AI Risk Wire

Incidents

15 incidents

Risk: Hidden instructions hijack the agent Control: Memory review and expiry Outcome: Not stated in sources

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

DateIncidentRiskWhere it failedControls mentioned in sources
2026-10-26Malicious AGENTS.md in Downloads folder hijacks Codex and Claude Code agents
OpenAI		 Hidden instructions hijack the agent
Not effective (bypassed)Human approval for high-impact actions L3
Not effective (bypassed)Sandboxed code execution L2
2026-10-15Critical ChatGPT GitHub Connector flaw could leak private repository secrets
OpenAI		 Hidden instructions hijack the agent
Not effective (bypassed)Safety training and refusal L1
2026-09-24SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form
Salesforce		 Hidden instructions hijack the agent
Not effective (bypassed)Output filtering and redaction L3
Not effective (bypassed)Network egress control L2
2026-09-08ChatGPT flaw let attackers read victims' Gmail through hidden channel Hidden instructions hijack the agent
Did not existStop control L2
2026-08-20Grok chat data exfiltration via encrypted prompt injection (Cryptographic Context Injection)
xAI		 Hidden instructions hijack the agent
Did not existNetwork egress control L2
2026-08-05Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover
Anthropic		 Hidden instructions hijack the agent
Not effective (bypassed)Prompt-injection detection L2
2026-07-23AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent
OpenAI		 Hidden instructions hijack the agent
Not effective (bypassed)Human approval for high-impact actions L3
2026-06-12Agentjacking attack tricks AI coding agents into running malicious code Hidden instructions hijack the agent
2026-06-06Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials
Anthropic		 Hidden instructions hijack the agent
Not effective (bypassed)Secrets scanning L4
2026-04-30Google Gemini CLI flaw enabled host code execution and supply chain attacks
Google		 Hidden instructions hijack the agent
Not effective (bypassed)Sandboxed code execution L2
Not effective (bypassed)Tool allow-list L2
2026-04-03Bedrock multi-agent applications attacked via agent-to-agent manipulation Hidden instructions hijack the agent
2026-02-25GitHub Copilot RoguePilot passive prompt injection repository takeover Hidden instructions hijack the agent
2026-01-25Prompt injection leads to simulated /etc/passwd disclosure Hidden instructions hijack the agent
2026-01-24Reprompt: a single malicious Copilot link could expose user data
Microsoft		 Hidden instructions hijack the agent
2025-11-23EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot
Microsoft		 Hidden instructions hijack the agent
Not effective (bypassed)Prompt-injection detection L2
Not effective (bypassed)Output filtering and redaction L3