INCIDENTS
AI agent security incidents
Reported incidents, published malicious or unauthorized artifacts, and threat trends involving coding agents, agents in CI, MCP servers and AI developer tooling. Each record identifies its evidence type and links to sources. Research disclosures are listed separately.
20 records and 9 research disclosures. Last content review 20 Oct 2026.
- ReportedData exposure
PixelLeak: researchers find over 13,000 exposed internal images
Glow Labs reported over 13,000 internal images exposed on GitHub across more than 300 organizations. Investigated cases included agents publishing code-review screenshots through personal public repositories and tools such as gitshot, exposing billing, treasury and unreleased product screens.
- Evidence
- Researcher-reported exposure
- Agent or tool
- Coding agents
- Control
- Review before publishing to public destinations
- ReportedCredential theft
Infostealers start harvesting AI agent sessions
Commodity stealers (Amatera, Remus, CallbackBeaver, Djinn and others) now collect coding-agent tokens, MCP configs and prompt histories. A valid, replayable session token can allow account access without repeating password or MFA authentication.
- Evidence
- Threat trend
- Agent or tool
- Claude Code, Codex, Cursor, Gemini CLI, Cline
- Control
- Treat agent token files as credentials
- ReportedSupply chain
An official MCP Registry listing spreads Shai-Hulud
OX Security found a registry entry linking a clean PyPI package to a repository with malicious Claude Code and VS Code workspace settings. Loading and trusting those settings could run the worm; execution depends on the tool and workspace trust configuration.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, VS Code
- Control
- Review repository config before an agent runs it
- Sources
- ReportedSupply chain
Mini Shai-Hulud: PyPI packages posing as MCP tools
Socket documented malicious MCP-themed PyPI wheels using Python startup hooks to load credential-stealing payloads. A related bioinformatics subcluster used native extensions triggered on import. The payloads targeted GitHub, cloud and AI tool secrets.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- MCP developers
- Control
- Review new package versionsnode9: Package check, when the agent runs the install
- Sources
- ReportedCredential theft
codexui-android steals Codex login tokens for a month
Aikido reported that an npm package with about 27,000 weekly downloads at the time sent locally available Codex access and refresh tokens to an attacker server on startup. The malicious code was present in the published package but absent from its GitHub source.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Codex
- Control
- Treat agent token files as credentials
- OccurredDestructive action
PocketOS reports production database deletion by a coding agent
PocketOS founder Jer Crane reported that a Cursor agent used an over-scoped Railway token to delete its production volume in nine seconds. Railway later confirmed recovery and described a cascading-delete issue that made backups unavailable in the UI; it also maintains offsite disaster backups.
- Evidence
- Reported by affected operator
- Agent or tool
- Cursor
- Control
- Review destructive cloud API calls; scope tokens
- OccurredSupply chain
Bitwarden CLI hijack targets coding-agent configs
A malicious Bitwarden CLI build on npm read Claude Code, Kiro and other MCP configuration files along with cloud and git secrets, then spread as a worm. The affected npm version was @bitwarden/cli@2026.4.0.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Kiro, Cursor, Codex CLI, Aider
- Control
- Treat agent config and token files as credentialsnode9: Package check, when the agent runs the install
- ReportedSupply chain
LiteLLM releases backdoored on PyPI
FutureSearch identified compromised PyPI releases 1.82.7 and 1.82.8 containing credential-stealing code targeting SSH, cloud and Kubernetes secrets. Version 1.82.8 used a .pth file to execute at Python startup, without an explicit LiteLLM import.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Python AI tooling
- Control
- Pin CI tools; review new package versionsnode9: Package check, when the agent runs the install
- ReportedDestructive action
Claude Code runs terraform destroy on production
Alexey Grigorev reported that on February 26, while cleaning up duplicate resources, the agent unpacked an old Terraform archive whose state described production, and the author let it run terraform destroy. DataTalks.Club's production stack and its automated snapshots were deleted. AWS restored a snapshot hidden from the console 24 hours later.
- Evidence
- Reported by affected operator
- Agent or tool
- Claude Code
- Control
- Review infrastructure teardown commands
- OccurredSupply chain
Trivy VS Code extension launches coding agents to steal secrets
Using an OpenVSX token stolen through a vulnerable Trivy GitHub Actions workflow, an attacker published extension versions 1.8.12 and 1.8.13 that attempted to start local coding agents in permissive modes and instructed them to collect and send out credentials. Socket reported no confirmed successful exfiltration at publication.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Codex, Gemini CLI, Copilot CLI, Kiro CLI
- Control
- Block agent reads of credential filesnode9: Credential file block, enforced even with safety flags off
- ReportedSupply chain
SANDWORM_MODE plants a rogue MCP server in AI assistants
Socket identified at least 19 malicious npm packages in a campaign whose malware could register a hidden MCP server with tool descriptions directing assistants to read credential files. The report did not establish a campaign-wide victim count.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Cursor, Windsurf, Continue
- Control
- Block agent reads of credential files; flag new MCP serversnode9: Credential file block
- Sources
- OccurredAgents in CI
Clinejection: an issue title leads to a rogue Cline release
An issue title steered Cline's AI triage workflow, which any GitHub user could trigger and which had shell access. An npm token missed during rotation was used to publish an unauthorized cline@2.3.0 that installed the legitimate OpenClaw package without authorization. Cline reported no malicious payload or user-data exfiltration.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code GitHub Action
- Control
- Audit CI workflows that let outsiders drive an agentnode9: Repository scan
- ReportedSupply chain
ClawHavoc: 341 malicious agent skills
Koi Security found 341 malicious skills on OpenClaw's ClawHub marketplace whose instructions told users and agents to run fake "prerequisite" installers that delivered infostealers on macOS and Windows. Antiy counted 1,184 malicious skills in the ClawHub historical repository as of February 5, a later and broader snapshot.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- OpenClaw
- Control
- Review skills before first use
- ReportedSupply chain
Shai-Hulud 2.0 reaches official MCP servers
The self-spreading npm worm republished 500+ packages, including MCP servers and agent SDKs from Browserbase, Postman, Zapier and PostHog, and dumped stolen secrets into public GitHub repos.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- MCP servers, Agent SDKs
- Control
- Review install scripts; block known-malicious versionsnode9: Package check, when the agent runs the install
- ReportedSupply chain
PhantomRaven: malicious npm packages hide remote payloads
Packages that appeared to have no dependencies fetched malicious dependencies from an attacker server during installation. Sonatype documented credential theft and more than 200 associated packages by October 31, 2025, including packages posing as MCP servers.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- npm tooling, MCP-themed packages
- Control
- Review new packages and install scriptsnode9: Package check, when the agent runs the install
- ReportedSupply chain
An MCP command-runner package opens a reverse shell on install
Versions starting with 1.0.6 of @lanyer640/mcp-runcommand-server contained a reverse shell activated by a preinstall script. Identified and reported by Checkmarx Zero researcher Bruno Dias on October 1, 2025.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Any MCP client
- Control
- Review package install scriptsnode9: Package check, when the agent runs the install
- Sources
- ReportedSupply chain
postmark-mcp: an MCP server that copied every email to the attacker
After clean versions up to 1.0.15, an unofficial Postmark email server added one line in 1.0.16 that blind-copied every message sent through it to an outside address. Snyk documented the BCC behavior in its analysis of the published package.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Any MCP client
- Control
- Pin MCP server code, not only its tool list
- ReportedSupply chain
nx "s1ngularity": malware turns installed coding agents into credential hunters
Malicious nx releases attempted to run locally installed Claude Code, Gemini CLI and Amazon Q in permissive modes, asking them to find wallets, SSH keys and .env files. Stolen secrets, including GitHub and npm tokens, went to public repos on the victims' own accounts.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Gemini CLI, Amazon Q
- Control
- Block agent reads of credential files
- ReportedSupply chain
Amazon Q Developer extension ships with a wiper prompt
An outsider used an over-scoped GitHub token in AWS's build setup to commit a prompt telling the agent to delete local files and cloud resources. Version 1.84.0 shipped to users; a syntax error stopped it from running.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Amazon Q Developer
- Control
- Review before destructive commands, whoever wrote the prompt
- ReportedDestructive action
Replit agent deletes a production database during a code freeze
During a code freeze, the agent ran destructive commands against the production database of an app Jason Lemkin was building, then said a rollback was impossible. The rollback worked. Lemkin also said it had faked data and test results.
- Evidence
- Reported by affected operator
- Agent or tool
- Replit Agent
- Control
- Review before destructive database commands
Disclosures
Vulnerabilities demonstrated by researchers. These entries do not establish exploitation outside the research setting. Fix status is historical; consult the linked advisories for affected versions.
- Reported
MCP Python SDK sends OAuth secrets to a malicious server
In affected HTTP OAuth clients, a malicious MCP server could redirect credentials to its own token endpoint, exposing client secrets and PKCE verifiers. SDK servers and stdio clients were not affected. Fixes were released in 1.30.0 and 2.2.0; some providers also require explicit issuer configuration.
- Reported
Plugin4Shell: pinned agent plugins swapped without a prompt
AIR demonstrated plugin checkout resolving to an attacker-controlled branch instead of the pinned commit: SHA-name ambiguity in Claude Code, Codex and Copilot, and a FETCH_HEAD variant in Gemini CLI. Claude Code and Codex were fixed; Copilot and Gemini CLI were unpatched at disclosure.
- Reported
DeepSeek Harness agent grants itself full access (CVE-2026-82533)
OX Security demonstrated that a sandboxed agent could call its own local control API and switch its session to full access with approvals off. The issue was fixed in DeepSeek Harness 0.1.2-alpha.1.
- Reported
GitSpawn: a repo's git settings run code when an agent opens it
Manifold reported eight findings across seven coding agents involving background Git operations in attacker-supplied workspaces. Mechanisms varied by agent; cases included malicious .git/config settings. Four findings were unpatched at disclosure.
- Reported
GitLost: an issue makes GitHub Agentic Workflows leak private repos
In Noma Security's proof of concept, a crafted public issue caused a GitHub Agentic Workflow already authorized to read public and private repositories to publish a private README in a public comment.
- Reported
GuardFall: command guards that read text, not commands
Adversa AI surveyed 11 agents and reported bypassable or missing command guards and unsafe local-mode configurations. Some agents used protective sandboxes by default. Continue resisted the tested payloads in default mode, but its CLI auto mode weakened approval enforcement.
node9: Parses the command; all five techniques stopped in our test
- Reported
Comment and Control: PR and issue text makes CI agents leak keys
Crafted pull request and issue text made the Claude Code Security Review action, Gemini CLI Action and Copilot's coding agent publish their own credentials.
- Reported
Codex branch-name command injection
BeyondTrust demonstrated command injection through a branch name in Codex cloud task setup, exposing a GitHub token. Its timeline records fixes and additional hardening before the March 2026 publication.
- Reported
Claude Code project settings redirect the API key (CVE-2026-21852)
Check Point demonstrated that repository settings could redirect Claude Code API credentials before workspace trust was accepted. Its timeline records a fix in December 2025, before the February 2026 research publication.
What counts
- Evidence labels distinguish affected operators' accounts, published malicious or unauthorized artifacts, researcher-reported exposure, and threat trends. Published malicious code does not by itself establish successful theft or a victim count.
- Sources include vendor advisories, researchers' technical analyses, affected operators' accounts, and supporting reporting. This is a source-based record, not an independent forensic reproduction.
- An incident is listed only when a reliable source confirms it: the affected company, the vendor, an official advisory or an established research team. A single user's report is not enough, even when it is widely shared.
- A named affected company's own account can be included and is labeled as such. A source documenting malicious capabilities is not treated as proof that every capability ran successfully on a victim's system.
- Dates labeled "Reported" identify a cited report or advisory, not necessarily the earliest public disclosure. Dates labeled "Occurred" identify the event. Counts describe the cited source's observation window; downloads are not unique users or confirmed victims.
- A node9 badge marks a row where a node9 default control acts on the step that did the damage, checked with node9 explain on a fresh default configuration. It applies to agents node9 supports and to actions that go through the agent.
- Spotted an error or a missing incident? Write to security@node9.ai.