The record: what has actually happened

Agent security incidents in context

• 2022-09-12 — “Prompt injection” gets its name:

  Simon Willison named the attack Riley Goodside had demonstrated against GPT-3 apps that same day: instructions smuggled in through data the model reads. Note the date — the vulnerability is named eleven weeks before ChatGPT ships and six months before anyone connects a model to third-party tools.

• 2023-02-10 — Bing Chat gives up its system prompt:

  Within days of launch, users talked the “Sydney” system prompt out of Microsoft’s new chat product. Treat this as settled: a system prompt is not a secret and not a security boundary — anything you put there is recoverable, and anything you rely on it to prevent is unenforced.

• 2023-02-23 — Indirect prompt injection:

  Greshake et al. showed that the attacker does not need to talk to your model at all: planting instructions in a web page, an email, or a document the model later retrieves is enough. This is the threat model for every agent with a retrieval tool or an inbox, and it lands a month before the tool-calling products do.

• 2024-02-01 — Air Canada is held liable for what its chatbot promised:

  A tribunal ordered the airline to pay a passenger who relied on a bereavement-fare policy the chatbot invented, explicitly rejecting the argument that the bot was “a separate legal entity responsible for its own actions”. Your agent’s output is your statement — that is the whole legal story of agentic UX in one small claim.

• 2024-08-06 — Copilot Studio SSRF reaches the cloud metadata service (CVE-2024-38206):

  Tenable chained Copilot Studio’s HTTP-request capability with a redirect that bypassed its SSRF protection, reaching the Azure instance metadata service and internal Cosmos DB instances. A tool that fetches URLs on the agent’s behalf is a request forgery primitive unless the runtime constrains its egress.

• 2024-08-20 — Slack AI leaks private-channel data through a rendered link:

  PromptArmor showed that an injection planted in a public channel with one member could make Slack AI fold a private-channel secret into a markdown link the victim would click. Retrieval scope plus link rendering is an exfiltration channel — the pattern every 2025 disclosure repeats.

• 2025-05-22 — GitLab Duo leaks private source via injected prompts:

  Legit Security hid instructions in merge requests, commits, issues, and code; Duo read them as instructions and exfiltrated private source through HTML it was allowed to render. GitLab fixed it by blocking unsafe external HTML — the fix is in the renderer, not the prompt.

• 2025-05-26 — The GitHub MCP “toxic agent flow”:

  Invariant Labs showed a malicious issue in a public repo could steer an agent using the official GitHub MCP server into publishing private-repository contents in a public pull request. Nothing in the server was buggy: the flaw is granting one agent session read access to private data and write access to public surfaces.

• 2025-06-11 — EchoLeak: zero-click exfiltration from Microsoft 365 Copilot (CVE-2025-32711):

  Aim Labs and Microsoft disclosed a CVSS 9.3 chain needing no user interaction at all — an email arrives, Copilot retrieves it, tenant data leaves. The researchers named the underlying class LLM Scope Violation; Microsoft mitigated it server-side with no customer action, and there is no evidence of exploitation in the wild.

• 2025-06-16 — The lethal trifecta gets its name:

  Simon Willison named the combination that turns every disclosure above into the same bug: private data + untrusted content + a way to communicate externally. Remove any one leg and exfiltration stops being available, which is why capability design beats prompt hardening.

• 2025-07-09 — mcp-remote RCE (CVE-2025-6514) caps an MCP tooling CVE wave:

  A malicious MCP server’s OAuth metadata could execute OS commands on the client through mcp-remote (CVSS 9.6) — weeks after MCP Inspector RCE (CVE-2025-49596, 13 June) and the Filesystem reference server’s path-traversal bypasses (CVE-2025-53109/53110, 2 July). The protocol’s attack surface is its client-side tooling, and connecting to an untrusted server is a code-execution decision.

• 2025-07-21 — A Replit agent deletes a production database:

  The Register reported Jason Lemkin’s account: the agent dropped his production data during an attempted code freeze, then reported that rollback was impossible (it was not) and produced fabricated records. Replit’s CEO responded the next day with automatic dev/prod database separation — the guardrail that should have existed before the agent had credentials.

• 2025-07-23 — Malicious commit ships in the Amazon Q Developer extension (AWS-2025-015):

  A threat actor used an over-scoped GitHub token to inject code into VS Code extension release 1.84.0; AWS confirmed the payload failed to execute because of a syntax error and shipped 1.85.0. Your agent’s distribution channel is part of its trust boundary.

• 2025-08-05 — CurXecute (CVE-2025-54135) and AgentFlayer: config files are an attack surface:

  Aim Labs showed indirect injection could make Cursor write a new .cursor/mcp.json without approval — new tools, no consent, remote code execution (fixed in 1.3.9). A day later Zenity Labs’ AgentFlayer demonstrated zero-click exfiltration from ChatGPT Connectors via poisoned documents and image URLs, and on 12 August Microsoft patched the analogous VS Code settings.json flaw (CVE-2025-53773).

• 2025-08-26 — Nx “s1ngularity” conscripts AI CLIs into a supply-chain attack:

  Malicious Nx npm releases stole credentials and then invoked the developer’s installed Claude, Gemini, and Q CLI tools to hunt the filesystem for more, publishing loot to s1ngularity-repository repos in victims’ own GitHub accounts; a second wave exposed 5,500-plus private repositories. Local coding agents were not the target here; they were the attacker’s reconnaissance engine, because they already had filesystem access and credentials.

• 2025-09-18 — ShadowLeak: the exfiltration happens on the vendor’s servers:

  Radware disclosed that one crafted email could make ChatGPT Deep Research send Gmail inbox PII to an attacker URL from OpenAI’s cloud, so no endpoint or network control on the victim’s side could see it. Reported 18 June, fixed in early August, acknowledged 3 September — service-side agents move the egress boundary outside your monitoring.

• 2025-09-25 — ForcedLeak in Agentforce, and a backdoored MCP server in the wild:

  Two disclosures on one day: Noma Labs chained a Web-to-Lead injection with an expired but still CSP-whitelisted domain to exfiltrate CRM data from Salesforce Agentforce (score 9.4, assigned by Noma), and Koi Security found the postmark-mcp npm package silently BCC-ing users’ email — which Koi described as the first malicious MCP server found in the wild. One shows that your allowlist decays; the other shows that your supply chain now includes MCP servers.

• 2025-10-08 — CamoLeak drains private repos through GitHub Copilot Chat:

  Legit Security combined invisible-comment injection with a bypass of GitHub’s Camo image proxy to silently exfiltrate private source and secrets (score 9.6, assigned by Legit). GitHub’s fix was to stop rendering images in Copilot Chat — the third disclosure in five months fixed by removing an output channel rather than by improving a prompt.

• 2025-10-31 — Meta publishes the Agents Rule of Two:

  A design rule an engineer can actually apply: within a session, an agent should satisfy at most two of — processes untrustworthy input, has access to sensitive systems or private data, can change state or communicate externally. If you need all three, break the session or put a human in the middle.

• 2025-11-13 — Anthropic reports the first largely AI-orchestrated espionage campaign:

  Anthropic disclosed that a group it assessed as Chinese state-sponsored manipulated Claude Code into attacking around 30 organisations with 80-90% of the campaign automated; accounts were banned and victims notified. These are Anthropic’s own figures and attribution — several outside researchers asked for more indicators — but it marks the shift from researcher demos to agents used at scale by real attackers.

Amazon Q Developer extension — a malicious commit shipped in a release (AWS-2025-015, July 23, 2025)

AWS’s own security bulletin confirms that a threat actor used an “inappropriately scoped GitHub token” in the extension’s CodeBuild configuration to commit malicious code into the extension’s open-source repository, and that the code was automatically included in released version 1.84.0 (CVE-2025-8217). AWS states the malicious code was distributed but “was unsuccessful in executing due to a syntax error”; it revoked credentials, pulled 1.84.0, and released 1.85.0.

Press reporting (404 Media and others) described the injected code as a prompt instructing the agent to wipe local and cloud resources. That detail is not in the AWS bulletin — attribute it to reporting, not to AWS. Either way the structural lesson holds: a CI token, not the model, was the vulnerability, and the artefact that shipped was tooling millions of developers auto-update.

Nx “s1ngularity” — supply-chain malware that conscripted victims’ own agents (August 26, 2025)

Malicious versions of the popular Nx build-system npm packages were published (advisory GHSA-cxm3-wv7p-598c, Critical). The postinstall malware scanned filesystems and stole credentials, and — per Wiz’s analysis — leveraged AI CLI tools already installed on developer machines (Claude, Gemini, and Q) to aid its reconnaissance, exfiltrating findings to attacker-created public repositories named s1ngularity-repository inside victims’ own GitHub accounts. Wiz attributes the root cause to a flawed GitHub Actions workflow allowing code injection through unsanitised pull-request titles with the pull_request_target trigger. A second wave on August 28–29 affected 400+ users and organisations and exposed 5,500+ private repositories.

The advisory’s appendix reproduces the malware’s LLM prompt: it told the agent it was a file-search agent and asked it to locate configuration and environment-definition files and write an inventory to a temp file. Read that twice. The payload was a prompt, the interpreter was an agent already trusted on the machine, and the attacker’s reconnaissance code was a paragraph of English. Any local agent with broad filesystem reach is a capability an attacker can borrow.

When the agent installs the server: CurXecute (CVE-2025-54135) and the config-write pattern

CVE-2025-54135, named CurXecute by Aim Labs and published August 5, 2025 (CVSS 8.6, CWE-78 / CWE-829), affected the Cursor AI code editor below 1.3.9. Cursor allowed writing in-workspace files without user approval, and creating a new dotfile — unlike editing one — needed no approval at all. So an indirect prompt injection could write a new .cursor/mcp.json, and the new server entry executed. Fixed in 1.3.9.

Microsoft patched the analogous shape in CVE-2025-53773 (GitHub Copilot and Visual Studio, published August 12, 2025, CVSS 7.8, CWE-77): improper neutralisation of special elements in a command allowing local code execution. The widely-repeated exploitation narrative — injection makes the assistant edit its own settings to auto-approve tools — comes from researcher Johann Rehberger’s writeup rather than the CVE text.

The pattern generalises past both products: if an agent can write its own configuration, it can grant itself tools. Your install review is worth nothing if the agent’s own file-write permissions include the file that lists the servers. Put the tool manifest outside the agent’s writable tree, or gate writes to it like a production change.