5 incidents

Risk: Hidden instructions hijack the agent Control: Outside content treated as data, not instructions Outcome: Not mentioned

HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target

Date	Incident	Risk	Controls named
2026-09-24	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form Salesforce	Hidden instructions hijack the agent	Got aroundOutput filtering and redaction L3 Got aroundOutput filtering and redaction L3 Got aroundOutput filtering and redaction L3
2026-08-05	Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover Anthropic	Hidden instructions hijack the agent	Got aroundHuman approval for high-impact actions L3 Got aroundHuman approval for high-impact actions L3 Got aroundSafety training and refusal L1
2026-08-05	Intent collision via X comment hijacks ChatGPT Atlas into mass WhatsApp phishing from victim's account OpenAI	Hidden instructions hijack the agent	Got aroundPrompt-injection detection L2 Got aroundPrompt-injection detection L2 Got aroundHuman approval for high-impact actions L3
2026-07-23	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent OpenAI	Hidden instructions hijack the agent	Got aroundHuman approval for high-impact actions L3 Got aroundHuman approval for high-impact actions L3
2026-06-09	Varonis phishing simulation drove an OpenClaw email agent to forward credentials and a customer export to an external address Google	Hidden instructions hijack the agent	MissingHuman approval for high-impact actions L3 FailedHuman approval for high-impact actions L3 FailedHuman approval for high-impact actions L3