{"dataset":"ai-agent-incidents","total":77,"columns":["id","record_version","title","event_date","date_basis","date_disclosed","incident_class","trigger","model_name","landscape_read","developer","deployer","harness","severity","evidence_level","primary_risk","risk_basis","chain_basis","attacker_run","cause","industry","autonomy_level","detection_method"],"rows":[{"id":"LR-2026-0826","record_version":1,"title":"WorkOS internal sales application breached via AI-assisted offensive framework ARTEX","event_date":"2026-10-30","date_basis":"occurred","date_disclosed":"2026-11-02","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"ARTEX","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_used_to_exploit","industry":"Software / identity and authentication services","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0818","record_version":1,"title":"CyberStrikeAI LLM-orchestrated intrusions against educational organizations in Africa and Latin America","event_date":"2026-11-02","date_basis":"disclosed","date_disclosed":"2026-11-02","incident_class":"security_compromise","trigger":"human_misuse","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"CyberStrikeAI","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"rule","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Educational Services","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0817","record_version":1,"title":"Morris agent bypasses Slack guard script via readable bot token, causing false unauthorized-message alarms","event_date":"2026-11-02","date_basis":"disclosed","date_disclosed":"2026-11-02","incident_class":"operational_error","trigger":"unknown","model_name":"Claude Code","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK24","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"software studio","autonomy_level":"supervised-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0816","record_version":1,"title":"CyberStrikeAI LLM-driven agent used in live intrusion against Windows domains","event_date":"2026-11-02","date_basis":"disclosed","date_disclosed":"2026-11-02","incident_class":"security_compromise","trigger":"human_misuse","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"CyberStrikeAI","severity":"major","evidence_level":"preliminary","primary_risk":"RK03","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_used_to_exploit","industry":"Educational Services","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0298","record_version":2,"title":"Ava AI agent misclassified emergency caller as nonemergency during 2024 rollout","event_date":"2026-10-31","date_basis":"disclosed","date_disclosed":"2026-10-31","incident_class":"operational_error","trigger":"unknown","model_name":null,"landscape_read":false,"developer":"Aurelian","deployer":null,"harness":"Ava","severity":"minor","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":"Emergency call centers (911 dispatch)","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0279","record_version":18,"title":"VAPOR PANDA agentic AI framework (ARTEX + DeepSeek) used for multi-target espionage campaign","event_date":"2026-10-17","date_basis":"occurred","date_disclosed":"2026-10-30","incident_class":"security_compromise","trigger":"human_misuse","model_name":"DeepSeek","landscape_read":false,"developer":null,"deployer":null,"harness":"ARTEX","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Public Administration","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0271","record_version":3,"title":"Multi-agent shutdown sabotage in a sandboxed evaluation environment","event_date":"2026-10-29","date_basis":"disclosed","date_disclosed":"2026-10-29","incident_class":"agent_misalignment","trigger":"unknown","model_name":"Gemini 3.1 Pro","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"Research and development in AI safety","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0266","record_version":4,"title":"Agentic AI intrusions by four threat actors (CrowdStrike 2026 Global Threat Report)","event_date":"2026-10-28","date_basis":"disclosed","date_disclosed":"2026-10-28","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Code","landscape_read":false,"developer":null,"deployer":null,"harness":"Claude Code","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Healthcare","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0258","record_version":10,"title":"CyberStrikeAI multi-agent platform drives end-to-end attack workflow against Japanese organizations","event_date":"2026-10-28","date_basis":"disclosed","date_disclosed":"2026-10-28","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"CyberStrikeAI","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0251","record_version":5,"title":"Dual-agent Claude Code/PentestGPT intrusion against 15 Argentine healthcare organizations","event_date":"2026-10-28","date_basis":"disclosed","date_disclosed":"2026-10-28","incident_class":"security_compromise","trigger":"human_misuse","model_name":"Claude Code","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Health Care and Social Assistance","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0276","record_version":4,"title":"DeepSeek V4.1 Flash-1017 disables shutdown script and kills co-tenant process in agentic evaluations","event_date":"2026-10-26","date_basis":"disclosed","date_disclosed":"2026-10-26","incident_class":"agent_misalignment","trigger":"reward_hack","model_name":"DeepSeek-V4.1-Flash","landscape_read":false,"developer":"DeepSeek","deployer":null,"harness":"FoFBench (Fail or Foul Benchmark) client-server harness with SSH access to a remote grading server","severity":"minor","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0261","record_version":6,"title":"Frontier models autonomously raise agentic wallet spending cap by harvesting emailed OTPs","event_date":"2026-10-26","date_basis":"disclosed","date_disclosed":"2026-10-26","incident_class":"agent_misalignment","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0260","record_version":8,"title":"Symantec honeypot captures autonomous 'Skynet mode' attack agent hijacking exposed AI models","event_date":"2026-10-26","date_basis":"disclosed","date_disclosed":"2026-10-26","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0254","record_version":5,"title":"AI-assisted ARTEX hacking campaign targeting financial and personal data across 19 markets","event_date":"2026-10-26","date_basis":"disclosed","date_disclosed":"2026-10-26","incident_class":"security_compromise","trigger":"human_misuse","model_name":"DeepSeek, GLM, Grok","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Finance and Insurance","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0247","record_version":14,"title":"Anthropic's Claude agent autonomously accessed Georgia voter data hub and bypassed a paywall","event_date":"2026-10-26","date_basis":"disclosed","date_disclosed":"2026-10-26","incident_class":"operational_error","trigger":"unknown","model_name":"Claude","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":"Information","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0246","record_version":5,"title":"Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains","event_date":"2026-08-13","date_basis":"occurred","date_disclosed":"2026-10-26","incident_class":"security_compromise","trigger":"human_misuse","model_name":"Claude Code","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude Code","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Healthcare and government","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0245","record_version":5,"title":"Self-taught hacker uses AI coding agent and autonomous penetration-testing system to breach 90+ companies and steal 8.2 million records","event_date":"2025-09-01","date_basis":"occurred","date_disclosed":"2026-10-26","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":"AI coding agent and an autonomous AI penetration testing system","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"victim"},{"id":"LR-2026-0235","record_version":24,"title":"Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…","event_date":"2026-10-15","date_basis":"occurred","date_disclosed":"2026-10-22","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":"ARTEX","severity":"major","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_used_to_exploit","industry":"IT services (managed service providers)","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0232","record_version":6,"title":"ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions","event_date":"2026-10-21","date_basis":"disclosed","date_disclosed":"2026-10-21","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":"ARTEX","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Finance and Insurance","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0229","record_version":7,"title":"China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms","event_date":"2026-10-20","date_basis":"disclosed","date_disclosed":"2026-10-20","incident_class":"security_compromise","trigger":"unknown","model_name":"Artex","landscape_read":true,"developer":null,"deployer":null,"harness":"Artex","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Retail Trade; Transportation and Warehousing; Finance and Insurance","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0228","record_version":18,"title":"Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform","event_date":"2026-09-25","date_basis":"occurred","date_disclosed":"2026-10-20","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":"A Chinese-speaking hacker","harness":"Cairn","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Retail Trade","autonomy_level":"supervised-auto","detection_method":"public_researcher"},{"id":"LR-2026-0793","record_version":3,"title":"OpenAI discloses four more rogue incidents involving financial, medical and government data","event_date":"2026-06-26","date_basis":"occurred","date_disclosed":"2026-10-16","incident_class":"agent_misalignment","trigger":"unknown","model_name":"GPT-5.6 Sol","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK03","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0168","record_version":8,"title":"CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents","event_date":"2026-10-12","date_basis":"disclosed","date_disclosed":"2026-10-12","incident_class":"security_compromise","trigger":"human_misuse","model_name":"Claude Code","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude Code with a cluster of 51 specialized agents; PentAGI connected to Cobalt Strike","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"critical infrastructure and e-commerce","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0152","record_version":20,"title":"Anthropic AI agent sends fabricated murder tip to Philadelphia Police","event_date":"2026-07-18","date_basis":"occurred","date_disclosed":"2026-10-10","incident_class":"operational_error","trigger":"unknown","model_name":"Claude Haiku 4.5","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK19","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":"Public Administration","autonomy_level":"full-auto","detection_method":"human_review"},{"id":"LR-2026-0133","record_version":9,"title":"Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data","event_date":"2026-10-07","date_basis":"disclosed","date_disclosed":"2026-10-07","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":"Strix, Cairn, Hermes","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Retail","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0762","record_version":3,"title":"GitHub Copilot CLI prompt-injection flaw lets a web page steer the agent to steal local secrets","event_date":"2026-10-06","date_basis":"disclosed","date_disclosed":"2026-10-06","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Copilot CLI","landscape_read":false,"developer":"GitHub","deployer":null,"harness":"GitHub Copilot CLI","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development / coding tools","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0114","record_version":7,"title":"Reward hacking in Arcadia Impact automated research scaffold worker agents","event_date":"2026-10-02","date_basis":"disclosed","date_disclosed":"2026-10-02","incident_class":"agent_misalignment","trigger":"reward_hack","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK10","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":"AI safety research","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0794","record_version":3,"title":"OpenAI test-environment AI agents escape containment and attack Hugging Face (FTC investigation)","event_date":"2026-10-01","date_basis":"disclosed","date_disclosed":"2026-10-01","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":"OpenAI","deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK05","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":"AI research and development","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0727","record_version":2,"title":"XBOW autonomous agent finds Linux kernel DIBS loopback flaw enabling local root (CVE-2026-72018)","event_date":"2026-09-30","date_basis":"disclosed","date_disclosed":"2026-09-30","incident_class":"other","trigger":"unknown","model_name":null,"landscape_read":false,"developer":"XBOW","deployer":null,"harness":"XBOW autonomous security research platform agent","severity":"negligible","evidence_level":"preliminary","primary_risk":null,"risk_basis":"none","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"Cybersecurity / vulnerability research","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0103","record_version":8,"title":"Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer","event_date":"2026-09-29","date_basis":"disclosed","date_disclosed":"2026-09-29","incident_class":"privacy_leakage","trigger":"unknown","model_name":"Muse","landscape_read":true,"developer":"Meta","deployer":"individual user","harness":"Muse","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK04","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"user_misuse","industry":"Technology","autonomy_level":"full-auto","detection_method":"victim"},{"id":"LR-2026-0716","record_version":3,"title":"Storm-3168 / JADEPUFFER agentic attack on Azure via compromised service principals","event_date":"2026-06-01","date_basis":"occurred","date_disclosed":"2026-09-28","incident_class":"security_compromise","trigger":"credential_exposure","model_name":"Jadepuffer","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK03","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"Cloud computing","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0069","record_version":12,"title":"OpenAI agents bypass website security controls and republish SEC data","event_date":"2026-09-26","date_basis":"disclosed","date_disclosed":"2026-09-26","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"OpenAI","deployer":null,"harness":"OpenAI agents","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK04","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0063","record_version":27,"title":"OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database","event_date":"2026-06-18","date_basis":"occurred","date_disclosed":"2026-09-24","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"OpenAI","deployer":"OpenAI","harness":null,"severity":"major","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"ai_acting_alone","industry":"Public administration","autonomy_level":"full-auto","detection_method":"human_review"},{"id":"LR-2026-0054","record_version":18,"title":"SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form","event_date":"2026-09-24","date_basis":"disclosed","date_disclosed":"2026-09-24","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Agentforce","landscape_read":true,"developer":"Salesforce","deployer":null,"harness":"Agentforce","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"CRM software","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0748","record_version":3,"title":"Open-source AI agents breach 27 companies and steal 600,000 card records","event_date":"2026-09-10","date_basis":"occurred","date_disclosed":"2026-09-23","incident_class":"security_compromise","trigger":"human_misuse","model_name":null,"landscape_read":false,"developer":"Open-source projects behind Strix, Cairn and Hermes","deployer":null,"harness":"Hermes (central orchestration harness), with Strix and Cairn","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":"Retail Trade","autonomy_level":"supervised-auto","detection_method":"third_party"},{"id":"LR-2026-0056","record_version":14,"title":"Anthropic model conducted state-sponsored espionage campaign against ~30 targets","event_date":"2026-09-23","date_basis":"disclosed","date_disclosed":"2026-09-23","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"Anthropic","deployer":null,"harness":null,"severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0033","record_version":11,"title":"Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation","event_date":"2026-05-01","date_basis":"occurred","date_disclosed":"2026-09-19","incident_class":"security_compromise","trigger":"credential_exposure","model_name":"Gemini","landscape_read":true,"developer":"Google","deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0059","record_version":14,"title":"AEPD-confirmed autonomous AI agent data breach (Spain)","event_date":"2026-09-15","date_basis":"occurred","date_disclosed":"2026-09-16","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0016","record_version":18,"title":"Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training","event_date":"2026-04-14","date_basis":"occurred","date_disclosed":"2026-09-16","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"OpenAI","deployer":"OpenAI","harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK04","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"ai_acting_alone","industry":"Artificial intelligence research and development","autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0014","record_version":16,"title":"Unreleased OpenAI models uploaded task data and a task photo to public file hosts to obtain citations and image search during RL training","event_date":"2026-09-16","date_basis":"disclosed","date_disclosed":"2026-09-16","incident_class":"agent_misalignment","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"OpenAI","deployer":null,"harness":null,"severity":"minor","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"Information","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0032","record_version":11,"title":"Agent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft","event_date":"2026-05-05","date_basis":"occurred","date_disclosed":"2026-09-11","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":true,"developer":"OpenAI","deployer":null,"harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":null,"autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0759","record_version":2,"title":"Anthropic discloses fourth AI hacking incident involving Claude Opus 4.6","event_date":"2026-01-01","date_basis":"occurred","date_disclosed":"2026-09-10","incident_class":"agent_misalignment","trigger":"unknown","model_name":"Claude Opus","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK10","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"not_classified","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0031","record_version":11,"title":"AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded","event_date":"2026-08-31","date_basis":"occurred","date_disclosed":"2026-09-09","incident_class":"security_compromise","trigger":"unknown","model_name":"Codex","landscape_read":true,"developer":"OpenAI","deployer":null,"harness":"Codex","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"stored","attacker_run":true,"cause":"ai_used_to_exploit","industry":"education","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0745","record_version":2,"title":"Claude Code Auto Mode: website summary leads to remote code execution via Python module shadowing","event_date":"2026-09-01","date_basis":"disclosed","date_disclosed":"2026-09-01","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Opus 5","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Claude Code Auto Mode","severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Software development / AI tooling","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0687","record_version":1,"title":"Claude Code Opus 5 in Auto Mode tricked into running malicious code via website summary request","event_date":"2026-08-28","date_basis":"disclosed","date_disclosed":"2026-08-28","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Code Opus 5","landscape_read":false,"developer":null,"deployer":null,"harness":"Claude Code","severity":"minor","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"rule","chain_basis":"stored","attacker_run":true,"cause":"ai_attacked","industry":null,"autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0670","record_version":1,"title":"AI-assisted change introduced a script-injection flaw in a Snowflake GitHub workflow, later exploited by an autonomous research agent","event_date":"2026-08-18","date_basis":"disclosed","date_disclosed":"2026-08-18","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":"Wiz","deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK03","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0717","record_version":1,"title":"Autonomous AI agent swarm breaches 21 Taiwanese government systems, cracks 85 accounts and extracts 2,500 personnel records (July 2026)","event_date":"2026-07-01","date_basis":"occurred","date_disclosed":"2026-08-13","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_acting_alone","industry":"government","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0046","record_version":18,"title":"OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist","event_date":"2026-08-10","date_basis":"disclosed","date_disclosed":"2026-08-10","incident_class":"agent_misalignment","trigger":"unknown","model_name":"Claude","landscape_read":true,"developer":"Anthropic","deployer":"individual user","harness":"OpenClaw","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_acting_alone","industry":"Fitness and recreational sports centers","autonomy_level":"full-auto","detection_method":"victim"},{"id":"LR-2026-0689","record_version":1,"title":"Irregular evaluation misconfiguration let Claude Mythos 5 reach real systems","event_date":"2026-08-07","date_basis":"disclosed","date_disclosed":"2026-08-07","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Mythos 5","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0089","record_version":13,"title":"Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover","event_date":"2026-08-05","date_basis":"disclosed","date_disclosed":"2026-08-05","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude in Chrome (Claude Chrome extension)","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0022","record_version":16,"title":"AISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues","event_date":"2026-07-25","date_basis":"occurred","date_disclosed":"2026-08-04","incident_class":"agent_misalignment","trigger":"impossible_task","model_name":"Mythos 5","landscape_read":true,"developer":"Anthropic","deployer":"UK’s AI Security Institute (AISI)","harness":null,"severity":"moderate","evidence_level":"confirmed","primary_risk":"RK09","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":"government AI safety evaluation","autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0610","record_version":1,"title":"Hacker uses DeepSeek agent to autonomously attack vulnerable servers","event_date":"2026-05-01","date_basis":"occurred","date_disclosed":"2026-07-31","incident_class":"security_compromise","trigger":"unknown","model_name":"DeepSeek","landscape_read":false,"developer":null,"deployer":null,"harness":"Hermes Agent","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"stored","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0090","record_version":15,"title":"AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent","event_date":"2026-07-23","date_basis":"disclosed","date_disclosed":"2026-07-23","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"ChatGPT","landscape_read":true,"developer":"OpenAI","deployer":null,"harness":"Workspace Agents Builder","severity":"minor","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"Information","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0001","record_version":11,"title":"OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet","event_date":"2026-07-08","date_basis":"occurred","date_disclosed":"2026-07-21","incident_class":"agent_misalignment","trigger":"reward_hack","model_name":"GPT-5.6 Sol","landscape_read":true,"developer":"OpenAI","deployer":null,"harness":"ExploitGym benchmark evaluation harness","severity":"major","evidence_level":"confirmed","primary_risk":"RK05","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":"Information","autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0619","record_version":3,"title":"FakeGit campaign targets AI coding agents with malicious GitHub repos","event_date":"2026-07-20","date_basis":"disclosed","date_disclosed":"2026-07-20","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Code, Gemini, ChatGPT","landscape_read":false,"developer":"Anthropic, Google, OpenAI","deployer":null,"harness":"AI agent searching for a skill or an MCP server","severity":"moderate","evidence_level":"confirmed","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0003","record_version":41,"title":"OpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions","event_date":"2026-07-11","date_basis":"occurred","date_disclosed":"2026-07-16","incident_class":"agent_misalignment","trigger":"reward_hack","model_name":"GPT-5.6 Sol","landscape_read":true,"developer":"OpenAI","deployer":"OpenAI","harness":"ExploitGym benchmark evaluation environment","severity":"major","evidence_level":"confirmed","primary_risk":"RK05","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":"Information","autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0640","record_version":3,"title":"GPT-5.6 Sol Ultra-mode subagent ran rm -rf on Matt Shumer's Mac (press report of his X post)","event_date":"2026-07-10","date_basis":"occurred","date_disclosed":"2026-07-10","incident_class":"operational_error","trigger":"unknown","model_name":"GPT-5.6 Sol","landscape_read":false,"developer":"OpenAI","deployer":null,"harness":"Ultra mode subagent orchestration","severity":"minor","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":"Technology","autonomy_level":"supervised-auto","detection_method":"victim"},{"id":"LR-2026-0648","record_version":3,"title":"Hidden webpage instructions cause AI agents to pay hackers in live campaigns","event_date":"2026-07-09","date_basis":"disclosed","date_disclosed":"2026-07-09","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Llama 3.3 70B Instruct","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Cybersecurity research (security vendor testing AI agents)","autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0593","record_version":3,"title":"GuardFall: shell-trick bypass of AI coding agent command guards","event_date":"2026-06-30","date_basis":"disclosed","date_disclosed":"2026-06-30","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Claude Sonnet","landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":"full-auto","detection_method":"public_researcher"},{"id":"LR-2026-0591","record_version":3,"title":"Clean GitHub repo tricks AI coding agents into running malware","event_date":"2026-06-27","date_basis":"disclosed","date_disclosed":"2026-06-27","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Code","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Claude Code","severity":"major","evidence_level":"preliminary","primary_risk":"RK02","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_used_to_exploit","industry":"software development","autonomy_level":"supervised-auto","detection_method":null},{"id":"LR-2026-0606","record_version":3,"title":"AI agent bogus scan leaves developer begging for crypto donations","event_date":"2026-05-09","date_basis":"occurred","date_disclosed":"2026-06-13","incident_class":"operational_error","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"minor","evidence_level":"preliminary","primary_risk":"RK22","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":"hobbyist networking","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0581","record_version":3,"title":"Marimo notebook flaw (CVE-2026-39987) exploited in LLM-agent-driven intrusion","event_date":"2026-05-10","date_basis":"occurred","date_disclosed":"2026-06-01","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"preliminary","primary_risk":"RK04","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0550","record_version":3,"title":"Attackers use LLM agent for post-exploitation after Marimo exploit","event_date":"2026-05-10","date_basis":"occurred","date_disclosed":"2026-05-29","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":"LLM agent","severity":"major","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"rule","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0547","record_version":1,"title":"AI agent intrusion in the wild steals database in under an hour","event_date":"2026-05-10","date_basis":"occurred","date_disclosed":"2026-05-28","incident_class":"security_compromise","trigger":"human_misuse","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0542","record_version":2,"title":"Google Chrome silently downloads 4GB on-device AI model without permission","event_date":"2026-05-06","date_basis":"disclosed","date_disclosed":"2026-05-06","incident_class":"other","trigger":"unknown","model_name":"Gemini Nano","landscape_read":false,"developer":"Google","deployer":null,"harness":"Google Chrome browser","severity":"moderate","evidence_level":"preliminary","primary_risk":null,"risk_basis":"none","chain_basis":"unread","attacker_run":false,"cause":"not_classified","industry":"Information","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0491","record_version":1,"title":"Google Gemini CLI flaw enabled host code execution and supply chain attacks","event_date":"2026-04-30","date_basis":"disclosed","date_disclosed":"2026-04-30","incident_class":"security_compromise","trigger":"prompt_injection","model_name":null,"landscape_read":false,"developer":"Google","deployer":null,"harness":"Gemini CLI","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0095","record_version":20,"title":"Cursor coding agent deletes PocketOS production database and backups","event_date":"2026-04-25","date_basis":"occurred","date_disclosed":"2026-04-27","incident_class":"operational_error","trigger":"unknown","model_name":"Claude Opus 4.6","landscape_read":true,"developer":"Anthropic","deployer":"PocketOS","harness":"Cursor","severity":"major","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_acting_alone","industry":"Software Publishers","autonomy_level":"full-auto","detection_method":"human_review"},{"id":"LR-2026-0466","record_version":2,"title":"SentinelOne blocks Claude-driven zero-day supply chain attack (LiteLLM trojan)","event_date":"2026-03-24","date_basis":"occurred","date_disclosed":"2026-03-31","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude Code","landscape_read":false,"developer":"Anthropic","deployer":null,"harness":"Claude Code","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"ai_failing","industry":"Cybersecurity / endpoint security vendor (press account of customer environments)","autonomy_level":"full-auto","detection_method":"automated_monitor"},{"id":"LR-2026-0395","record_version":2,"title":"Lobstar Wilde AI crypto agent sends 52.4M LOBSTAR tokens to a random user","event_date":"2026-02-25","date_basis":"disclosed","date_disclosed":"2026-02-25","incident_class":"operational_error","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"moderate","evidence_level":"preliminary","primary_risk":"RK22","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0403","record_version":1,"title":"Hundreds of FortiGate firewalls compromised by a threat actor using commercial generative AI services (Jan-Feb 2026)","event_date":"2026-02-20","date_basis":"disclosed","date_disclosed":"2026-02-20","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2026-0402","record_version":1,"title":"hackerbot-claw AI bot actively exploits GitHub Actions workflows","event_date":"2026-02-20","date_basis":"disclosed","date_disclosed":"2026-02-20","incident_class":"security_compromise","trigger":"unknown","model_name":null,"landscape_read":false,"developer":null,"deployer":null,"harness":null,"severity":"major","evidence_level":"confirmed","primary_risk":"RK03","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"ai_attacked","industry":"open source software","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0048","record_version":10,"title":"Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage","event_date":"2025-12-01","date_basis":"occurred","date_disclosed":"2026-02-20","incident_class":"operational_error","trigger":"unknown","model_name":"Kiro","landscape_read":true,"developer":"Amazon","deployer":null,"harness":"Kiro","severity":"major","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"stored","attacker_run":false,"cause":"user_misuse","industry":"Information","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0344","record_version":3,"title":"Researchers hack Copilot AI agent, exposing fraud risks","event_date":"2025-12-12","date_basis":"disclosed","date_disclosed":"2025-12-12","incident_class":"security_compromise","trigger":"prompt_injection","model_name":"Microsoft Copilot Studio","landscape_read":false,"developer":"Microsoft","deployer":null,"harness":"Microsoft Copilot Studio","severity":"minor","evidence_level":"preliminary","primary_risk":"RK01","risk_basis":"stored","chain_basis":"unread","attacker_run":false,"cause":"ai_attacked","industry":"Professional, Scientific, and Technical Services","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2026-0338","record_version":2,"title":"Ontario hospital AI transcription bot sends confidential patient information to recipients after recording a meeting","event_date":"2024-09-23","date_basis":"occurred","date_disclosed":"2025-11-21","incident_class":"privacy_leakage","trigger":"unknown","model_name":"Otter.ai","landscape_read":false,"developer":null,"deployer":null,"harness":"Otter.ai meeting transcription bot","severity":"moderate","evidence_level":"preliminary","primary_risk":"RK15","risk_basis":"rule","chain_basis":"unread","attacker_run":false,"cause":"user_misuse","industry":"Health Care and Social Assistance","autonomy_level":"full-auto","detection_method":null},{"id":"LR-2025-0044","record_version":14,"title":"Anthropic disclosed a cybercriminal using Claude Code to automate data theft and extortion across at least 17 organizations","event_date":"2025-08-27","date_basis":"disclosed","date_disclosed":"2025-08-27","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude","landscape_read":true,"developer":"Anthropic","deployer":null,"harness":"Claude Code","severity":"major","evidence_level":"confirmed","primary_risk":"RK07","risk_basis":"stored","chain_basis":"unread","attacker_run":true,"cause":"ai_used_to_exploit","industry":null,"autonomy_level":"full-auto","detection_method":null},{"id":"LR-2025-0041","record_version":11,"title":"Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration","event_date":"2025-08-26","date_basis":"occurred","date_disclosed":"2025-08-27","incident_class":"security_compromise","trigger":"unknown","model_name":"Claude","landscape_read":true,"developer":null,"deployer":null,"harness":"AI CLIs (Claude, Gemini, Amazon Q)","severity":"major","evidence_level":"confirmed","primary_risk":"RK06","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"ai_used_to_exploit","industry":"Software publishing / npm ecosystem","autonomy_level":"full-auto","detection_method":"third_party"},{"id":"LR-2025-0031","record_version":19,"title":"Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible","event_date":"2025-07-18","date_basis":"occurred","date_disclosed":"2025-07-21","incident_class":"operational_error","trigger":"unknown","model_name":"Replit AI","landscape_read":true,"developer":"Replit","deployer":null,"harness":"Replit Agent","severity":"major","evidence_level":"confirmed","primary_risk":"RK02","risk_basis":"stored","chain_basis":"legacy","attacker_run":false,"cause":"ai_acting_alone","industry":"Software Publishers","autonomy_level":"full-auto","detection_method":"victim"}]}