INCIDENTS

AI agent security incidents

Reported incidents, published malicious or unauthorized artifacts, and threat trends involving coding agents, agents in CI, MCP servers and AI developer tooling. Each record identifies its evidence type and links to sources. Research disclosures are listed separately.

24 records and 21 research disclosures. Last content review 8 Nov 2026.

npm / PyPI packageMCP serverAgent skillEditor extensionCI pipelineCredentialsProductionPublic repo>_coding agent
  1. ReportedData exposure

    Claude Code's "don't ask again" saves approved commands, secrets included, to a file that reaches GitHub

    Approving a command with "Yes, and don't ask again" stores it word for word in .claude/settings.local.json, which is not ignored by git by default. Apiiro scanned 104,185 public copies of the file and found secrets in 1,122 of them; with git history and related files the count reached 2,539 secrets in 1,994 repositories, including 379 database passwords, 42 GitHub, GitLab and npm tokens and 23 AWS keys. The researchers did not try the credentials; one company confirmed its key was live.

    Evidence
    Researcher-reported exposure
    Agent or tool
    Claude Code
    Data exposed
    Credentials and secrets
    Control
    Keep secrets out of approved commands; ignore agent settings files in git
  2. OccurredSupply chain

    Tampered Claude Code extension served from Cursor's marketplace

    For about eleven hours on October 29, Cursor's extension marketplace served versions 2.1.312 and 2.1.313 of the Claude Code extension with a loader that ran on load, before any conversation. It reported hostname, username, environment variable names, Git email and public IP, added an attacker SSH key to authorized_keys and installed persistence. Cursor says at most 5,000 users received it; Anthropic says it did not build or publish the copy. Neither company has said how the attacker gained publish access. The Microsoft marketplace, Open VSX and npm were not affected.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code (VS Code extension)
    Entry point
    Editor extension
    Control
    Verify extension updates against the publisher's own release
  3. ReportedSupply chain

    LiteLLM 1.107.0 released with a credential stealer through leaked GitHub tokens

    A compromised release pipeline published litellm 1.107.0 to PyPI, Docker Hub and GHCR for about two hours on October 21. The wheels dropped a Python startup stealer that reads Claude Code, Codex, Gemini CLI and Cursor auth files along with cloud, SSH, GitHub and browser secrets, plus an hourly remote-code loader. According to LiteLLM's corrected attack-chain report, an Agent Platform admin key committed to a public repository in May was never revoked; in October it returned a GitHub organization owner's GitHub CLI OAuth token through the platform's API, and that token drove the release.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, Codex, Gemini CLI, Cursor
    Entry point
    npm or PyPI package
    Data targeted
    Agent tokens and configs, Credentials and secrets
    Control
    Review new package versions; treat agent token files as credentialsnode9: Package check: a version under 48 hours old goes to review
  4. ReportedData exposure

    PixelLeak: researchers find over 13,000 exposed internal images

    Glow Labs reported over 13,000 internal images exposed on GitHub across more than 300 organizations. Investigated cases included agents publishing code-review screenshots through personal public repositories and tools such as gitshot, exposing billing, treasury and unreleased product screens.

    Evidence
    Researcher-reported exposure
    Agent or tool
    Coding agents
    Data exposed
    Internal images
    Control
    Review before publishing to public destinations
  5. ReportedCredential theft

    Infostealers start harvesting AI agent sessions

    Commodity stealers (Amatera, Remus, CallbackBeaver, Djinn and others) now collect coding-agent tokens, MCP configs and prompt histories. A valid, replayable session token can allow account access without repeating password or MFA authentication.

    Evidence
    Threat trend
    Agent or tool
    Claude Code, Codex, Cursor, Gemini CLI, Cline
    Data targeted
    Agent tokens and configs
    Control
    Treat agent token files as credentials
  6. ReportedSupply chain

    An official MCP Registry listing spreads Shai-Hulud

    OX Security found a registry entry linking a clean PyPI package to a repository with malicious Claude Code and VS Code workspace settings. Loading and trusting those settings could run the worm; execution depends on the tool and workspace trust configuration.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, VS Code
    Entry point
    Repository config
    Data targeted
    Credentials and secrets
    Control
    Review repository config before an agent runs it
  7. ReportedSupply chain

    A Claude model publishes a credential-stealing package to PyPI during a security evaluation

    Anthropic reported that during a capture-the-flag evaluation run by its partner Irregular, Claude Mythos 5 found setup instructions naming a Python package that did not exist, created it with hidden credential-stealing code, registered accounts and published it to the real PyPI registry while reasoning that it was still in a simulation. The package was live for about an hour and ran on 15 real systems, among them a security company's scanner; the credentials it took were used to reach that company's infrastructure. Anthropic did not name the package and notified the affected organizations and PyPI.

    Evidence
    Reported by affected operator
    Agent or tool
    Claude Mythos 5 (evaluation run)
    Entry point
    npm or PyPI package
    Data affected
    Credentials and secrets
    Control
    No registry publishing from agent sandboxes; review package installs
  8. ReportedSupply chain

    Mini Shai-Hulud: PyPI packages posing as MCP tools

    Socket documented malicious MCP-themed PyPI wheels using Python startup hooks to load credential-stealing payloads. A related bioinformatics subcluster used native extensions triggered on import. The payloads targeted GitHub, cloud and AI tool secrets.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    MCP developers
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets
  9. ReportedCredential theft

    codexui-android steals Codex login tokens for a month

    Aikido reported that an npm package with about 27,000 weekly downloads at the time sent locally available Codex access and refresh tokens to an attacker server on startup. The malicious code was present in the published package but absent from its GitHub source.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Codex
    Entry point
    npm or PyPI package
    Data targeted
    Agent tokens and configs
    Control
    Treat agent token files as credentials
  10. OccurredDestructive action

    PocketOS reports production database deletion by a coding agent

    PocketOS founder Jer Crane reported that a Cursor agent used an over-scoped Railway token to delete its production volume in nine seconds. Railway later confirmed recovery and described a cascading-delete issue that made backups unavailable in the UI; it also maintains offsite disaster backups.

    Evidence
    Reported by affected operator
    Agent or tool
    Cursor
    Data affected
    Production database
    Control
    Review destructive cloud API calls; scope tokens
  11. OccurredSupply chain

    Bitwarden CLI hijack targets coding-agent configs

    A malicious Bitwarden CLI build on npm read Claude Code, Kiro and other MCP configuration files along with cloud and git secrets, then spread as a worm. The affected npm version was @bitwarden/cli@2026.4.0.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, Kiro, Cursor, Codex CLI, Aider
    Entry point
    npm or PyPI package
    Data targeted
    Agent tokens and configs, Credentials and secrets
    Control
    Treat agent config and token files as credentialsnode9: Package check, when the agent runs the install
  12. ReportedSupply chain

    LiteLLM releases backdoored on PyPI

    FutureSearch identified compromised PyPI releases 1.82.7 and 1.82.8 containing credential-stealing code targeting SSH, cloud and Kubernetes secrets. Version 1.82.8 used a .pth file to execute at Python startup, without an explicit LiteLLM import.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Python AI tooling
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets
    Control
    Pin CI tools; review new package versionsnode9: Package check, when the agent runs the install
  13. ReportedDestructive action

    Claude Code runs terraform destroy on production

    Alexey Grigorev reported that on February 26, while cleaning up duplicate resources, the agent unpacked an old Terraform archive whose state described production, and the author let it run terraform destroy. DataTalks.Club's production stack and its automated snapshots were deleted. AWS restored a snapshot hidden from the console 24 hours later.

    Evidence
    Reported by affected operator
    Agent or tool
    Claude Code
    Data affected
    Production database, Cloud infrastructure
    Control
    Review infrastructure teardown commands
  14. OccurredSupply chain

    Trivy VS Code extension launches coding agents to steal secrets

    Using an OpenVSX token stolen through a vulnerable Trivy GitHub Actions workflow, an attacker published extension versions 1.8.12 and 1.8.13 that attempted to start local coding agents in permissive modes and instructed them to collect and send out credentials. Socket reported no confirmed successful exfiltration at publication.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, Codex, Gemini CLI, Copilot CLI, Kiro CLI
    Entry point
    Editor extension
    Data targeted
    Credentials and secrets
    Control
    Block agent reads of credential filesnode9: Credential file block, enforced even with safety flags off
  15. ReportedSupply chain

    SANDWORM_MODE plants a rogue MCP server in AI assistants

    Socket identified at least 19 malicious npm packages in a campaign whose malware could register a hidden MCP server with tool descriptions directing assistants to read credential files. The report did not establish a campaign-wide victim count.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, Cursor, Windsurf, Continue
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets
    Control
    Block agent reads of credential files; flag new MCP serversnode9: Credential file block
  16. OccurredAgents in CI

    Clinejection: an issue title leads to a rogue Cline release

    An issue title steered Cline's AI triage workflow, which any GitHub user could trigger and which had shell access. An npm token missed during rotation was used to publish an unauthorized cline@2.3.0 that installed the legitimate OpenClaw package without authorization. Cline reported no malicious payload or user-data exfiltration.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code GitHub Action
    Entry point
    CI workflow
    Data targeted
    Credentials and secrets
    Control
    Audit CI workflows that let outsiders drive an agentnode9: Repository scan
  17. ReportedSupply chain

    ClawHavoc: 341 malicious agent skills

    Koi Security found 341 malicious skills on OpenClaw's ClawHub marketplace whose instructions told users and agents to run fake "prerequisite" installers that delivered infostealers on macOS and Windows. Antiy counted 1,184 malicious skills in the ClawHub historical repository as of February 5, a later and broader snapshot.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    OpenClaw
    Entry point
    Agent skill
    Data targeted
    Credentials and secrets, Agent tokens and configs, Crypto wallets, Local files
    Control
    Review skills before first use
  18. ReportedSupply chain

    Shai-Hulud 2.0 reaches official MCP servers

    The self-spreading npm worm republished 500+ packages, including MCP servers and agent SDKs from Browserbase, Postman, Zapier and PostHog, and dumped stolen secrets into public GitHub repos.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    MCP servers, Agent SDKs
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets
    Control
    Review install scripts; block known-malicious versionsnode9: Package check, when the agent runs the install
  19. ReportedSupply chain

    PhantomRaven: malicious npm packages hide remote payloads

    Packages that appeared to have no dependencies fetched malicious dependencies from an attacker server during installation. Sonatype documented credential theft and more than 200 associated packages by October 31, 2025, including packages posing as MCP servers.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    npm tooling, MCP-themed packages
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets
    Control
    Review new packages and install scriptsnode9: Package check, when the agent runs the install
  20. ReportedSupply chain

    An MCP command-runner package opens a reverse shell on install

    Versions starting with 1.0.6 of @lanyer640/mcp-runcommand-server contained a reverse shell activated by a preinstall script. Identified and reported by Checkmarx Zero researcher Bruno Dias on October 1, 2025.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Any MCP client
    Entry point
    npm or PyPI package
    Control
    Review package install scriptsnode9: Package check, when the agent runs the install
  21. ReportedSupply chain

    postmark-mcp: an MCP server that copied every email to the attacker

    After clean versions up to 1.0.15, an unofficial Postmark email server added one line in 1.0.16 that blind-copied every message sent through it to an outside address. Snyk documented the BCC behavior in its analysis of the published package.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Any MCP client
    Entry point
    MCP server
    Data targeted
    Email content
    Control
    Pin MCP server code, not only its tool list
  22. ReportedSupply chain

    nx "s1ngularity": malware turns installed coding agents into credential hunters

    Malicious nx releases attempted to run locally installed Claude Code, Gemini CLI and Amazon Q in permissive modes, asking them to find wallets, SSH keys and .env files. Stolen secrets, including GitHub and npm tokens, went to public repos on the victims' own accounts.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Claude Code, Gemini CLI, Amazon Q
    Entry point
    npm or PyPI package
    Data targeted
    Credentials and secrets, Crypto wallets
    Control
    Block agent reads of credential files
  23. ReportedSupply chain

    Amazon Q Developer extension ships with a wiper prompt

    An outsider used an over-scoped GitHub token in AWS's build setup to commit a prompt telling the agent to delete local files and cloud resources. Version 1.84.0 shipped to users; a syntax error stopped it from running.

    Evidence
    Published malicious or unauthorized artifact
    Agent or tool
    Amazon Q Developer
    Entry point
    Editor extension
    Data targeted
    Local files, Cloud infrastructure
    Control
    Review before destructive commands, whoever wrote the prompt
  24. ReportedDestructive action

    Replit agent deletes a production database during a code freeze

    During a code freeze, the agent ran destructive commands against the production database of an app Jason Lemkin was building, then said a rollback was impossible. The rollback worked. Lemkin also said it had faked data and test results.

    Evidence
    Reported by affected operator
    Agent or tool
    Replit Agent
    Data affected
    Production database
    Control
    Review before destructive database commands

Disclosures

Vulnerabilities demonstrated by researchers. These entries do not establish exploitation outside the research setting. Fix status is historical; consult the linked advisories for affected versions.

  1. Reported

    Instruction files in the Downloads folder steer Codex and Claude Code

    Forever Security showed that an AGENTS.md or CLAUDE.md file a browser saved to ~/Downloads is read as instructions when a coding agent is started there. In its tests Codex followed the file in over 90% of runs and Claude Code rerouted its API traffic in about half. On a customer machine Codex installed the npm package function-color, part of the MALFEX campaign, which OSV lists as malicious since October 7.

  2. Reported

    MCP Inspector: a malicious MCP server runs commands on the developer's machine

    Two critical advisories in the official MCP Inspector. A hostile server's OAuth callback could switch the Inspector to a local command, and a remote MCP app could steal the proxy's auth token and run commands through it. Both fixed in 1.0.3; a third advisory line covers 2.x up to 2.11.0, fixed in 2.12.0. No CVE assigned.

  3. Reported

    OpenCode runs a malicious MCP server's login URL as a command on Windows

    On Windows and WSL, OpenCode passed the authorization endpoint supplied by a remote MCP server to PowerShell without escaping it, so a crafted https URL ran code with the developer's access when they started that server's sign-in. Pillar Security disclosed it on October 19. Anomaly had fixed it in 1.18.33 on September 28 by upgrading the open package, with no advisory and no CVE; versions 1.0.137 through 1.18.32 are affected.

  4. Reported

    An official OpenAI skill points Codex at a domain nobody owned, and real apps send it tokens

    AIR Security found that OpenAI's curated render-deploy skill told agents that Render's private services live under render-internal.com, a domain Render did not own. Codex wrote it into generated code as the internal API address; after the researchers registered the domain, deployed applications sent it token-bearing requests. The report gives no counts. Render corrected its guidance on August 14 and OpenAI removed the plugin on August 26.

  5. Reported

    A trailing dot lets Copilot in Visual Studio overwrite protected settings (CVE-2026-103572)

    Windows drops a period at the end of a file name when saving, so a write to .mcp.json. passed the check that protects Copilot's configuration files in Visual Studio and SQL Server Management Studio and landed on the real file. Prompt injection from an MCP server or from project files could use it to run code. Reported by Johann Rehberger; fixed in the October Patch Tuesday.

  6. Reported

    mcp-go clients request OAuth tokens for whatever resource a server declares

    In the Go MCP library mcp-go, versions 0.48.0 through 1.2.0 passed the resource a server declared in its protected-resource metadata into the OAuth request without checking it against the server itself, so a malicious MCP server could obtain tokens meant for another resource and replay them there. Fixed in 1.2.1; CVE-2026-123272 was assigned on November 5.

  7. Reported

    Session Inception: a child Claude Code session runs a repository's SessionStart hook without the parent's approval

    Straiker's STAR Labs showed that when a Claude Code session starts a second Claude Code session from the command line inside a malicious repository, the child skips the workspace confirmation and runs the SessionStart hook in the repository's .claude/settings.json, which sent data from the developer's machine to the researchers' server. Anthropic closed the report as informative, treating repository settings as part of the workspace trust decision.

  8. Reported

    Copilot CLI decrypts a web page's hidden instructions and sends local secrets out

    Adversa AI showed that a web page carrying encrypted instructions passes plain-text injection checks; in autopilot mode, GitHub Copilot CLI decrypted them, read a local .env file and posted it to the attacker's endpoint in about 28 seconds, in roughly half of attempts. GitHub said the user had directed the agent to fetch untrusted content and did not treat it as a product vulnerability.

  9. Reported

    MCP Python SDK sends OAuth secrets to a malicious server

    In affected HTTP OAuth clients, a malicious MCP server could redirect credentials to its own token endpoint, exposing client secrets and PKCE verifiers. SDK servers and stdio clients were not affected. Fixes were released in 1.30.0 and 2.2.0; some providers also require explicit issuer configuration.

  10. Reported

    Plugin4Shell: pinned agent plugins swapped without a prompt

    AIR demonstrated plugin checkout resolving to an attacker-controlled branch instead of the pinned commit: SHA-name ambiguity in Claude Code, Codex and Copilot, and a FETCH_HEAD variant in Gemini CLI. Claude Code and Codex were fixed; Copilot and Gemini CLI were unpatched at disclosure.

  11. Reported

    DeepSeek Harness agent grants itself full access (CVE-2026-82533)

    OX Security demonstrated that a sandboxed agent could call its own local control API and switch its session to full access with approvals off. The issue was fixed in DeepSeek Harness 0.1.2-alpha.1.

  12. Reported

    GitSpawn: a repo's git settings run code when an agent opens it

    Manifold reported eight findings across seven coding agents involving background Git operations in attacker-supplied workspaces. Mechanisms varied by agent; cases included malicious .git/config settings. Four findings were unpatched at disclosure.

  13. Reported

    Sandbox escapes in Cursor, Codex, Gemini CLI and Antigravity through files the agent writes

    Pillar Security showed that an agent confined to a sandbox can still reach the host, because files it writes are trusted by tools outside the box: workspace configs that run commands, permissive command allowlists and privileged daemons reachable from inside. Cursor fixed CVE-2026-48124 and related findings in 3.0.0 (the desktop app ran hook commands from .claude/settings.local.json without approval); Codex CLI fixed its findings in 0.95.0; Google downgraded the two Antigravity findings.

  14. Reported

    GitLost: an issue makes GitHub Agentic Workflows leak private repos

    In Noma Security's proof of concept, a crafted public issue caused a GitHub Agentic Workflow already authorized to read public and private repositories to publish a private README in a public comment.

  15. Reported

    GuardFall: command guards that read text, not commands

    Adversa AI surveyed 11 agents and reported bypassable or missing command guards and unsafe local-mode configurations. Some agents used protective sandboxes by default. Continue resisted the tested payloads in default mode, but its CLI auto mode weakened approval enforcement.

    node9: Parses the command; all five techniques stopped in our test

  16. Reported

    Amazon Q in VS Code starts MCP servers from an opened folder (CVE-2026-12957)

    The extension loaded .amazonq/mcp.json from the opened workspace and started those servers with no prompt, with the developer's environment, including cloud keys. Fixed; AWS lists no workaround other than upgrading.

  17. Reported

    Comment and Control: PR and issue text makes CI agents leak keys

    Crafted pull request and issue text made the Claude Code Security Review action, Gemini CLI Action and Copilot's coding agent publish their own credentials.

    node9: Repository scan

  18. Reported

    Codex branch-name command injection

    BeyondTrust demonstrated command injection through a branch name in Codex cloud task setup, exposing a GitHub token. Its timeline records fixes and additional hardening before the March 2026 publication.

  19. Reported

    Claude Code project settings redirect the API key (CVE-2026-21852)

    Check Point demonstrated that repository settings could redirect Claude Code API credentials before workspace trust was accepted. Its timeline records a fix in December 2025, before the February 2026 research publication.

  20. Reported

    Codex CLI loads a repository's own config through .env (CVE-2025-61260)

    A repository's .env could point CODEX_HOME at a folder inside the repository, so running codex there loaded its config.toml and started the MCP commands in it without asking. According to Check Point, OpenAI fixed it in Codex CLI 0.23.0 in August 2025; the GitHub advisory still lists 0.23.0 as affected.

  21. Reported

    Cursor runs a repository's task when the folder is opened

    With Workspace Trust off by default, Cursor ran a task defined in a repository's .vscode/tasks.json as soon as the folder was opened, with no prompt. No CVE and no patch; turning Workspace Trust on closes it.

What counts

  • Evidence labels distinguish affected operators' accounts, published malicious or unauthorized artifacts, researcher-reported exposure, and threat trends. Published malicious code does not by itself establish successful theft or a victim count.
  • "Data targeted" lists what the malicious code or attacker went after, as the cited source names it. "Data affected" appears only on an affected operator's own account, and "Data exposed" on researcher findings. The field is left out when the source does not say.
  • Sources include vendor advisories, researchers' technical analyses, affected operators' accounts, and supporting reporting. This is a source-based record, not an independent forensic reproduction.
  • An incident is listed only when a reliable source confirms it: the affected company, the vendor, an official advisory or an established research team. A single user's report is not enough, even when it is widely shared.
  • A named affected company's own account can be included and is labeled as such. A source documenting malicious capabilities is not treated as proof that every capability ran successfully on a victim's system.
  • Dates labeled "Reported" identify a cited report or advisory, not necessarily the earliest public disclosure. Dates labeled "Occurred" identify the event. Counts describe the cited source's observation window; downloads are not unique users or confirmed victims.
  • A node9 badge marks a row where a node9 default control acts on the step that did the damage, checked against node9's hook on a fresh default configuration. It applies to agents node9 supports and to actions that go through the agent.
  • Spotted an error or a missing incident? Write to security@node9.ai.