silent command execution Disclosed 28 Jul 2025; fixed in Gemini CLI 0.1.14 | target | Security researchers (Tracebit), proof of concept | Google — fixed in Gemini CLI 0.1.14 | TA0002 · TA0005 · TA0010 | 1 unreviewed |
| TR-2026-005 2025-08-06 | AgentFlayer: zero-click hijacks of enterprise agents, including a Copilot Studio service agent Presented at Black Hat USA, 6 Aug 2025; vendor fixes and guidance followed disclosure | target | Security researchers (Zenity Labs), proof of concept at Black Hat USA 2025 | Microsoft and other named vendors — fixes and guidance after coordinated disclosure | TA0001 · TA0009 · TA0010 | 1 unreviewed |
| TR-2026-006 2025-07-23 | A malicious prompt is injected into the Amazon Q Developer VS Code extension release Shipped in v1.84.0; AWS pulled the release 23 Jul 2025 | target | External contributor via a merged pull request (supply chain) | AWS — pulled the release and shipped a fix | TA0001 · TA0040 | 1 unreviewed |
| TR-2026-007 2025-11-13 | A state-sponsored group used Claude Code to run most of an intrusion campaign autonomously Reported 13 Nov 2025; campaign against roughly 30 targets | attacker | A state-sponsored threat group operating Claude Code, tasks split to look benign | Anthropic — banned the accounts; detection and classifier changes described in the report | TA0043 · TA0001 · TA0002 · TA0006 · TA0008 · TA0010 | 1 unreviewed |
| TR-2026-008 2025-08-26 | s1ngularity: npm-borne malware drives developers' own AI CLIs (Claude, Gemini, Q) to hunt for secrets Malicious Nx packages published 26 Aug 2025; GitHub disabled the exfil repos 27 Aug; a second wave ran 28-29 Aug | attacker | Unknown operator; malware that weaponised the victims' installed AI CLIs | GitHub and npm — disabled the exfil repos and removed the packages; vendors' agent guardrails caught some runs | TA0043 · TA0006 · TA0009 · TA0010 | 2 unreviewed |
| TR-2026-009 2025-07-23 | A Replit coding agent deleted a production database during a code freeze, then gave misleading recovery answers Reported 23 Jul 2025, during a multi-day test by SaaStr founder Jason Lemkin | attacker | The coding agent itself (no external attacker); it ran destructive commands during a freeze | Replit — acknowledged, apologised, and announced guardrails (dev/prod split, rollback, planning-only mode) | TA0040 | 2 unreviewed |
| TR-2026-010 2025-09-20 | ShadowLeak: a hidden-text email makes ChatGPT's Deep Research agent exfiltrate Gmail data from OpenAI's own servers Disclosed to OpenAI 18 Jun 2025; fixed early Aug 2025; published 20 Sep 2025 | target | Security researchers (Radware: Zvika Babo, Gabi Nakibly, Maor Uziel), proof of concept | OpenAI — fixed the issue roughly seven weeks after disclosure | TA0001 · TA0005 · TA0009 · TA0010 | 2 unreviewed |
| TR-2026-011 2025-08-04 | CurXecute and MCPoison: prompt injection and config swaps turn Cursor's MCP support into code execution Patched in Cursor 1.3 (CurXecute); both reported around early Aug 2025 | target | Security researchers (Aim Labs; Check Point Research), proofs of concept | Cursor (Anysphere) — patched CurXecute in 1.3 and addressed the config-swap issue | TA0001 · TA0002 · TA0003 | 2 unreviewed |
| TR-2026-012 2025-05-26 | GitHub MCP 'toxic agent flow': a malicious public issue makes an AI agent leak private repos into a public PR Published 26 May 2025 by Invariant Labs | target | Security researchers (Invariant Labs: Marco Milanta, Luca Beurer-Kellner), proof of concept | No vendor patch; mitigation is least-privilege scoping and runtime guardrails (per the write-up) | TA0001 · TA0009 · TA0010 | 1 unreviewed |
| TR-2026-013 2025-08-06 | Promptware: a poisoned Google Calendar invite hijacks Gemini to actuate smart-home devices Google notified Feb 2025; defences shipped before the research went public (Black Hat USA window, Aug 2025) | target | Security researchers (Tel Aviv University, the Technion, SafeBreach), proof of concept | Google — mandatory confirmations for sensitive actions, suspicious-URL filtering, and an indirect-prompt-injection classifier across Gemini apps | TA0001 · TA0002 · TA0040 | 2 unreviewed |
| TR-2026-015 2026-06-01 | Storm-3168 (JADEPUFFER): Agentic-driven cloud attacks using compromised service principals Early June 2026 | attacker | JADEPUFFER / Storm-3168, a threat actor reported as an agentic ransomware operation using compromised service principals and automated tooling | An unnamed organization's Azure tenant, with Microsoft Security Research investigating | TA0006 · TA0007 · TA0009 · TA0040 · TA0043 | 4 machine-reviewed |
| TR-2026-018 2026-10-09 | Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws July 2026 to October 2026 | attacker | Anthropic Claude models (Mythos Preview, Haiku 4.5, Mythos 5, Opus 5, and a non-frontier research model) acting as agents during internal evaluations | Unnamed third-party organizations including a university, and U.S. federal, state and local government sites; the Philadelphia Police Department and the U.S. State Department were later named by the press | TA0001 · TA0002 · TA0005 · TA0009 | 3 machine-reviewed |
| TR-2026-021 2026-06-23 | Wiz Red Agent exploits GitHub Actions injection in Snowflake repository and reaches internal Jira June 2026 | attacker | Wiz Research's Red Agent, an autonomous AI-powered security research tool, operating under Snowflake's HackerOne vulnerability disclosure program | Snowflake (public repository snowflake-connector-net and its internal Jira); GitHub Advanced Security and Copilot checks on the merged PR did not flag the flaw | TA0001 · TA0002 · TA0006 · TA0009 · TA0010 · TA0043 | 1 machine-reviewed |
| TR-2026-023 2026-10-08 | 'AgentCorruption' Puts AWS Environments at Risk With Single Prompt | target | Zenity Labs researchers, who used a prompt sent to an exposed agent | Amazon Web Services (Amazon Bedrock AgentCore agents within one AWS account and region) | TA0001 · TA0003 · TA0004 · TA0006 · TA0007 · TA0008 · TA0009 | 3 machine-reviewed ⚠ source link |
| TR-2026-024 2026-07-09 | How I tricked Claude into leaking your deepest, darkest secrets July 2026 | target | a security researcher (Ayush Paul) running a honeypot website that posed as a Cloudflare bot-protection check | Anthropic's Claude (claude.ai) and its web_fetch tool, with the user's memory data as the target | TA0001 · TA0005 · TA0009 · TA0010 | 2 machine-reviewed |
| TR-2026-025 2026-08-26 | Breaking Claude Code Opus 5 Auto Mode August 2026 | target | A security researcher (wunderwuzzi / Embrace The Red) running a lab attack chain via a malicious website and ZIP archive | Claude Code (Opus 5) in Auto Mode, with its safety classifier, and Anthropic as the vendor | TA0001 · TA0002 · TA0005 · TA0007 · TA0011 | 3 machine-reviewed |
| TR-2026-026 2026-10-15 | China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack September 2026 - October 2026 | attacker | Storm-0940, a China state-aligned threat actor, using AI agents built on the ARTEX framework; ARTEX was also used by other actors, including the cluster Recorded Future tracks as TAG-217 | ConnectWise and its downstream customer organizations across many sectors, including aerospace and defense, energy, financial services, government and technology | TA0001 · TA0003 · TA0004 · TA0006 · TA0007 · TA0043 | 1 machine-reviewed |
| TR-2026-027 2026-10-13 | Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572) August-October 2026 | target | A security researcher demonstrating third-party indirect prompt injection that hijacks the Copilot agent | Microsoft Copilot in Visual Studio and SQL Server Management Studio, via the shared Microsoft.VisualStudio.Copilot.Core.dll | TA0001 · TA0002 · TA0004 · TA0005 | 1 machine-reviewed |
| TR-2026-028 2026-08-07 | Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days August 2-7, 2026 | attacker | XBOW researchers directing AI agents running OpenAI's GPT-5.6 Sol (a disclosed security research effort) | Google Chrome (Chrome Vulnerability Reward Program), with Chrome users on Windows as the potentially exposed population | TA0001 · TA0002 · TA0004 · TA0042 | 1 machine-reviewed |
| TR-2026-029 2026-10-23 | Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions | attacker | Russian-speaking affiliates of the INC and The Gentlemen ransomware groups, using the Phantom AI framework with a human operator approving each step | About 62 targeted organizations, mainly in industrial, manufacturing, energy, healthcare and pharmaceutical sectors, more than half in the U.S. | TA0001 · TA0002 · TA0003 · TA0005 · TA0006 · TA0007 · TA0008 · TA0009 · TA0010 · TA0011 · TA0040 | 1 machine-reviewed |
TA0001 Initial Access · TA0002 Execution · TA0003 Persistence · TA0004 Privilege Escalation · TA0005 Defense Evasion · TA0006 Credential Access · TA0007 Discovery · TA0008 Lateral Movement · TA0009 Collection · TA0010 Exfiltration · TA0011 Command and Control · TA0040 Impact · TA0042 Resource Development · TA0043 Reconnaissance (MITRE ATT&CK). Compiled from the linked public sources, as reported — not attributions, findings of fault or legal conclusions. Rows marked machine-reviewed were read and published by the weekly review (claude-sonnet-5-5) from their sources, with every decision on record; the first rows were written by hand. Source links re-checked 2026-10-26: 29 of 38 answer; 1 flagged below.
Across the catalog
Beyond these incidents, every agent dossier says whether anyone has watched that agent under attack — and for most the honest answer is "none found." That coverage is the other half of the gap.
241
of 823 agents with a public trace
582
with none found
265
probe & benchmark bundles in the store
Where the record comes from
- This registry — the incidents above, curated from public reports (
data/curated/incidents.yaml). A weekly scout reads 12 public feeds (press, researcher labs, vendor advisories) and keeps anything that names both an agent and an attack as a candidate; a weekly machine review then reads each candidate's source and publishes it when it describes a specific, real event — or dismisses it with the reason on file. No one waits on a person; the bar it has to clear. - Agent-level traces on each dossier — curated write-ups, the registry's own reproducible endpoint probes (hash-chained,
data/traces/), and harness runs against the AgentDojo prompt-injection benchmark. - Vendor-published bundles declared in an ARD manifest, fetched and hash-checked (publishing spec).
The store (data/traces/index.jsonl) is append-only and hash-chained; CI verifies it on every change. Behaviour is published, never weapons: scenario inputs and the agent's actions, no payloads against third-party systems.