Prompt injection incidents

Also on: Risk Hidden instructions hijack the agent

51 of 716 published incidents · major 10 · moderate 15 · minor 21 · negligible 5

Confirmed 16 · Preliminary 35

Who caught it, where the source says (32 of 51): Automated monitoring 1 · Human review 1 · Third party 5 · Outside researcher 25

Incidents per month

47 so far in 2026; 1 in the same span of 2025.

Disclosed	Incident	Severity	Evidence
2026-11-03	Haiou Codex jailbreak bundle injects persistent gateway advertisements into agent instruction files LR-2026-0828	minor	Confirmed
2026-11-01	Brazilian lawyers fined for hidden prompt injection targeting court AI Galileu LR-2026-0810	moderate	Preliminary
2026-10-30	EMBRACE: Codex embedded browser reads files outside the project via malicious HTML LR-2026-0296	moderate	Preliminary
2026-10-29	University of Washington study demonstrates cross-origin data theft via prompt injection in ChatGPT Atlas Agent Mode LR-2026-0303	moderate	Preliminary
2026-10-27	Perplexity Comet browser agent bypasses file:// hard boundary twice, enabling local file exfiltration and 1Password vault takeover LR-2026-0253	major	Preliminary
2026-10-20	OPPO Find X10 Manus AI agent email access: indirect prompt injection vulnerability disclosed LR-2026-0781	minor	Preliminary
2026-10-16	Indirect prompt injection attempts embedded in HTTP response headers across websites LR-2026-0202	minor	Preliminary
2026-10-15	Critical ChatGPT GitHub Connector flaw could leak private repository secrets LR-2026-0780	minor	Preliminary
2026-10-15	HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent LR-2026-0189	negligible	Preliminary
2026-10-10	AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS LR-2026-0153	major	Preliminary
2026-10-07	Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs LR-2026-0136	major	Preliminary
2026-10-07	Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment LR-2026-0135	moderate	Confirmed
2026-10-06	GitHub Copilot CLI prompt-injection flaw lets a web page steer the agent to steal local secrets LR-2026-0762	moderate	Preliminary
2026-10-05	Indirect prompt injection of AI email summarizer via forged header blocks in plain view LR-2026-0125	negligible	Preliminary
2026-10-04	Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure LR-2026-0123	moderate	Preliminary
2026-10-03	Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies LR-2026-0115	moderate	Preliminary
2026-09-29	Connecticut pro se plaintiff sanctioned for prompt injection against court AI tool LR-2026-0102	minor	Preliminary
2026-09-24	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form LR-2026-0054	minor	Confirmed
2026-09-21	Researchers break out of OpenAI Codex sandbox twice LR-2026-0724	major	Preliminary
2026-09-08	ChatGPT flaw let attackers read victims' Gmail through hidden channel LR-2026-0730	moderate	Confirmed
2026-09-01	Russia-aligned UAC-0099 prompt injection against AI malware analysis (GuardBreaker) LR-2026-0744	minor	Confirmed
2026-08-27	Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document LR-2026-0086	moderate	Confirmed
2026-08-20	Grok chat data exfiltration via encrypted prompt injection (Cryptographic Context Injection) LR-2026-0686	minor	Confirmed
2026-08-05	Atlassian Rovo prompt injection exfiltrated Jira and Confluence data LR-2026-0685	minor	Confirmed
2026-08-05	Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover LR-2026-0089	minor	Confirmed

Page 1 of 3 · Next

By AI system named: Claude 2 · Claude Sonnet 2 · Codex 2 · Grok 2 · Manus 2 · Microsoft 365 Copilot 2

Download: JSON · CSV