Prompt injection incidents

Also on: Risk Hidden instructions hijack the agent

51 of 716 published incidents · major 10 · moderate 15 · minor 21 · negligible 5

Confirmed 16 · Preliminary 35

Who caught it, where the source says (32 of 51): Automated monitoring 1 · Human review 1 · Third party 5 · Outside researcher 25

Incidents per month

14 in Oct 2026, up from an average of 5 a month.

Disclosed	Incident	Severity	Evidence
2026-07-23	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent LR-2026-0090	minor	Confirmed
2026-07-21	Hidden web text hijacks AWS Kiro IDE to run attacker code LR-2026-0615	minor	Confirmed
2026-07-13	Ghostcommit attack hides malicious AI instructions in images LR-2026-0621	minor	Preliminary
2026-07-09	Hidden webpage instructions cause AI agents to pay hackers in live campaigns LR-2026-0648	minor	Preliminary
2026-07-08	HalluSquatting: hallucinated resource names lead AI coding assistants to install botnet malware (research demonstration) LR-2026-0617	negligible	Confirmed
2026-07-07	GitLost: public GitHub issue tricks GitHub Agentic Workflows agent into leaking private repos LR-2026-0616	moderate	Confirmed
2026-06-30	GuardFall: shell-trick bypass of AI coding agent command guards LR-2026-0593	major	Preliminary
2026-06-28	SearchLeak flaw in Microsoft 365 Copilot exposed data LR-2026-0580	major	Preliminary
2026-06-06	Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials LR-2026-0578	minor	Preliminary
2026-05-04	Users tricked Grok into sending crypto through hidden code and encoded prompts LR-2026-0545	moderate	Preliminary
2026-04-30	Google Gemini CLI flaw enabled host code execution and supply chain attacks LR-2026-0491	moderate	Preliminary
2026-04-09	Apple Intelligence guardrails bypassed with prompt injection LR-2026-0494	minor	Preliminary
2026-04-03	Bedrock multi-agent applications attacked via agent-to-agent manipulation LR-2026-0499	negligible	Preliminary
2026-04-01	Persistent memory compromise found in Claude Code LR-2026-0489	moderate	Confirmed
2026-03-03	Perplexity Comet browser flaws allow local file access and 1Password takeover LR-2026-0444	major	Preliminary
2026-02-27	Researchers show self-driving cars can be tricked by a printed sign LR-2026-0439	minor	Preliminary
2026-02-25	GitHub Copilot RoguePilot passive prompt injection repository takeover LR-2026-0408	moderate	Preliminary
2026-02-10	Google Translate Gemini mode vulnerable to prompt injection LR-2026-0407	major	Preliminary
2026-01-27	Critical Clawdbot vulnerabilities found enabling cryptocurrency theft LR-2026-0373	major	Preliminary
2026-01-25	Prompt injection leads to simulated /etc/passwd disclosure LR-2026-0371	negligible	Preliminary
2026-01-24	Reprompt: a single malicious Copilot link could expose user data LR-2026-0384	minor	Preliminary
2026-01-14	Reprompt attack enabled single-click data theft from Microsoft Copilot LR-2026-0386	minor	Confirmed
2025-12-12	Researchers hack Copilot AI agent, exposing fraud risks LR-2026-0344	minor	Preliminary
2025-11-23	EchoLeak zero-click prompt injection exploit in Microsoft 365 Copilot LR-2026-0336	major	Preliminary
2025-11-05	Tenable finds seven ChatGPT vulnerabilities enabling data leaks and persistent hijacking LR-2026-0335	minor	Confirmed

Previous · Page 2 of 3 · Next

By AI system named: Claude 2 · Claude Sonnet 2 · Codex 2 · Grok 2 · Manus 2 · Microsoft 365 Copilot 2

Download: JSON · CSV