Failure mode

Security Vulnerability

33 documented incidents where AI agents exhibited security vulnerability.
10.0
An AI vendor's automated evaluation sandbox was prompt-injected into handing over its production API keys for multiple AI providers, which the attacker then used against the vendor and ~30 other AI companies (Anthropic GTG-50020)
10.0
Vibe-coded Tea app leaked 72,000 IDs and selfies plus 1.1M private messages from an unsecured bucket
9.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
9.0
OpenAI's own cybersecurity-evaluation agents broke out of their sandbox, chained zero-days, and compromised Hugging Face's production infrastructure trying to win an impossible benchmark
9.0
Cursor's terminal sandbox trusted an agent-set working directory, letting zero-click prompt injection escape it and gain code execution (CVE-2026-50548)
9.0
A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it
9.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
9.0
Vibe-coded Moltbook exposed 1.5M API keys and 35,000 user emails via misconfigured database
9.0
Malicious npm packages used locally installed Claude, Gemini and Amazon Q CLIs to hunt developer secrets in the s1ngularity supply-chain attack
9.0
Hacker slipped a data-wiping prompt into Amazon Q's VS Code extension, shipped to ~1M installs
9.0
EchoLeak: a zero-click email silently exfiltrated data from Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3)
9.0
Lovable-generated apps shipped without adequate Supabase row-level security, leaving databases readable and writable by anyone (CVE-2025-48757)
8.0
Self-propagating npm worm plants persistence in Claude Code's hook files to survive credential rotation (ChainDrop / keyv supply-chain attack)
8.0
Malicious cloned repository triggered code execution in Cursor on Windows
8.0
Claude Code's git worktree handling let a malicious repo escape the sandbox via symlink and fsmonitor tricks, overwriting shell init files (CVE-2026-55607)
8.0
Symlink-hijack lets a booby-trapped repo overwrite config in Claude Code, Gemini CLI, Cursor, Copilot CLI, Grok Build and Codex (SymJack)
8.0
GitHub Copilot CLI ran arbitrary attacker commands via a nested bare git repository abusing core.fsmonitor (CVE-2026-45033)
8.0
A security researcher found 16 vulnerabilities — including inverted access-control logic — in a Lovable-generated EdTech app, exposing 18,697 users' records and letting anyone delete accounts or grade exams
8.0
GitHub Copilot suggested 2,702 valid secrets — 33% of extracted keys were real, live credentials
8.0
Claude Code's read-only command check could be tricked by $IFS and short-flag shell parsing into approving arbitrary code execution
8.0
Scan of 5,600 vibe-coded apps found 2,000+ high-impact vulns, 400+ exposed secrets, PII leaksStudy
8.0
CamoLeak: hidden prompt injection turned GitHub Copilot Chat into a silent code/secret exfiltration channel (CVSS 9.6)
8.0
A hidden comment made GitLab Duo leak private source code and inject rogue HTML
8.0
Rule Files Backdoor: hidden Unicode in config files made Copilot and Cursor emit malicious code
8.0
Slack AI could be tricked into leaking private-channel data via indirect prompt injection
7.0
Claude Code's "dangerous rm" safety check is spelling-dependent — the MSYS form of a Windows path bypasses the approval gate entirely (GitHub #100630)
7.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
7.0
Claude Code leaked API keys via malicious repo settings before trust prompt
6.0
Aider leaks model-provider API keys to child processes spawned via /run, /test, lint commands, and /git
6.0
Claude Code loaded managed config from a world-writable Windows path, enabling local privilege escalation (CVE-2026-35603)
6.0
Claude Code MCP trust boundary failures allow workspace privilege escalation
5.0
Manus AI leaked its own system prompt when a user simply asked it to read its internal directory
4.0
Claude Opus 4.5 leaked API key in console logs during YouTube scraper build