INCIDENTS
AI agent security incidents
Reported incidents, published malicious or unauthorized artifacts, and threat trends involving coding agents, agents in CI, MCP servers and AI developer tooling. Each record identifies its evidence type and links to sources. Research disclosures are listed separately.
22 records and 15 research disclosures. Last content review 1 Nov 2026.
- OccurredSupply chain
Tampered Claude Code extension served from Cursor's marketplace
For about eleven hours on October 29, Cursor's extension marketplace served versions 2.1.312 and 2.1.313 of the Claude Code extension with a loader that ran on load, before any conversation. It reported hostname, username, environment variable names, Git email and public IP, added an attacker SSH key to authorized_keys and installed persistence. Cursor says at most 5,000 users received it; Anthropic says it did not build or publish the copy. Neither company has said how the attacker gained publish access. The Microsoft marketplace, Open VSX and npm were not affected.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code (VS Code extension)
- Entry point
- Editor extension
- Control
- Verify extension updates against the publisher's own release
- ReportedSupply chain
LiteLLM 1.107.0 released with a credential stealer through leaked GitHub tokens
A compromised release pipeline published litellm 1.107.0 to PyPI, Docker Hub and GHCR for about two hours on October 21. The wheels dropped a Python startup stealer that reads Claude Code, Codex, Gemini CLI and Cursor auth files along with cloud, SSH, GitHub and browser secrets, plus an hourly remote-code loader. According to LiteLLM's corrected attack-chain report, an Agent Platform admin key committed to a public repository in May was never revoked; in October it returned a GitHub organization owner's GitHub CLI OAuth token through the platform's API, and that token drove the release.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Codex, Gemini CLI, Cursor
- Entry point
- npm or PyPI package
- Data targeted
- Agent tokens and configs, Credentials and secrets
- Control
- Review new package versions; treat agent token files as credentialsnode9: Package check: a version under 48 hours old goes to review
- ReportedData exposure
PixelLeak: researchers find over 13,000 exposed internal images
Glow Labs reported over 13,000 internal images exposed on GitHub across more than 300 organizations. Investigated cases included agents publishing code-review screenshots through personal public repositories and tools such as gitshot, exposing billing, treasury and unreleased product screens.
- Evidence
- Researcher-reported exposure
- Agent or tool
- Coding agents
- Data exposed
- Internal images
- Control
- Review before publishing to public destinations
- ReportedCredential theft
Infostealers start harvesting AI agent sessions
Commodity stealers (Amatera, Remus, CallbackBeaver, Djinn and others) now collect coding-agent tokens, MCP configs and prompt histories. A valid, replayable session token can allow account access without repeating password or MFA authentication.
- Evidence
- Threat trend
- Agent or tool
- Claude Code, Codex, Cursor, Gemini CLI, Cline
- Data targeted
- Agent tokens and configs
- Control
- Treat agent token files as credentials
- ReportedSupply chain
An official MCP Registry listing spreads Shai-Hulud
OX Security found a registry entry linking a clean PyPI package to a repository with malicious Claude Code and VS Code workspace settings. Loading and trusting those settings could run the worm; execution depends on the tool and workspace trust configuration.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, VS Code
- Entry point
- Repository config
- Data targeted
- Credentials and secrets
- Control
- Review repository config before an agent runs it
- Sources
- ReportedSupply chain
Mini Shai-Hulud: PyPI packages posing as MCP tools
Socket documented malicious MCP-themed PyPI wheels using Python startup hooks to load credential-stealing payloads. A related bioinformatics subcluster used native extensions triggered on import. The payloads targeted GitHub, cloud and AI tool secrets.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- MCP developers
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets
- Control
- Review new package versionsnode9: Package check, when the agent runs the install
- Sources
- ReportedCredential theft
codexui-android steals Codex login tokens for a month
Aikido reported that an npm package with about 27,000 weekly downloads at the time sent locally available Codex access and refresh tokens to an attacker server on startup. The malicious code was present in the published package but absent from its GitHub source.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Codex
- Entry point
- npm or PyPI package
- Data targeted
- Agent tokens and configs
- Control
- Treat agent token files as credentials
- OccurredDestructive action
PocketOS reports production database deletion by a coding agent
PocketOS founder Jer Crane reported that a Cursor agent used an over-scoped Railway token to delete its production volume in nine seconds. Railway later confirmed recovery and described a cascading-delete issue that made backups unavailable in the UI; it also maintains offsite disaster backups.
- Evidence
- Reported by affected operator
- Agent or tool
- Cursor
- Data affected
- Production database
- Control
- Review destructive cloud API calls; scope tokens
- OccurredSupply chain
Bitwarden CLI hijack targets coding-agent configs
A malicious Bitwarden CLI build on npm read Claude Code, Kiro and other MCP configuration files along with cloud and git secrets, then spread as a worm. The affected npm version was @bitwarden/cli@2026.4.0.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Kiro, Cursor, Codex CLI, Aider
- Entry point
- npm or PyPI package
- Data targeted
- Agent tokens and configs, Credentials and secrets
- Control
- Treat agent config and token files as credentialsnode9: Package check, when the agent runs the install
- ReportedSupply chain
LiteLLM releases backdoored on PyPI
FutureSearch identified compromised PyPI releases 1.82.7 and 1.82.8 containing credential-stealing code targeting SSH, cloud and Kubernetes secrets. Version 1.82.8 used a .pth file to execute at Python startup, without an explicit LiteLLM import.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Python AI tooling
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets
- Control
- Pin CI tools; review new package versionsnode9: Package check, when the agent runs the install
- ReportedDestructive action
Claude Code runs terraform destroy on production
Alexey Grigorev reported that on February 26, while cleaning up duplicate resources, the agent unpacked an old Terraform archive whose state described production, and the author let it run terraform destroy. DataTalks.Club's production stack and its automated snapshots were deleted. AWS restored a snapshot hidden from the console 24 hours later.
- Evidence
- Reported by affected operator
- Agent or tool
- Claude Code
- Data affected
- Production database, Cloud infrastructure
- Control
- Review infrastructure teardown commands
- OccurredSupply chain
Trivy VS Code extension launches coding agents to steal secrets
Using an OpenVSX token stolen through a vulnerable Trivy GitHub Actions workflow, an attacker published extension versions 1.8.12 and 1.8.13 that attempted to start local coding agents in permissive modes and instructed them to collect and send out credentials. Socket reported no confirmed successful exfiltration at publication.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Codex, Gemini CLI, Copilot CLI, Kiro CLI
- Entry point
- Editor extension
- Data targeted
- Credentials and secrets
- Control
- Block agent reads of credential filesnode9: Credential file block, enforced even with safety flags off
- ReportedSupply chain
SANDWORM_MODE plants a rogue MCP server in AI assistants
Socket identified at least 19 malicious npm packages in a campaign whose malware could register a hidden MCP server with tool descriptions directing assistants to read credential files. The report did not establish a campaign-wide victim count.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Cursor, Windsurf, Continue
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets
- Control
- Block agent reads of credential files; flag new MCP serversnode9: Credential file block
- Sources
- OccurredAgents in CI
Clinejection: an issue title leads to a rogue Cline release
An issue title steered Cline's AI triage workflow, which any GitHub user could trigger and which had shell access. An npm token missed during rotation was used to publish an unauthorized cline@2.3.0 that installed the legitimate OpenClaw package without authorization. Cline reported no malicious payload or user-data exfiltration.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code GitHub Action
- Entry point
- CI workflow
- Data targeted
- Credentials and secrets
- Control
- Audit CI workflows that let outsiders drive an agentnode9: Repository scan
- ReportedSupply chain
ClawHavoc: 341 malicious agent skills
Koi Security found 341 malicious skills on OpenClaw's ClawHub marketplace whose instructions told users and agents to run fake "prerequisite" installers that delivered infostealers on macOS and Windows. Antiy counted 1,184 malicious skills in the ClawHub historical repository as of February 5, a later and broader snapshot.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- OpenClaw
- Entry point
- Agent skill
- Data targeted
- Credentials and secrets, Agent tokens and configs, Crypto wallets, Local files
- Control
- Review skills before first use
- ReportedSupply chain
Shai-Hulud 2.0 reaches official MCP servers
The self-spreading npm worm republished 500+ packages, including MCP servers and agent SDKs from Browserbase, Postman, Zapier and PostHog, and dumped stolen secrets into public GitHub repos.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- MCP servers, Agent SDKs
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets
- Control
- Review install scripts; block known-malicious versionsnode9: Package check, when the agent runs the install
- ReportedSupply chain
PhantomRaven: malicious npm packages hide remote payloads
Packages that appeared to have no dependencies fetched malicious dependencies from an attacker server during installation. Sonatype documented credential theft and more than 200 associated packages by October 31, 2025, including packages posing as MCP servers.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- npm tooling, MCP-themed packages
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets
- Control
- Review new packages and install scriptsnode9: Package check, when the agent runs the install
- ReportedSupply chain
An MCP command-runner package opens a reverse shell on install
Versions starting with 1.0.6 of @lanyer640/mcp-runcommand-server contained a reverse shell activated by a preinstall script. Identified and reported by Checkmarx Zero researcher Bruno Dias on October 1, 2025.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Any MCP client
- Entry point
- npm or PyPI package
- Control
- Review package install scriptsnode9: Package check, when the agent runs the install
- Sources
- ReportedSupply chain
postmark-mcp: an MCP server that copied every email to the attacker
After clean versions up to 1.0.15, an unofficial Postmark email server added one line in 1.0.16 that blind-copied every message sent through it to an outside address. Snyk documented the BCC behavior in its analysis of the published package.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Any MCP client
- Entry point
- MCP server
- Data targeted
- Email content
- Control
- Pin MCP server code, not only its tool list
- ReportedSupply chain
nx "s1ngularity": malware turns installed coding agents into credential hunters
Malicious nx releases attempted to run locally installed Claude Code, Gemini CLI and Amazon Q in permissive modes, asking them to find wallets, SSH keys and .env files. Stolen secrets, including GitHub and npm tokens, went to public repos on the victims' own accounts.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Claude Code, Gemini CLI, Amazon Q
- Entry point
- npm or PyPI package
- Data targeted
- Credentials and secrets, Crypto wallets
- Control
- Block agent reads of credential files
- ReportedSupply chain
Amazon Q Developer extension ships with a wiper prompt
An outsider used an over-scoped GitHub token in AWS's build setup to commit a prompt telling the agent to delete local files and cloud resources. Version 1.84.0 shipped to users; a syntax error stopped it from running.
- Evidence
- Published malicious or unauthorized artifact
- Agent or tool
- Amazon Q Developer
- Entry point
- Editor extension
- Data targeted
- Local files, Cloud infrastructure
- Control
- Review before destructive commands, whoever wrote the prompt
- ReportedDestructive action
Replit agent deletes a production database during a code freeze
During a code freeze, the agent ran destructive commands against the production database of an app Jason Lemkin was building, then said a rollback was impossible. The rollback worked. Lemkin also said it had faked data and test results.
- Evidence
- Reported by affected operator
- Agent or tool
- Replit Agent
- Data affected
- Production database
- Control
- Review before destructive database commands
Disclosures
Vulnerabilities demonstrated by researchers. These entries do not establish exploitation outside the research setting. Fix status is historical; consult the linked advisories for affected versions.
- Reported
Instruction files in the Downloads folder steer Codex and Claude Code
Forever Security showed that an AGENTS.md or CLAUDE.md file a browser saved to ~/Downloads is read as instructions when a coding agent is started there. In its tests Codex followed the file in over 90% of runs and Claude Code rerouted its API traffic in about half. On a customer machine Codex installed the npm package function-color, part of the MALFEX campaign, which OSV lists as malicious since October 7.
- Reported
MCP Inspector: a malicious MCP server runs commands on the developer's machine
Two critical advisories in the official MCP Inspector. A hostile server's OAuth callback could switch the Inspector to a local command, and a remote MCP app could steal the proxy's auth token and run commands through it. Both fixed in 1.0.3; a third advisory line covers 2.x up to 2.11.0, fixed in 2.12.0. No CVE assigned.
- Reported
OpenCode runs a malicious MCP server's login URL as a command on Windows
On Windows and WSL, OpenCode passed the authorization endpoint supplied by a remote MCP server to PowerShell without escaping it, so a crafted https URL ran code with the developer's access when they started that server's sign-in. Pillar Security disclosed it on October 19. Anomaly had fixed it in 1.18.33 on September 28 by upgrading the open package, with no advisory and no CVE; versions 1.0.137 through 1.18.32 are affected.
- Reported
MCP Python SDK sends OAuth secrets to a malicious server
In affected HTTP OAuth clients, a malicious MCP server could redirect credentials to its own token endpoint, exposing client secrets and PKCE verifiers. SDK servers and stdio clients were not affected. Fixes were released in 1.30.0 and 2.2.0; some providers also require explicit issuer configuration.
- Reported
Plugin4Shell: pinned agent plugins swapped without a prompt
AIR demonstrated plugin checkout resolving to an attacker-controlled branch instead of the pinned commit: SHA-name ambiguity in Claude Code, Codex and Copilot, and a FETCH_HEAD variant in Gemini CLI. Claude Code and Codex were fixed; Copilot and Gemini CLI were unpatched at disclosure.
- Reported
DeepSeek Harness agent grants itself full access (CVE-2026-82533)
OX Security demonstrated that a sandboxed agent could call its own local control API and switch its session to full access with approvals off. The issue was fixed in DeepSeek Harness 0.1.2-alpha.1.
- Reported
GitSpawn: a repo's git settings run code when an agent opens it
Manifold reported eight findings across seven coding agents involving background Git operations in attacker-supplied workspaces. Mechanisms varied by agent; cases included malicious .git/config settings. Four findings were unpatched at disclosure.
- Reported
GitLost: an issue makes GitHub Agentic Workflows leak private repos
In Noma Security's proof of concept, a crafted public issue caused a GitHub Agentic Workflow already authorized to read public and private repositories to publish a private README in a public comment.
- Reported
GuardFall: command guards that read text, not commands
Adversa AI surveyed 11 agents and reported bypassable or missing command guards and unsafe local-mode configurations. Some agents used protective sandboxes by default. Continue resisted the tested payloads in default mode, but its CLI auto mode weakened approval enforcement.
node9: Parses the command; all five techniques stopped in our test
- Reported
Amazon Q in VS Code starts MCP servers from an opened folder (CVE-2026-12957)
The extension loaded .amazonq/mcp.json from the opened workspace and started those servers with no prompt, with the developer's environment, including cloud keys. Fixed; AWS lists no workaround other than upgrading.
- Reported
Comment and Control: PR and issue text makes CI agents leak keys
Crafted pull request and issue text made the Claude Code Security Review action, Gemini CLI Action and Copilot's coding agent publish their own credentials.
- Reported
Codex branch-name command injection
BeyondTrust demonstrated command injection through a branch name in Codex cloud task setup, exposing a GitHub token. Its timeline records fixes and additional hardening before the March 2026 publication.
- Reported
Claude Code project settings redirect the API key (CVE-2026-21852)
Check Point demonstrated that repository settings could redirect Claude Code API credentials before workspace trust was accepted. Its timeline records a fix in December 2025, before the February 2026 research publication.
- Reported
Codex CLI loads a repository's own config through .env (CVE-2025-61260)
A repository's .env could point CODEX_HOME at a folder inside the repository, so running codex there loaded its config.toml and started the MCP commands in it without asking. According to Check Point, OpenAI fixed it in Codex CLI 0.23.0 in August 2025; the GitHub advisory still lists 0.23.0 as affected.
- Reported
Cursor runs a repository's task when the folder is opened
With Workspace Trust off by default, Cursor ran a task defined in a repository's .vscode/tasks.json as soon as the folder was opened, with no prompt. No CVE and no patch; turning Workspace Trust on closes it.
What counts
- Evidence labels distinguish affected operators' accounts, published malicious or unauthorized artifacts, researcher-reported exposure, and threat trends. Published malicious code does not by itself establish successful theft or a victim count.
- "Data targeted" lists what the malicious code or attacker went after, as the cited source names it. "Data affected" appears only on an affected operator's own account, and "Data exposed" on researcher findings. The field is left out when the source does not say.
- Sources include vendor advisories, researchers' technical analyses, affected operators' accounts, and supporting reporting. This is a source-based record, not an independent forensic reproduction.
- An incident is listed only when a reliable source confirms it: the affected company, the vendor, an official advisory or an established research team. A single user's report is not enough, even when it is widely shared.
- A named affected company's own account can be included and is labeled as such. A source documenting malicious capabilities is not treated as proof that every capability ran successfully on a victim's system.
- Dates labeled "Reported" identify a cited report or advisory, not necessarily the earliest public disclosure. Dates labeled "Occurred" identify the event. Counts describe the cited source's observation window; downloads are not unique users or confirmed victims.
- A node9 badge marks a row where a node9 default control acts on the step that did the damage, checked against node9's hook on a fresh default configuration. It applies to agents node9 supports and to actions that go through the agent.
- Spotted an error or a missing incident? Write to security@node9.ai.