65 documented incidents from postmortems, regulatory filings and court records, plus 1,500 security advisories ingested every two hours. Each links to its public source and to the safeguard that addresses it.
15 records · Documented incident: A real incident summarised from a public source (postmortem, regulatory filing, court record or advisory).
Explore these 15 records in charts
Most represented patterns
Top six in the filtered results. A record can have several patterns.
Privileged action without an enforceable approval gate11
AI action exceeds its intended scope8
Indirect prompt injection changes agent behavior5
Weak or phishable authentication on a privileged path3
Cross-tenant access through a caller-controlled identifier2
Destructive operation without verified recovery1
Records by year
Up to eight recent years, plus undated records. Dates may refer to an incident, disclosure or publication.
A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.
Safeguard: Never run untrusted pull-request input with secrets
Privileged action without an enforceable approval gatenx.dev
Instructions planted in content the agent reads could make GitHub Copilot write "chat.tools.autoApprove": true into the project's .vscode/settings.json, which turns off all user confirmations.
Safeguard: Never let an agent change its own permissions
Researchers hid a prompt injection inside a README.md (in the text of a software license) so that Gemini CLI, asked only to inspect a codebase, would request shell commands.
By supplying only an application's non-secret appid to undocumented registration and email-verification endpoints, an attacker could create a verified account on private applications built with Base44.
Safeguard: Never use an identifier as an authorization check
Cross-tenant access through a caller-controlled identifierwiz.io
General Analysis showed that hidden instructions in a customer support ticket could make a developer's MCP-connected assistant query a private table of integration tokens.
Safeguard: Give agents least-privilege, read-only database roles
McHire, the chatbot recruiting platform used by most McDonald's franchisees, lets applicants chat with a bot named Olivia, built by Paradox.ai, that collects personal information.
Safeguard: Remove default and test accounts before production
Cross-tenant access through a caller-controlled identifierian.sh
EchoLeak (CVE-2025-32711, CVSS 9.3) is a zero-click vulnerability in Microsoft 365 Copilot in which a crafted email could trigger indirect prompt injection.
Safeguard: Isolate retrieved untrusted content from privileged context
Invariant Labs showed that a malicious instruction placed in an issue on a public repository could be read by an agent connected through the GitHub MCP server.
Safeguard: Scope agent credentials per task and repository
A customer relied on Air Canada's website chatbot, which told him he could apply for a bereavement fare retroactively; the airline's policy did not allow that.
Safeguard: Ground policy answers in the authoritative policy source
AI action exceeds its intended scopedecisions.civilresolutionbc.ca
Machine learning pricing models drifted during market volatility; automated purchasing bought homes above value resulting in $540M inventory write-down.
Safeguard: Cap automated exposure in deterministic limits
Privileged action without an enforceable approval gatesec.gov
From July 2016 to June 2019 the broker received high payment for order flow but did not conduct adequate, regular and rigorous reviews of execution quality on customer orders.
Safeguard: Review execution quality regularly and rigorously
Privileged action without an enforceable approval gatesec.gov
The CFTC alleged a layering algorithm automatically placed four to six very large sell orders in the E-mini S&P 500 order book and cancelled them without execution.
Safeguard: Limit order modification and cancellation behaviour
Privileged action without an enforceable approval gatecftc.gov