3 incidents

HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target

Date	Incident	Risk	Controls named
2026-09-29	Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer Meta	Privacy harm to a person	MissingHuman approval for high-impact actions L3 MissingHuman approval for high-impact actions L3 MissingHuman approval for high-impact actions L3
2026-06-09	Varonis phishing simulation drove an OpenClaw email agent to forward credentials and a customer export to an external address Google	Hidden instructions hijack the agent	MissingHuman approval for high-impact actions L3 FailedHuman approval for high-impact actions L3 FailedHuman approval for high-impact actions L3
2026-04-25	Cursor coding agent deletes PocketOS production database and backups Anthropic	Agent takes destructive or unapproved actions	MissingHuman approval for high-impact actions L3 MissingProduction kept apart from test L3