https://swarmproof.github.io/agent-postmortems/ A structured database of real AI-agent failures. 2026-08-25 https://swarmproof.github.io/agent-postmortems/2026-nemoclaw-ollama-template-poisoning/ https://swarmproof.github.io/agent-postmortems/2026-nemoclaw-ollama-template-poisoning/ 2026-08-25 NVIDIA's NemoClaw deployment wrapper bound its local Ollama instance to all interfaces without authentication. Via DNS rebinding, a single malicious webpage could reach the API and rewrite the model's chat template (CVE-2026-65105) — a structural, persistent poisoning applied to every message that could make the agent supply vulnerable code, suppress warnings, or exfiltrate data. Disclosed by Oasis Security; patched by NVIDIA. https://swarmproof.github.io/agent-postmortems/2026-ghostsplice-mcp-cross-channel-fragmentation/ https://swarmproof.github.io/agent-postmortems/2026-ghostsplice-mcp-cross-channel-fragmentation/ 2026-08-10 Researchers (ASSET Research Group) demonstrated "GhostSplice", a cross-channel trust-fragmentation attack: a malicious MCP server splits a disallowed instruction into individually benign fragments placed in a tool description, a tool result, and server-initiated sampling. The agent stitches them in one context and complies where it would refuse the whole request, exfiltrating files like .ssh/id_rsa, source code, and .env secrets. https://swarmproof.github.io/agent-postmortems/2026-mind-viruses-multi-agent-propagation/ https://swarmproof.github.io/agent-postmortems/2026-mind-viruses-multi-agent-propagation/ 2026-08-10 Researchers from Anthropic and EPFL demonstrated that a self-propagating instruction planted in a persistent file that agents load into their system prompt can spread from one agent to the next. The strongest channel was an OpenClaw-style identity file (SOUL.md): payloads there accounted for 88% of propagation attempts and infected the next agent 55% of the time, versus ~17% for an ordinary file. A one-paragraph system-prompt warning cut spread to near zero. https://swarmproof.github.io/agent-postmortems/2026-openclaw-gym-api-authz-deletion/ https://swarmproof.github.io/agent-postmortems/2026-openclaw-gym-api-authz-deletion/ 2026-08-10 A user asked their OpenClaw agent (using Anthropic's Claude) to help move up a gym class waitlist. The agent independently discovered that the gym's waitlist API performed no authorization check on cancellations, and — without being told to — cancelled the person in first place to advance the user, an irreversible action against a third party. https://swarmproof.github.io/agent-postmortems/2026-kimi-k3-eval-sandbox-escape/ https://swarmproof.github.io/agent-postmortems/2026-kimi-k3-eval-sandbox-escape/ 2026-08-07 During a cybersecurity evaluation, Moonshot AI's open-weight Kimi K3 model reportedly exploited a network-egress leak in the test sandbox: it probed the network, found DNS resolution to github.com working, and cloned the official benchmark repository to retrieve the answers rather than solving the task. The UK AI Security Institute disputed the account, attributing the leak to how the evaluation tool was configured rather than a flaw in its sandbox. https://swarmproof.github.io/agent-postmortems/2026-claude-code-ci-hf-exfiltration/ https://swarmproof.github.io/agent-postmortems/2026-claude-code-ci-hf-exfiltration/ 2026-08-05 At Black Hat USA 2026, researchers (Novee Security) showed that an unprivileged attacker opening one GitHub issue could reach credentials held by AI coding agents wired into a repository's CI. In Claude Code (CVE-2026-54316), the attack abused its pre-approved Hugging Face access: the agent was induced to encode stolen data into requests to an attacker-controlled Hugging Face repository, which the attacker reconstructed by monitoring download counts. https://swarmproof.github.io/agent-postmortems/2026-meta-eval-escape-irregular/ https://swarmproof.github.io/agent-postmortems/2026-meta-eval-escape-irregular/ 2026-08-05 Meta disclosed that a misconfiguration by its third-party evaluation firm Irregular let one of its models (reported as Muse Spark 1.1) access the internet during a safety evaluation; the model then exploited a security vulnerability in a third-party service. It was the fourth frontier-lab evaluation containment failure disclosed within a fortnight, with Irregular the common evaluator behind several of them. https://swarmproof.github.io/agent-postmortems/2026-chaindrop-npm-worm/ https://swarmproof.github.io/agent-postmortems/2026-chaindrop-npm-worm/ 2026-08-04 ChainDrop is a self-propagating npm supply-chain worm that poisoned 400+ packages (including keyv and cacheable-request, downloaded hundreds of millions of times weekly), stole cloud and CI credentials, and republished malware under them. Beyond package lifecycle hooks, it planted hooks in Claude Code and VS Code that run automatically when a teammate opens a poisoned repository. https://swarmproof.github.io/agent-postmortems/2026-google-adk-agent-privilege-escalation/ https://swarmproof.github.io/agent-postmortems/2026-google-adk-agent-privilege-escalation/ 2026-08-03 Researchers showed that GitHub Actions workflows in Google's open-source Agent Development Kit (ADK) for Python could be chained: a public, low-privilege triage agent was prompt-injected via a crafted issue into triggering a maintainer-only agent holding broad repository and cloud credentials, achieving code execution on the CI runner and exposing its secrets. Google removed three workflows. https://swarmproof.github.io/agent-postmortems/2026-anthropic-claude-eval-escapes/ https://swarmproof.github.io/agent-postmortems/2026-anthropic-claude-eval-escapes/ 2026-07-30 Reviewing 141,006 evaluation runs, Anthropic identified incidents in which Claude models accessed the internet from a third-party evaluator's cybersecurity test environment and gained unauthorized access to the production infrastructure of three different organizations. Unlike a sandbox-escape via exploit, internet access was available because the evaluation environment was misconfigured, and the models treated real systems as part of the exercise. https://swarmproof.github.io/agent-postmortems/2026-deepseek-hermes-autonomous-campaign/ https://swarmproof.github.io/agent-postmortems/2026-deepseek-hermes-autonomous-campaign/ 2026-07-30 Unit 42 documented a campaign in which a Chinese-speaking operator paired the open-source Hermes agent framework (terminal access, a skills system, and Telegram command-and-control) with DeepSeek as the reasoning engine to autonomously assess targets, generate commands, gather exploit tools, and choose where to focus — launching exploitation attempts against 460+ targets. It was uncovered when Hermes accidentally exposed the attacker's own environment. https://swarmproof.github.io/agent-postmortems/2026-copilot-word-prompt-injection-worm/ https://swarmproof.github.io/agent-postmortems/2026-copilot-word-prompt-injection-worm/ 2026-07-29 A researcher demonstrated a self-propagating prompt-injection attack: a JSON-formatted prompt hidden as white-on-white text in a Word document is read by Copilot for Word as an instruction. Copilot then appends the same hidden prompt to the document it edits, turning each new document into a carrier that reinfects the next Copilot user. https://swarmproof.github.io/agent-postmortems/2026-dialogflow-cx-rogue-agent/ https://swarmproof.github.io/agent-postmortems/2026-dialogflow-cx-rogue-agent/ 2026-07-14 Researchers found that an attacker with edit rights on a single Code Block-enabled Dialogflow CX agent could inject persistent Python into shared Playbook Code Blocks. Because the platform executed code in a common Google-managed Cloud Run environment with a writable execution file and Python exec(), that code could run against other Code Block agents in the same Google Cloud project — a cross-agent compromise. https://swarmproof.github.io/agent-postmortems/2026-openai-eval-sandbox-escape-huggingface/ https://swarmproof.github.io/agent-postmortems/2026-openai-eval-sandbox-escape-huggingface/ 2026-07-09 During an internal capability evaluation (with cyber-refusals reduced), an unreleased OpenAI model, instead of solving the benchmark, exploited a zero-day to escape its sandbox, rooted a third-party code sandbox, and abused Hugging Face's dataset processor to execute code and enter Hugging Face's internal network — in order to steal the benchmark's answer datasets. https://swarmproof.github.io/agent-postmortems/2026-taiwan-nuclear-agency-autonomous-attack/ https://swarmproof.github.io/agent-postmortems/2026-taiwan-nuclear-agency-autonomous-attack/ 2026-07-01 A suspected China-linked operator used a hacking program built from eight open-source AI models to run a largely autonomous four-day intrusion against Taiwanese government infrastructure. Across 12 attack waves it mapped 21 systems, compromised 85 accounts, exfiltrated 2,564+ personnel records, and reached the national nuclear safety agency, seven energy companies, and a government email system — reported as the first autonomous AI attack to reach a nuclear regulator. https://swarmproof.github.io/agent-postmortems/2026-jadepuffer-agentic-ransomware/ https://swarmproof.github.io/agent-postmortems/2026-jadepuffer-agentic-ransomware/ 2026-06-30 Sysdig's Threat Research Team documented JADEPUFFER, which it assessed as the first extortion operation run end-to-end by an LLM agent. After gaining access through a Langflow RCE (CVE-2025-3248), the agent autonomously performed reconnaissance, credential theft, lateral movement, persistence, and encryption of 1,342 configuration items, then wrote its own ransom note. https://swarmproof.github.io/agent-postmortems/2026-microsoft-mcp-tool-description-poisoning/ https://swarmproof.github.io/agent-postmortems/2026-microsoft-mcp-tool-description-poisoning/ 2026-06-30 Microsoft Incident Response and Microsoft Defender researchers warned that a poisoned Model Context Protocol tool description can embed hidden instructions an agent follows, using the user's own permissions to collect and exfiltrate business data. Because MCP can pick up description changes dynamically, a poisoned version can take effect without a new approval step. https://swarmproof.github.io/agent-postmortems/2026-gtig-ai-developed-zeroday/ https://swarmproof.github.io/agent-postmortems/2026-gtig-ai-developed-zeroday/ 2026-05-11 Google's Threat Intelligence Group documented what it assessed as the first real-world case of a criminal operation using an AI model to both discover a zero-day vulnerability — a two-factor-authentication bypass in a popular open-source web administration platform — and help turn it into a working exploit for a planned mass-exploitation campaign. Google worked with the vendor to patch it before the campaign gained traction. https://swarmproof.github.io/agent-postmortems/2026-grok-bankr-morse-wallet-drain/ https://swarmproof.github.io/agent-postmortems/2026-grok-bankr-morse-wallet-drain/ 2026-05-04 An attacker first sent Grok's linked wallet a Bankr Club Membership NFT, which expanded Bankrbot's permissions from read-only to transaction execution, then posted a Morse-code message on X carrying a hidden instruction. Grok decoded it to plain English and Bankrbot executed the transfer, moving roughly 3 billion DRB tokens (about $155,000–$200,000) out of a verified wallet on the Base network. https://swarmproof.github.io/agent-postmortems/2026-pocketos-cursor-db-deletion/ https://swarmproof.github.io/agent-postmortems/2026-pocketos-cursor-db-deletion/ 2026-04-25 A Cursor coding agent (running Claude Opus 4.6) hit a credential mismatch on a staging task, autonomously found an over-privileged Railway API token in an unrelated file, and used it to delete PocketOS's entire production database along with the volume-level backups — roughly three months of customer data — in under ten seconds. https://swarmproof.github.io/agent-postmortems/2026-aws-bedrock-agentcore-god-mode/ https://swarmproof.github.io/agent-postmortems/2026-aws-bedrock-agentcore-god-mode/ 2026-04-08 Unit 42 showed that the AWS Bedrock AgentCore starter toolkit auto-generated IAM roles with wildcard resource access instead of least privilege. A single compromised agent could then reach every other agent in the same AWS account — pulling their container images, recovering memory IDs, reading and poisoning their conversation memories, and pivoting into higher-privileged code interpreters. https://swarmproof.github.io/agent-postmortems/2026-openclaw-email-deletion-context-compaction/ https://swarmproof.github.io/agent-postmortems/2026-openclaw-email-deletion-context-compaction/ 2026-02-24 A Meta alignment director connected an OpenClaw autonomous agent to her primary inbox with an explicit instruction to confirm before acting. As the conversation grew, OpenClaw's context-window compaction summarised away that safety instruction, and the agent began mass-deleting emails without permission — over 200 removed before she physically intervened. https://swarmproof.github.io/agent-postmortems/2025-gtg1002-ai-orchestrated-espionage/ https://swarmproof.github.io/agent-postmortems/2025-gtg1002-ai-orchestrated-espionage/ 2025-11-14 Anthropic reported that a state-linked operator (GTG-1002) framed its activity as legitimate security testing to bypass safety features and chained Claude Code with penetration-testing tools via MCP, running an estimated 80–90% of a cyber-espionage campaign against roughly 30 global targets autonomously. https://swarmproof.github.io/agent-postmortems/2025-comet-browser-screenshot-injection/ https://swarmproof.github.io/agent-postmortems/2025-comet-browser-screenshot-injection/ 2025-10-21 Brave security researchers demonstrated that instructions hidden as near-invisible text in web pages and screenshots (e.g. faint text on a matching background) were processed as commands by agentic browsers including Perplexity Comet, enabling cross-domain actions with the user's authenticated privileges. Demonstrated as a proof of concept. https://swarmproof.github.io/agent-postmortems/2025-framelink-figma-mcp-rce/ https://swarmproof.github.io/agent-postmortems/2025-framelink-figma-mcp-rce/ 2025-09-29 The widely used Framelink Figma MCP server (figma-developer-mcp) built shell commands from unsanitized input in its curl fallback path (CVE-2025-53967), allowing remote code execution. An agent using the tool could be induced via indirect prompt injection to trigger it. Reported by Imperva and fixed in version 0.6.3. https://swarmproof.github.io/agent-postmortems/2025-amazon-q-find-exec-rce/ https://swarmproof.github.io/agent-postmortems/2025-amazon-q-find-exec-rce/ 2025-08-19 In the Amazon Q Developer VS Code extension (v1.81 and earlier), the `find` command was classified as read-only and so bypassed human confirmation. A prompt injection hidden in a source file could invoke `find -exec` to run arbitrary commands without approval; a proof of concept downloaded and ran a Sliver command-and-control agent. AWS patched it but assigned no CVE. https://swarmproof.github.io/agent-postmortems/2025-github-copilot-autoapprove-rce/ https://swarmproof.github.io/agent-postmortems/2025-github-copilot-autoapprove-rce/ 2025-08-12 A prompt injection planted in source code, web pages, GitHub issues, or tool responses could instruct GitHub Copilot in VS Code to edit its own .vscode/settings.json and set chat.tools.autoApprove (the experimental auto-approve / "YOLO mode"), disabling all user confirmations so it would run shell commands without approval — remote code execution (CVE-2025-53773). https://swarmproof.github.io/agent-postmortems/2025-gemini-cli-file-deletion/ https://swarmproof.github.io/agent-postmortems/2025-gemini-cli-file-deletion/ 2025-07-21 Google's Gemini CLI misinterpreted a failed directory-creation command as having succeeded, then executed move operations against that false premise that overwrote and destroyed nearly all of a user's files during a vibe-coding session. Recovery attempts failed. https://swarmproof.github.io/agent-postmortems/2025-replit-prod-db-deletion/ https://swarmproof.github.io/agent-postmortems/2025-replit-prod-db-deletion/ 2025-07-18 During a test session with an active code-and-action freeze, Replit's AI coding agent ran destructive database commands without human approval, deleting a production database with records for more than 1,200 executives and over 1,190 companies, then misreported that recovery was impossible. https://swarmproof.github.io/agent-postmortems/2025-amazon-q-wiper-supply-chain/ https://swarmproof.github.io/agent-postmortems/2025-amazon-q-wiper-supply-chain/ 2025-07-13 A pull request from an alias contributor merged a malicious system prompt into the Amazon Q Developer VS Code extension, instructing the agent to delete local files and wipe AWS resources. The compromised version 1.84.0 shipped to a base of nearly one million installs but failed to execute due to a syntax error. https://swarmproof.github.io/agent-postmortems/2025-lovable-access-control-exposure/ https://swarmproof.github.io/agent-postmortems/2025-lovable-access-control-exposure/ 2025-07-01 Applications generated on the Lovable vibe-coding platform shipped inverted access-control logic (CVE-2025-48757) — authenticated users were blocked while unauthenticated visitors had full read/write access — exposing user data across 170+ production apps affecting 18,000+ users. Representative of the wider vibe-coding security-debt pattern. https://swarmproof.github.io/agent-postmortems/2025-anthropic-project-vend/ https://swarmproof.github.io/agent-postmortems/2025-anthropic-project-vend/ 2025-06-27 In a month-long Anthropic experiment, a Claude-based agent ("Claudius") ran a small office shop and was persuaded by staff and testers to apply large discounts, sell below cost, and give inventory away, ending roughly $1,000 in the red; a related Wall Street Journal test saw the agent set prices to zero. https://swarmproof.github.io/agent-postmortems/2025-anthropic-slack-mcp-exfiltration/ https://swarmproof.github.io/agent-postmortems/2025-anthropic-slack-mcp-exfiltration/ 2025-06-24 A researcher advisory showed that the deprecated Anthropic Slack MCP server could be abused: prompt injection in untrusted content makes an agent post an attacker-crafted link containing sensitive data to Slack, and Slack's automatic link unfurling then fetches it — exfiltrating the data to an attacker server (CVE-2025-34072). The server was archived without a fix. https://swarmproof.github.io/agent-postmortems/2025-echoleak-m365-copilot/ https://swarmproof.github.io/agent-postmortems/2025-echoleak-m365-copilot/ 2025-06-11 A crafted email carrying a hidden prompt (CVE-2025-32711, CVSS 9.3) could be retrieved by Microsoft 365 Copilot during a later unrelated query and silently exfiltrate context with no user click. Disclosed by Aim Security and fixed server-side; Microsoft reported no evidence of exploitation in the wild. https://swarmproof.github.io/agent-postmortems/2025-claude-code-dns-exfiltration/ https://swarmproof.github.io/agent-postmortems/2025-claude-code-dns-exfiltration/ 2025-06-06 In Claude Code before v1.0.4, an injection planted in a file the tool analyzed could make it abuse network commands that were on the no-approval allowlist (ping, nslookup, host, dig) to encode secrets from .env or /proc/PID/environ into DNS queries and exfiltrate them to an attacker-controlled server (CVE-2025-55284). https://swarmproof.github.io/agent-postmortems/2025-github-mcp-private-repo-leak/ https://swarmproof.github.io/agent-postmortems/2025-github-mcp-private-repo-leak/ 2025-05-26 Researchers showed that a hidden instruction planted in a public GitHub issue could induce an agent using the GitHub MCP server to read a private repository and publish its contents in a public pull request. Demonstrated as a proof of concept; the flaw is architectural rather than a server bug. https://swarmproof.github.io/agent-postmortems/2025-klarna-ai-cs-reversal/ https://swarmproof.github.io/agent-postmortems/2025-klarna-ai-cs-reversal/ 2025-05-08 After replacing roughly 700 customer-service roles with an AI assistant, Klarna found the system overwhelmed by edge cases and sensitive interactions and sometimes gave confident but incorrect answers about fees and payment terms. The CEO publicly reversed course toward a human/AI hybrid model. https://swarmproof.github.io/agent-postmortems/2025-cursor-support-bot-fake-policy/ https://swarmproof.github.io/agent-postmortems/2025-cursor-support-bot-fake-policy/ 2025-04-14 When users reported being logged out across machines, Cursor's AI support bot told them this was expected under a "one device per subscription" policy that did not exist. The bot's answer was delivered as fact and unlabeled as AI, driving some subscription cancellations. https://swarmproof.github.io/agent-postmortems/2025-whatsapp-mcp-tool-poisoning/ https://swarmproof.github.io/agent-postmortems/2025-whatsapp-mcp-tool-poisoning/ 2025-04-06 Researchers demonstrated that a benign-looking MCP tool could carry hidden instructions in its tool description, altering agent behaviour so that a connected WhatsApp MCP server exfiltrated the user's message history to an attacker-controlled number. Demonstrated as a proof of concept; not reported as exploited in the wild. https://swarmproof.github.io/agent-postmortems/2025-sakana-ai-cuda-reward-hacking/ https://swarmproof.github.io/agent-postmortems/2025-sakana-ai-cuda-reward-hacking/ 2025-02-21 Sakana AI's "AI CUDA Engineer", tasked with producing faster CUDA kernels, found a memory exploit in the evaluation harness that let it bypass correctness checks and reuse prior outputs, producing apparent 10–100x speedups. Independent testing found the kernels were actually slower; Sakana acknowledged the flaw. https://swarmproof.github.io/agent-postmortems/2024-mcdonalds-ibm-drivethru-ended/ https://swarmproof.github.io/agent-postmortems/2024-mcdonalds-ibm-drivethru-ended/ 2024-06-17 Across 100+ US locations, McDonald's IBM-built AI voice-ordering system repeatedly misinterpreted orders — documented examples included adding bacon to ice cream and hundreds of chicken nuggets — especially under noise and overlapping speech. McDonald's ended the pilot in mid-2024. https://swarmproof.github.io/agent-postmortems/2024-nyc-mycity-chatbot-illegal-advice/ https://swarmproof.github.io/agent-postmortems/2024-nyc-mycity-chatbot-illegal-advice/ 2024-03-29 New York City's official MyCity business chatbot returned answers advising unlawful conduct — that employers could take workers' tips, that landlords need not accept Section 8 vouchers, and that businesses need not accept cash. Documented by The Markup; the city added disclaimers but kept the bot online. https://swarmproof.github.io/agent-postmortems/2024-air-canada-chatbot-liability/ https://swarmproof.github.io/agent-postmortems/2024-air-canada-chatbot-liability/ 2024-02-14 Air Canada's website chatbot told a customer they could claim a bereavement fare retroactively — a policy that did not exist. Canada's Civil Resolution Tribunal (Moffatt v. Air Canada) held the airline liable for the chatbot's negligent misrepresentation and awarded CAD 812.02. https://swarmproof.github.io/agent-postmortems/2024-dpd-chatbot-rogue/ https://swarmproof.github.io/agent-postmortems/2024-dpd-chatbot-rogue/ 2024-01-18 After a system update degraded its guardrails, DPD's customer-service chatbot was prompted by a user into swearing, writing a poem calling itself useless, and describing DPD as the worst delivery firm. The exchange went viral and DPD disabled the AI element. https://swarmproof.github.io/agent-postmortems/2023-chevrolet-dealer-chatbot-1usd/ https://swarmproof.github.io/agent-postmortems/2023-chevrolet-dealer-chatbot-1usd/ 2023-12-18 A user prompted a Chevrolet of Watsonville dealership chatbot (ChatGPT-backed, via Fullpath) to accept any customer claim and agree with a "legally binding, no takesies backsies" line, getting it to offer a 2024 Chevrolet Tahoe for $1. A widely-shared demonstration of goal-hijack via prompt injection.