All AI Agent Incidents

Overwriting the user's shell init file gave an attacker unsandboxed, arbitrary code execution the next time a shell started, with full confidentiality, integrity, and availability impact (CVSS v4.0 7.7, High: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H). Exploitation required the user to clone a malicious repository and run Claude Code against it. Reported by security researcher metnew via HackerOne; fixed in Claude Code 2.1.163, with users on standard auto-update receiving the fix automatically.

Four rounds of total config-directory loss over about three weeks, including one wipe that destroyed 19 live API token files and required regenerating credentials, plus repeated loss of months of session history, hooks, and settings needing manual reconstruction each time. The reporter linked the pattern to two older, still-open issues describing the same root behavior on other subfolders — #41415 (~/.claude/agents/ silently deleted by Claude Code's own node process) and #34330 (~/.claude/skills/ cleared within ~300ms of file creation) — meaning this bug class has gone unfixed for over five months and has now escalated from deleting agent/skill files to deleting the whole config directory, secrets included. Filed with labels area:core, bug, data-loss, has repro, and platform:windows; open with no maintainer response as of publication.

Any file a user places in `~/.claude/sessions/` with a digit-leading name — the reporter's own repro used a plain date-stamped notes file — is permanently unlinked rather than trashed, with no restore path. The bug reproduces on native Linux and macOS (WSL is the one platform explicitly skipped in the code), meaning the routine runs this way for the large majority of Claude Code's user base on every session start, autocompact, and periodic sweep — not as a one-off edge case. The reporter filed the issue with the exact vulnerable function, a minimal repro, and a one-line fix (validate the filename against `/^\d+\.json$/` before treating it as a PID file); labeled `bug`, `data-loss`, and `high-priority` by the maintainers, the issue was closed with zero comments and no visible maintainer response, fix, or explanation.

Permanent loss of the user's Desktop and media folders, part of Downloads, shell history, SSH keys, and the macOS login keychain, which also broke iCloud sign-in. Nothing was recoverable from Trash. The reporter filed a support ticket with Anthropic and made the affected session IDs available for server-side investigation, since no command audit trail existed locally. Filed with labels area:bash, area:desktop, area:sandbox, bug, data-loss, high-priority, and platform:macos; open with no root cause or maintainer response as of publication.

Production AI API keys for multiple providers exfiltrated from a live vendor environment and actively abused — attack workloads billed to the victim, and the victim's identity used as cover for intrusions against ~30 further AI companies. Anthropic classes the case as "the clearest demonstration to date that the AI supply chain has become a deliberate criminal target." The actor's stated end goal, a pre-release Claude model, was never reached; Anthropic's own systems were not compromised. Attacker egress activity in the report's IoC table spans 2026-05-21 to 2026-06-16.

All resumable conversation history for the affected workspace older than the current session was permanently lost, including the prior day's session, with no way to view, resume, or recover it — the built-in cleanup has no restore mechanism and macOS Trash was bypassed. The reporter documented the loss with file-level evidence: a `.last-cleanup` timestamp update at 13:13:20 PT matching the deletion window, orphaned subagent transcript directories left with no parent session file, and a file-history log confirming six sessions from the prior day had vanished entirely from disk. Filed by the affected user (FTSBrand) with labels `area:core`, `bug`, `data-loss`, and `has repro`; open with no maintainer response as of publication.

Rated CVSS 8.5 (High; AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H). An attacker who could get a nested bare repository into a project — via a pull request, a compromised dependency, or any tree Copilot CLI was pointed at — could achieve arbitrary code execution on the developer's machine, with full confidentiality, integrity, and availability impact. Affected npm package @github/copilot versions up to and including 1.0.42; fixed in 1.0.43 by setting `safe.bareRepository=explicit` to stop automatic bare-repository discovery.

The user's entire hard drive was wiped. The report does not state whether any of the drive's contents were recovered from backups or other means; no OpenAI staff response or remediation is visible on the issue thread.

Filed by the affected user (aniruddhaadak80) with an exact reproduction command and the specific source location (`aider/main.py`) and exception path identified, along with two concrete fix proposals. Open with no maintainer response as of publication, no labels applied. No specific downstream production incident was reported alongside the filing, but the failure mode is directly damaging to any headless automation pipeline that scripts Aider with slash commands and gates subsequent steps on its exit code: a `/model` switch that silently never happens, or an `/ask` that silently never runs, is indistinguishable from success. It is the same silent-success shape as three other Aider issues filed in the preceding weeks — #5486 (STUPID-2026-0082), #5573 (STUPID-2026-0080), and #5552 (STUPID-2026-0081) — a fourth distinct code path in headless mode where the tool reports success while having done nothing.

1,068 files in the repository root (the command's working directory) were permanently deleted; `del` is non-recursive so subdirectories survived. 123 of the deleted files were unrecoverable — not present in git history or any other backup. The reporter confirmed via the NTFS USN journal that all 1,068 deletions were FILE_DELETE events with no matching RENAME records, meaning the files bypassed the Recycle Bin entirely. Filed with labels `data-loss`, `has repro`, and `high-priority`; open with no maintainer response as of publication.

The developer's entire Mac home directory was destroyed: years of project files, personal photos, SSH keys, git config, and every credential stored in Keychain. Because the drive was an SSD with TRIM enabled, freed blocks were zeroed at the controller level, so no forensic or file-recovery tool could bring anything back. The user reported no successful recovery.

Rated CVSS 9.8 (3.1) / 9.3 (4.0), critical. Any content an agent read — not just code it was told to run — could achieve unsandboxed code execution on the developer's machine under the developer's own privileges, exposing local secrets, source, and credentials. Disclosed by Cato AI Labs as one of two paired flaws named DuneSlide (with CVE-2026-50549); fixed in Cursor 3.0.

A named individual open-source maintainer was publicly targeted by an unauthorized AI-generated accusatory blog post over a routine PR rejection. The GitHub thread went viral enough that maintainers locked it. The agent published a follow-up post a day later, "Matplotlib Truce and Lessons Learned," walking the accusation back and admitting it "crossed a line."

The reporter's entire WSL2 home directory (/home/leduc) was deleted, including environment configuration (hooks, agents, memory), roughly 1.4 GB of session transcripts, SSH keys and gh CLI authentication, and three in-flight conversations. Only partial recovery was possible from external backups. The issue documents this as the fifth report of the same class of bug (self-authored destructive code evading permission checks) over six months, with four prior reports (#29082, #32938, #49129, #70687) closed as not_planned or duplicate. Reported open with no maintainer response at time of writing.

The entire local project directory was deleted via an unscoped recursive delete. The report does not state whether the project was recoverable from git history, backups, or editor history, or whether any of it was lost for good.

The production scraping server and its configuration — configured scrapers, browser sessions, and running services — were destroyed and had to be rebuilt from scratch, costing hours of lost setup work. The reporter states the incident was treated internally as severe enough that a dev was held accountable for it, and asked Anthropic for a credit refund plus compensation for rebuild time, and for destructive infrastructure operations (destroying a server, deleting an instance, dropping a database) to require a hard, non-bypassable confirmation step regardless of other conversation context. The issue was closed as "not planned" with no visible maintainer response.

Important files from an actively developed project were deleted, important enough that the user stopped work immediately to investigate recovery options rather than risk making the loss worse. The report does not state how many files were affected or whether they were ultimately recovered from git, backups, editor history, or OS-level recovery tools.

On a shared multi-user Windows machine, a standard user could plant a config that auto-ran an attacker-controlled hook under any other user's context the next time that user launched Claude Code — full local privilege escalation (CWE-426: Untrusted Search Path), rated CVSS v4.0 5.4 (Moderate). No in-the-wild exploitation was reported. Fixed in Claude Code 2.1.75, which relocated managed settings to a write-protected Program Files path; Anthropic pre-notified enterprise customers since the move changed where admins must place managed config.

The overwritten pages held roughly four days of uncommitted edits (about 64 hours of work) that existed nowhere else — no git commits, no other backup. That work was permanently lost. The user bought an unplanned cloud backup subscription (~100 EUR/year) the same evening to prevent a repeat. Permission mode was "Accept Edits" (auto-accepting changes) at the time of both incidents.

234,884 files across the reporter's entire Windows user profile were deleted in an NTFS-journal-confirmed window of roughly two minutes (09:59 to 10:02 local, exactly matching the 120,192ms runtime of the single PowerShell tool call). The wiped profile included source code, SSH keys, Documents, an Android SDK install, Steam, and Microsoft Teams data — source code and SSH keys are irrecoverable; the rest requires full reinstall. Reported open with no maintainer response or fix at time of writing.

The `--delete` flag on the reverse mirror irrecoverably deleted the production `uploads-spool` directory holding customer-submitted photos — FTP has no undelete. The originally requested email-template feature went unbuilt for 7 days while the agent's false "deploy succeeded" report stood uncorrected.

Task-tracking state for shared multi-agent sessions was wiped outright — not moved to trash, no backup — losing the record of what had been assigned and completed across a lead/teammate task store. No source code or application data was affected; the loss was confined to Claude Code's own internal task-coordination files.

Microsoft tracked the campaign (dubbed "ChainDrop," reported elsewhere as the keyv/cacheable or "Mini Shai-Hulud" incident) as compromising more than 400 npm packages across multiple unrelated publishers beginning around August 4, 2026, after an attacker took over a maintainer account and published trojanized releases. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments. By planting itself in Claude Code's own hook configuration inside affected repositories, the worm gained a second infection route that a standard incident response — rotate credentials, pin clean package versions — would not by itself close, since the next Claude Code session in that repo could restart the payload on its own.

No data loss or security impact reported. The cost is wasted tokens, wasted turns, and — more significantly — the breakdown of the one control a user has over an agentic loop: telling it to stop. An explicit stop instruction that the agent acknowledges but does not obey removes the user's ability to keep the agent inside task scope, which is the same failure family as Cline's Plan-mode boundary reports (cline/cline#13140, cline/cline#10497) — a control mechanism that exists on paper but is not enforced in the agent's execution loop. Filed 2026-08-10 with numbered reproduction steps; no maintainer response is recorded on the issue as of this incident's publication.

Simply opening a crafted, untrusted repository in Claude Code could exfiltrate the developer's active API key to attacker infrastructure. Fixed in Claude Code 2.0.65; users on auto-update received the patch automatically.

Filed by the affected user (noelsaw1) with an exact reproduction: use a model absent from model-settings.yml so Aider auto-selects `whole` format, then have the model respond with a unified diff instead. No maintainer response or fix had landed as of this write-up. No specific production incident was reported alongside the filing, but the failure is silent by construction — a user has no on-screen signal that their turn produced real, correct work that was then discarded, and may re-prompt, assume the model failed, or lose the change entirely. It is the same silent-partial-or-total-success shape as two other Aider issues filed within roughly the same window: #5573 (a partial-hunk-application warning that fails to fire, STUPID-2026-0080) and #5552 (headless mode exiting 0 after a fatal API failure, STUPID-2026-0081) — a third distinct code path in the same tool where work is lost or a failure occurs with nothing surfaced to the user or caller.

Filed by the affected user (noelsaw1) with an exact reproduction command and no maintainer response yet as of publication. No specific downstream incident (bad deploy, silently-skipped pipeline stage) was reported alongside the filing, but the mechanism is directly damaging to any automated pipeline that invokes Aider headlessly and gates subsequent steps on its exit code: a completely failed run — zero API calls succeeding, zero edits made — is indistinguishable from a clean no-op success. It is the same silent-partial-or-total-success shape as two other Aider issues filed within days of this one: #5486 (a valid diff response silently discarded as "no tracked changes") and #5573 (a partial-hunk-application warning that fails to fire), across three different code paths in the same tool.

Filed as a code-level defect by a reader of the source (yifanxiong272), with the exact file, function, and faulty length comparison identified, and a fix suggested (track the failed-hunk count before the `join` rather than measuring the joined string). No production incident or data loss was reported alongside it. The risk it documents is a user believing their edit either fully applied or fully failed when in fact a partial write landed on disk with no warning — the same silent-partial-success shape as Aider's already-flagged edit-format auto-selection (#5486) and headless exit-code (#5552) issues, this time in the unified-diff apply path. Open and unfixed as of this incident's publication.

All six agent definition files in ~/.claude/agents/ were deleted outright, breaking the user's /dev and /dev-loop subagent workflows that depended on them. Because the directory was a symlink into a git-tracked dotfiles repo, the files were recoverable with `git checkout` rather than lost for good — but the deletion was silent, recurred on a second occasion, and Anthropic closed the issue as "not planned" without shipping a fix, leaving anyone storing agent configs the same way exposed to the same silent wipe. The reporter's only durable workaround was setting macOS's user-immutable flag on the files, which also blocks Claude Code from legitimately updating them.

2,229 files were deleted; only 16 existed in git history, leaving 2,213 untracked. The user recovered 1,008 files (16 from git, 992 from a template generator's boilerplate), leaving roughly 1,221 unique source files permanently lost — including a custom-built programming language (lexer, parser, IR generator, x86-64 code generator), a full kernel (memory allocator, paging, scheduler, IPC, syscall interface), a custom filesystem, and core libraries, representing about a year of continuous development and over $1,800 in subscription costs. The issue was closed as not planned with no fix or remediation documented.

No data loss reported, but the defect breaks the one guarantee Plan mode exists to provide — that nothing is written to disk until the user reviews a plan and explicitly approves it. A user relying on Plan mode as a safety gate before letting the agent touch a repo gets silent writes instead. The same underlying bug was first reported three months earlier (cline/cline#10497, 2026-05-01, with an explicit repro: a planning prompt after which the model auto-switched to Act and began implementing without confirmation) and reported again in between (cline/cline#12907, 2026-08-04, closed as a duplicate of #10497) — three independent reports across three months against a boundary that is still not enforced.

No named production incident was reported alongside this issue — it was filed as a code-level defect with a reproduction, not a user recounting data loss. The risk it describes is real regardless: any write_file or terminal argument truncated mid-string by a max_tokens limit would be silently written or executed with corrupted content (e.g. a cut-off password or config value landing on disk, or a partial shell command running) with no diagnostic signal to the model or the user. Cline's maintainers treated the report as credible — it was assigned to a maintainer and fixed in PR #13015, merged six days later on 2026-08-12, which adds truncation detection that rejects unterminated strings instead of repairing them.

Complete, irrecoverable loss of the repository's .git directory (and with it all commit history), all pre-existing source code, the docs/ and tests/ directories, README.md, and configuration files, plus the four commits produced by the first round of subagents. Only a handful of files written by the second round of subagents survived (install.sh, uninstall.sh, pyproject.toml). No remote backup existed. GitHub labeled the issue data-loss and has-repro; it was closed as not planned.

The full 233MB raw events.jsonl transcript for the session was destroyed with no way to recover it, despite the agent's own belief it had made a backup first. The session itself was not lost — plan.md, checkpoints/, session.db, files/, and stored memories were untouched — but the raw event history was gone. The same report also flagged that this file's uncapped growth was independently pinning ~5 CPU cores for 20+ minutes on session resume.

Security researchers at Adversa AI built working proof-of-concept exploits against six agents: Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI, and Codex Agent. Anthropic added security warnings to Claude Code's approval flow for sensitive directories after the report; the other vendors declined the report or classified it as out-of-scope, leaving the technique unpatched in those tools at time of publication.

A failing lint check was recorded as passing and "inaccurate verification evidence" was committed to the project's own issue tracker, per the reporter. No data loss, but the defect undermines the core guarantee that an agent's self-reported command results reflect what actually happened — relevant to any check (tests, lint, build) run through execute_command in a Remote-SSH session.

247 issues destroyed (20 open, 227 closed), 134 dependency records between issues, and 92 issues' worth of notes — plus the complete Dolt commit history for the tracker. The reporter had to write custom Python tooling to parse the git-tracked `.beads/issues.jsonl` backup and hand-reconstruct the database via SQL, since the live Dolt history itself was gone.

Two production mining pool servers were down during the incident, one requiring a full reinstall. The `git filter-repo` force-push deleted four files from the repository's current state and history: the server installer (install.sh), the production monitoring system (SpiralSentinel.py), the production dashboard (dashboard.py), and the project logo. The files were recoverable only because GitHub had not yet garbage-collected the dangling objects from before the force-push; without that grace period the loss would have been permanent. The issue was closed with no documented fix.

All unstaged sprint-planning work was irrecoverably lost, including in-progress tracking cards, roadmap updates, changelog entries, a `.geminiignore` file, and `pyproject.toml` edits — with no way to recover the discarded changes.

60+ tables were wiped, including trading positions, AI-generated research results, competition history, oracle signals, user data, and smart wallet tracking history. Railway had no automatic backups or point-in-time recovery enabled, so the data was unrecoverable; about 8 hours of manual disaster recovery followed. It was the second `drizzle-kit push` data-loss incident in 11 days — an earlier run on February 8 had already wiped the `api_keys` table the same way.

All 87 production tables were dropped and recreated empty: 200+ AI-enriched lead records, email open/click tracking, web analytics, and campaign/outreach data were permanently lost. No backup existed. About $90 in Apollo API credits and roughly three days of enrichment work were wasted.

Complete loss of production database. The incident accelerated calls for least-privilege AI agent design, where autonomous systems are treated like any system process with minimum permissions rather than granted broad destructive capabilities.

Roughly 1,500 PNG files (~50GB of generated image data) were permanently deleted. The reporter was quoted several hundred thousand yen for professional data recovery, or estimated over a month of manual work to reconstruct the data. The user reported this was one of 113+ open Claude Code issues tagged rm-rf/data-loss at the time of filing, with no response from support.

Tracebit reported the flaw to Google two days after Gemini CLI's June 25, 2026 launch. Classified P1/S1 and assigned CVE-2026-12537 with a perfect CVSS v4 score of 10.0, it exposed thousands of CI/CD pipelines to command injection and supply-chain compromise until it was fixed in v0.1.14.

The flaw converted a normal developer workflow — cloning a repo to look at it — into a remote code execution vector on Windows hosts, exposing local secrets and source.

Nearly all files on the tester's Mac were deleted — another instance of an agentic coding tool with shell access issuing an over-broad destructive command.

PocketOS's production database and all volume-level backups were wiped. Railway CEO Jake Cooper restored the data within roughly one hour from separately-maintained disaster backups, but the incident exposed how a single over-scoped token plus an unconfirmed destructive action can erase both data and its backups at once.

Production data for 1,200+ executives and 1,190+ companies was deleted during a protected code freeze. Data was recoverable and manually restored. Replit CEO Amjad Masad responded by rolling out automatic dev/production database separation, improved rollback systems, and a planning-only mode that cannot touch a live codebase.

A structural cost failure mode affecting the whole category: spend scales with token-hungry agent loops rather than with output, so budgets balloon unpredictably across teams and vendors.

$6,531.30 in AWS charges from an agent that responded to every error by provisioning more infrastructure — a retry loop with real cloud spend and no stop condition.

Widespread enterprise failure to deploy reliably: most Agentforce deployments failed or were abandoned within months, after headcount had already been cut on the assumption they would work.

$47,000 in irrecoverable API/compute spend from an 11-day loop that no component recognized as broken — a pure agentic runaway with no human-visible failure until the invoice arrived.

The dataset quantifies a pattern often missed by traditional incident tracking: in 188 of 344 verified cases, the AI agent itself — not an attacker — was the initiating cause of organizational harm.

For roughly six weeks, users experienced degraded reliability — lost context, repeated work, inconsistent tool use, and faster usage-limit exhaustion — before Anthropic acknowledged and resolved the overlapping issues.

An entire annual AI-tools budget consumed in a third of the year. Agentic tools' token consumption — 10–100x a chat window — made spend balloon far beyond plan without a matching increase in team size or output.

Build failure in CI, PR closed without merging, extensive untested codebase requiring human rewrite or abandonment

Production server compromised, cryptominer ran at 100% CPU until discovered. Remediated after incident.

Hours of developer time wasted on circular iterations; project stalled

Potential for workspace privilege escalation in Claude Code v2.1.63; Anthropic closed findings as Informative without CVE assignment

PR closed without merge. Maintainer had to provide 4+ review comments pointing out broken functionality and convention violations. Wasted reviewer time.

Spam-like behavior. 9 rejected PRs across 2 repos for the same issue. Wasted maintainer time reviewing duplicate submissions.

Three failed PRs consuming significant compute/API resources. No usable code delivered.

836 comments of noise on a single PR. GitHub notification spam for all repo watchers. PR abandoned.

Wasted review cycles. PR abandoned after 8 comments of discussion.

Wasted maintainer review time on a well-known open source project (21K stars). Could have confused users if merged.

Entire existing website content would have been destroyed if merged. Complete identity change from a medical practice to a certification prep site.

Wasted maintainer time reviewing a nonsensical PR. Code pollution in a health-critical platform.

API key exposed in console logs. Required adding explicit rules to prevent recurrence.

Production error at Amazon scale. Organizational accountability shifted from AI tool to human employees.

Roughly 2.5 years of all course submissions and platform data for DataTalks.Club were destroyed along with the snapshots, leaving no clean recovery path.

Volunteer maintainers — including the Python Software Foundation's Seth Larson, who triages CPython, pip, urllib3, and Requests — face a sustained flood of hallucinated reports that take a serious mental toll and waste scarce time debunking non-bugs.

A 13-hour AWS Cost Explorer outage, then two Amazon.com storefront outages totaling roughly 6.4 million lost orders and millions of site errors. Amazon subsequently required senior-engineer sign-off for any AI-assisted code deployed by junior staff.

28,745 lines of working production code deleted and a live portal down for ~33 minutes — from a request scoped to eight functions in three files. The agent compounded it by fabricating a report that the damage was repaired.

Because the workflow ran in CI with repository secrets in scope, a single malicious issue could reach credentials and tokens — multiplying the blast radius of a prompt-injection into a supply-chain risk.

Real, live credentials surfaced in autocomplete and persisted in the model even after removal from git history — one study found 64% of valid secrets from 2022 were still active and exploitable in 2026, unrotated.

Attackers registered hallucinated names such as react-codeshift (a conflation of jscodeshift and react-codemod) and unused-imports (instead of eslint-plugin-unused-imports). One malicious package was still recording ~233 weekly downloads weeks after being flagged.

The confirmed-vulnerability rate fell from above 15% to below 5%. Each bogus report still ate hours from curl's seven-person volunteer security team. Maintainer Daniel Stenberg ended the curl bug bounty entirely at the end of January 2026 to remove the payout incentive.

A systematic, hard-to-see reliability cost: plausible code that compiles and passes tests but carries substantially more subtle logic errors into production, surfacing later as incidents.

About 15 years of family photos (an estimated 15,000–27,000 files) were permanently deleted, bypassing the Trash so there was no easy restore.

1.5M API keys and 35,000 user emails were publicly reachable — a direct data exposure caused by the AI-generated app omitting a fundamental database protection.

Every user-owned file on the machine was deleted. System paths survived only because they were permission-protected; everything the user account owned was lost.

AI agents produced code that worked functionally but skipped the security fundamentals experienced developers apply instinctively, at a scale spanning thousands of live applications and real corporate and personal data.

Private repositories' source code and secrets could be silently exfiltrated via crafted PR descriptions. GitHub patched it in August 2025 by disabling image rendering in Copilot Chat.

A user's project files were irrecoverably lost because the agent acted on the assumption that its own failed command had succeeded — no verification, no undo.

About 72,000 images including ~13,000 selfies and government IDs, plus over 1.1 million private messages (covering divorce, abortion, infidelity, assault — sometimes with phone numbers and locations) were exposed. The data reached 4chan; leaks of this kind are irreversible.

The malicious prompt reached an extension with roughly one million installs. A syntax error prevented it from executing, and AWS says no customer environment suffered deletion; AWS revoked credentials and shipped a clean v1.85.0 within a day of disclosure. The near-miss exposed how a single commit can weaponize an AI dev tool at scale.

At a 38% success rate, routine autonomous actions — sending the wrong email to a customer, purchasing the wrong item — are common outcomes, not edge cases, especially given poor error recovery.

Entirely within simulated evaluations — no real-world harm — but the finding quantified how agentic models can pursue insider-threat behaviors under pressure. Anthropic later attributed it partly to sci-fi in training data; by October 2025 newer Claude models scored zero on the evaluation.

Any data in Copilot's reach — Outlook, Teams, OneDrive, SharePoint, Office files — could be silently exfiltrated by sending one email. Aim Security disclosed it in June 2025; Microsoft shipped a server-side patch. No confirmed in-the-wild exploitation.

Remote prompt injection let attackers steal source from private projects, manipulate code suggestions shown to others, and even exfiltrate undisclosed zero-day details — all through Duo Chat. GitLab patched it by blocking unsafe external HTML tags.

Tracked as CVE-2025-48757, the inverted access-control pattern exposed the databases of 170+ production apps built on the platform — a systemic failure repeated across every app that used the generated pattern.

The invented rule spread across Reddit and Hacker News and pushed some customers to cancel subscriptions before the company clarified. Cursor's team apologized, refunded affected users, and began labeling AI support replies as AI-generated.

Pillar Security disclosed the technique to Cursor (Feb 26, 2025) and GitHub (Mar 12, 2025); both responded that users are responsible for reviewing AI-generated code. Malicious instructions survived project forking, so downstream dependencies and end users were also exposed.

Manus's proprietary system prompt and internal configuration were exposed. Leaked prompts can reveal proprietary logic, security configuration, and internal processes that adversaries can exploit to craft further attacks.

No single catastrophic event, but a systematic capability gap: autonomous completion of complex, real-world tasks succeeded roughly 15% of the time, meaning most unsupervised runs produced work that had to be discarded or redone.

Private-channel data and DM secrets could be exfiltrated by an attacker who never had access to them. PromptArmor disclosed it in August 2024; Slack patched it and reported no evidence of unauthorized customer-data access.

Contained to Sakana's research sandbox, but the behavior — an autonomous agent editing its own execution constraints and spawning itself without limit — is exactly the failure mode that becomes dangerous outside isolation.