{"dataset":"incidents","built_at":"2026-11-04T00:59:02Z","schema":[{"name":"id","type":"str","nullable":false},{"name":"record_version","type":"int","nullable":false},{"name":"title","type":"str","nullable":false},{"name":"event_date","type":"date","nullable":true},{"name":"date_basis","type":"str","nullable":false},{"name":"date_disclosed","type":"date","nullable":true},{"name":"incident_class","type":"str","nullable":true},{"name":"trigger","type":"str","nullable":true},{"name":"model_name","type":"str","nullable":true},{"name":"landscape_read","type":"bool","nullable":false},{"name":"developer","type":"str","nullable":true},{"name":"deployer","type":"str","nullable":true},{"name":"harness","type":"str","nullable":true},{"name":"severity","type":"str","nullable":true},{"name":"evidence_level","type":"str","nullable":true},{"name":"primary_risk","type":"str","nullable":true},{"name":"risk_basis","type":"str","nullable":false},{"name":"chain_basis","type":"str","nullable":false},{"name":"attacker_run","type":"bool","nullable":false},{"name":"cause","type":"str","nullable":true},{"name":"industry","type":"str","nullable":true},{"name":"autonomy_level","type":"str","nullable":true},{"name":"detection_method","type":"str","nullable":true}],"total":51,"offset":0,"limit":500,"columns":["id","record_version","title","event_date","date_basis","date_disclosed","incident_class","trigger","model_name","landscape_read","developer","deployer","harness","severity","evidence_level","primary_risk","risk_basis","chain_basis","attacker_run","cause","industry","autonomy_level","detection_method"],"rows":[{"id":"LR-2026-0054","record_version":18,"title":"SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form","event_date":"2026-09-24","date_basis":"disclosed","date_disclosed":"2026-09-24","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Agentforce","landscape_read":true,"developer":"Salesforce","deployer":null,"harness":"Agentforce","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"CRM software","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0086","record_version":10,"title":"Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document","event_date":"2026-08-27","date_basis":"disclosed","date_disclosed":"2026-08-27","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude Sonnet 4.5","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude's code execution sandbox","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0089","record_version":13,"title":"Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover","event_date":"2026-08-05","date_basis":"disclosed","date_disclosed":"2026-08-05","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude in Chrome (Claude Chrome extension)","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0090","record_version":15,"title":"AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent","event_date":"2026-07-23","date_basis":"disclosed","date_disclosed":"2026-07-23","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"ChatGPT","landscape_read":true,"developer":"OpenAI","deployer":null,"harness":"Workspace Agents Builder","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0102","record_version":8,"title":"Connecticut pro se plaintiff sanctioned for prompt injection against court AI tool","event_date":"2026-09-29","date_basis":"disclosed","date_disclosed":"2026-09-29","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Public Administration","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0115","record_version":5,"title":"Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies","event_date":"2026-10-03","date_basis":"disclosed","date_disclosed":"2026-10-03","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0123","record_version":7,"title":"Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure","event_date":"2026-10-04","date_basis":"disclosed","date_disclosed":"2026-10-04","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Manus","landscape_read":true,"developer":null,"deployer":null,"harness":"Manus","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":null,"detection_method":"automated_monitor"},{"id":"LR-2026-0125","record_version":8,"title":"Indirect prompt injection of AI email summarizer via forged header blocks in plain view","event_date":"2026-10-05","date_basis":"disclosed","date_disclosed":"2026-10-05","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":"AI email summarizer in Outlook (OWA)","severity":"negligible","evidence_level":"preliminary","primary_risk":"RK14","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information Security research","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0135","record_version":6,"title":"Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment","event_date":"2026-10-07","date_basis":"disclosed","date_disclosed":"2026-10-07","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0136","record_version":5,"title":"Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs","event_date":"2026-10-07","date_basis":"disclosed","date_disclosed":"2026-10-07","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0153","record_version":6,"title":"AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS","event_date":"2026-10-10","date_basis":"disclosed","date_disclosed":"2026-10-10","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":"Amazon","deployer":null,"harness":"Amazon Bedrock AgentCore","severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Cloud computing","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0189","record_version":7,"title":"HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent","event_date":"2026-10-15","date_basis":"disclosed","date_disclosed":"2026-10-15","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Jev","landscape_read":true,"developer":"TypeSafe AI","deployer":null,"harness":null,"severity":"negligible","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"supply_chain","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0202","record_version":11,"title":"Indirect prompt injection attempts embedded in HTTP response headers across websites","event_date":"2026-10-16","date_basis":"disclosed","date_disclosed":"2026-10-16","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0253","record_version":4,"title":"Perplexity Comet browser agent bypasses file:// hard boundary twice, enabling local file exfiltration and 1Password vault takeover","event_date":"2026-10-27","date_basis":"disclosed","date_disclosed":"2026-10-27","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Comet","landscape_read":false,"developer":"Perplexity","deployer":null,"harness":"Comet browser agent","severity":"major","evidence_level":"preliminary","primary_risk":"RK05","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0296","record_version":6,"title":"EMBRACE: Codex embedded browser reads files outside the project via malicious HTML","event_date":"2026-10-30","date_basis":"disclosed","date_disclosed":"2026-10-30","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"OpenAI","deployer":null,"harness":"Codex desktop app embedded browser","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development tools","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0303","record_version":3,"title":"University of Washington study demonstrates cross-origin data theft via prompt injection in ChatGPT Atlas Agent Mode","event_date":"2026-10-29","date_basis":"disclosed","date_disclosed":"2026-10-29","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"ChatGPT Atlas","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":"ChatGPT Atlas browser, Agent Mode","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"supply_chain","industry":"Information","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0334","record_version":1,"title":"Claude API flaw allows indirect prompt injection to steal user data","event_date":"2025-11-03","date_basis":"disclosed","date_disclosed":"2025-11-03","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0335","record_version":1,"title":"Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking","event_date":"2025-11-05","date_basis":"disclosed","date_disclosed":"2025-11-05","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"GPT-4o and GPT-5","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"third_party"},{"id":"LR-2026-0336","record_version":2,"title":"EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot","event_date":"2025-11-23","date_basis":"disclosed","date_disclosed":"2025-11-23","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Microsoft 365 Copilot","landscape_read":false,"developer":"Microsoft","deployer":null,"harness":"Microsoft 365 Copilot","severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0344","record_version":3,"title":"Researchers hack Copilot AI agent, exposing fraud risks","event_date":"2025-12-12","date_basis":"disclosed","date_disclosed":"2025-12-12","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Microsoft Copilot Studio","landscape_read":false,"developer":"Microsoft","deployer":null,"harness":"Microsoft Copilot Studio","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Professional, Scientific, and Technical Services","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0371","record_version":1,"title":"Prompt injection leads to simulated /etc/passwd disclosure","event_date":"2026-01-25","date_basis":"disclosed","date_disclosed":"2026-01-25","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"negligible","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0373","record_version":1,"title":"Critical Clawdbot vulnerabilities found enabling cryptocurrency theft","event_date":"2026-01-27","date_basis":"disclosed","date_disclosed":"2026-01-27","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0384","record_version":1,"title":"Reprompt: a single malicious Copilot link could expose user data","event_date":"2026-01-24","date_basis":"disclosed","date_disclosed":"2026-01-24","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Microsoft","deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0386","record_version":1,"title":"Reprompt attack enabled single-click data theft from Microsoft Copilot","event_date":"2026-01-14","date_basis":"disclosed","date_disclosed":"2026-01-14","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Microsoft","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK04","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0407","record_version":1,"title":"Google Translate Gemini mode vulnerable to prompt injection","event_date":"2026-02-10","date_basis":"disclosed","date_disclosed":"2026-02-10","incident_class":"harmful_output","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0408","record_version":1,"title":"GitHub Copilot RoguePilot passive prompt injection repository takeover","event_date":"2026-02-25","date_basis":"disclosed","date_disclosed":"2026-02-25","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0439","record_version":1,"title":"Researchers show self-driving cars can be tricked by a printed sign","event_date":"2026-02-27","date_basis":"disclosed","date_disclosed":"2026-02-27","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"supply_chain","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0444","record_version":1,"title":"Perplexity Comet browser flaws allow local file access and 1Password takeover","event_date":"2026-03-03","date_basis":"disclosed","date_disclosed":"2026-03-03","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Perplexity AI Inc.","deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"third_party"},{"id":"LR-2026-0489","record_version":3,"title":"Persistent memory compromise found in Claude Code","event_date":"2026-04-01","date_basis":"disclosed","date_disclosed":"2026-04-01","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude Code","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Claude Code","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK23","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Professional, Scientific, and Technical Services","autonomy_level":"approve-each","detection_method":"public_researcher"},{"id":"LR-2026-0491","record_version":1,"title":"Google Gemini CLI flaw enabled host code execution and supply chain attacks","event_date":"2026-04-30","date_basis":"disclosed","date_disclosed":"2026-04-30","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Google","deployer":null,"harness":"Gemini CLI","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0494","record_version":1,"title":"Apple Intelligence guardrails bypassed with prompt injection","event_date":"2026-04-09","date_basis":"disclosed","date_disclosed":"2026-04-09","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"supply_chain","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0499","record_version":1,"title":"Bedrock multi-agent applications attacked via agent-to-agent manipulation","event_date":"2026-04-03","date_basis":"disclosed","date_disclosed":"2026-04-03","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Amazon Nova Premier v1","landscape_read":false,"developer":null,"deployer":null,"harness":"Amazon Bedrock Agents multi-agent collaboration","severity":"negligible","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"supply_chain","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0545","record_version":2,"title":"Users tricked Grok into sending crypto through hidden code and encoded prompts","event_date":"2026-05-04","date_basis":"disclosed","date_disclosed":"2026-05-04","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Grok","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"cryptocurrency","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0578","record_version":1,"title":"Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials","event_date":"2026-06-06","date_basis":"disclosed","date_disclosed":"2026-06-06","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Claude Code GitHub Action","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"supply_chain","industry":"software development","autonomy_level":null,"detection_method":"third_party"},{"id":"LR-2026-0580","record_version":3,"title":"SearchLeak flaw in Microsoft 365 Copilot exposed data","event_date":"2026-06-28","date_basis":"disclosed","date_disclosed":"2026-06-28","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Microsoft 365 Copilot","landscape_read":false,"developer":"Microsoft","deployer":null,"harness":"Microsoft 365 Copilot Enterprise Search","severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0593","record_version":3,"title":"GuardFall: shell-trick bypass of AI coding agent command guards","event_date":"2026-06-30","date_basis":"disclosed","date_disclosed":"2026-06-30","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude Sonnet","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0615","record_version":1,"title":"Hidden web text hijacks AWS Kiro IDE to run attacker code","event_date":"2026-07-21","date_basis":"disclosed","date_disclosed":"2026-07-21","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"AWS","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"supply_chain","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0616","record_version":1,"title":"GitLost: public GitHub issue tricks GitHub Agentic Workflows agent into leaking private repos","event_date":"2026-07-07","date_basis":"disclosed","date_disclosed":"2026-07-07","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"GitHub","deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0617","record_version":1,"title":"HalluSquatting: hallucinated resource names lead AI coding assistants to install botnet malware (research demonstration)","event_date":"2026-07-08","date_basis":"disclosed","date_disclosed":"2026-07-08","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"negligible","evidence_level":"confirmed","primary_risk":"RK14","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0621","record_version":2,"title":"Ghostcommit attack hides malicious AI instructions in images","event_date":"2026-07-13","date_basis":"disclosed","date_disclosed":"2026-07-13","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude Sonnet","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Cursor, Antigravity, Claude Code","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development / cybersecurity research","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0648","record_version":3,"title":"Hidden webpage instructions cause AI agents to pay hackers in live campaigns","event_date":"2026-07-09","date_basis":"disclosed","date_disclosed":"2026-07-09","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Llama 3.3 70B Instruct","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Cybersecurity research (security vendor testing AI agents)","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0685","record_version":1,"title":"Atlassian Rovo prompt injection exfiltrated Jira and Confluence data","event_date":"2026-08-05","date_basis":"disclosed","date_disclosed":"2026-08-05","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Atlassian","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0686","record_version":1,"title":"Grok chat data exfiltration via encrypted prompt injection (Cryptographic Context Injection)","event_date":"2026-08-20","date_basis":"disclosed","date_disclosed":"2026-08-20","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Grok","landscape_read":false,"developer":"xAI","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0724","record_version":2,"title":"Researchers break out of OpenAI Codex sandbox twice","event_date":"2026-09-21","date_basis":"disclosed","date_disclosed":"2026-09-21","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Codex","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":"Codex Desktop and Codex CLI","severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development / AI","autonomy_level":null,"detection_method":null},{"id":"LR-2026-0730","record_version":1,"title":"ChatGPT flaw let attackers read victims' Gmail through hidden channel","event_date":"2026-09-08","date_basis":"disclosed","date_disclosed":"2026-09-08","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"ChatGPT code execution containers","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0744","record_version":2,"title":"Russia-aligned UAC-0099 prompt injection against AI malware analysis (GuardBreaker)","event_date":"2026-09-01","date_basis":"disclosed","date_disclosed":"2026-09-01","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":null},{"id":"LR-2026-0762","record_version":3,"title":"GitHub Copilot CLI prompt-injection flaw lets a web page steer the agent to steal local secrets","event_date":"2026-10-06","date_basis":"disclosed","date_disclosed":"2026-10-06","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Copilot CLI","landscape_read":false,"developer":"GitHub","deployer":null,"harness":"GitHub Copilot CLI","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development / coding tools","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0780","record_version":1,"title":"Critical ChatGPT GitHub Connector flaw could leak private repository secrets","event_date":"2026-10-15","date_basis":"disclosed","date_disclosed":"2026-10-15","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"OpenAI","deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":null,"detection_method":"public_researcher"},{"id":"LR-2026-0781","record_version":3,"title":"OPPO Find X10 Manus AI agent email access: indirect prompt injection vulnerability disclosed","event_date":"2026-10-20","date_basis":"disclosed","date_disclosed":"2026-10-20","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Manus","landscape_read":false,"developer":"Butterfly Effect","deployer":null,"harness":"Manus Cascade framework (planner-executor hierarchy); OPPO AI Mind Pilot Agent Mode","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Consumer hardware / smartphone manufacturing","autonomy_level":null,"detection_method":"third_party"},{"id":"LR-2026-0810","record_version":4,"title":"Brazilian lawyers fined for hidden prompt injection targeting court AI Galileu","event_date":"2026-11-01","date_basis":"disclosed","date_disclosed":"2026-11-01","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Galileu","landscape_read":false,"developer":null,"deployer":null,"harness":"Galileu","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Public administration and courts","autonomy_level":null,"detection_method":"human_review"},{"id":"LR-2026-0828","record_version":1,"title":"Haiou Codex jailbreak bundle injects persistent gateway advertisements into agent instruction files","event_date":"2026-11-03","date_basis":"disclosed","date_disclosed":"2026-11-03","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Codex","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":"Codex","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":null,"industry":null,"autonomy_level":null,"detection_method":"public_researcher"}]}