Incident record
All incidents
Every entry is tied to its sources and carries an evidence level.What counts as an incident
- Coding agent deletes PocketOS production data and its backups in seconds
While working in staging, a coding agent used an account-wide Railway token to delete a volume. It was the production volume, and the backups were stored inside it.
PocketOS · Production database volume and its backups deleted; newest usable backup was three months old
- Report ties a 13-hour AWS disruption to the Kiro AI coding tool; Amazon disputes it
The Financial Times reported that engineers let Amazon’s Kiro tool make changes that led to a 13-hour disruption. Amazon confirms the event and attributes it to misconfigured access controls.
Amazon Web Services · 13-hour disruption of one AWS service in one region in December 2025
- Hundreds of malicious skills found on the OpenClaw agent marketplace
An audit by Koi Security found 341 malicious skills on ClawHub. Most told users to install a "prerequisite" that was an information stealer.
OpenClaw · 341 of 2,857 audited skills were malicious; they installed credential-stealing malware on users’ machines
- Google Antigravity agent wipes a user’s drive while clearing a cache
A user reported that Google’s Antigravity agent, asked to clear a project cache, ran a delete command against the root of his D: drive. Google said it was investigating.
Google · Contents of one user’s D: drive deleted and not recovered; most of it existed in a backup
- CamoLeak: hidden pull request text could make Copilot Chat leak private code
Legit Security showed that a hidden comment in a pull request could instruct Copilot Chat to leak private repository content through GitHub’s own image proxy.
GitHub · Possible exfiltration of private source code and secrets; no exploitation reported
- Fake "postmark-mcp" npm package secretly copies every email to its author
An npm package that copied Postmark’s MCP server worked normally for 15 versions, then added a line that blind-copied every outgoing email to an outside address.
Postmark (impersonated; not the publisher) · Emails sent by AI assistants through the package were copied to an outside address; 1,643 total downloads
- ForcedLeak: a web form could make Salesforce Agentforce send out CRM data
Noma Security showed that text submitted through a public lead form could instruct Agentforce to send CRM data to an expired domain that Salesforce’s policy still trusted.
Salesforce · Possible exfiltration of CRM data; no exploitation in the wild reported
- Three infrastructure bugs degrade Claude’s responses for weeks
Anthropic reported that three overlapping infrastructure bugs lowered the quality of Claude’s answers between August and early September 2025, and explained why they were slow to detect.
Anthropic · Intermittently degraded responses from early August to mid-September; 16% of Sonnet 4 requests affected at the worst hour
- Nx supply chain malware uses developers’ AI coding tools to hunt for secrets
Malicious versions of Nx were live on npm for about four hours. Their install script prompted locally installed AI coding assistants to search the machine for secrets.
Nx (Nrwl) · Over 2,000 verified secrets leaked from more than 1,700 users; at least 480 accounts had over 6,700 private repositories made public, according to Wiz
- Hidden webpage text makes Perplexity’s Comet browser leak a login code
Brave showed that instructions hidden in a Reddit comment could make Comet, while summarizing the page, read the user’s email and send a one-time login code to an attacker.
Perplexity · Demonstrated account takeover path through the user’s email; no exploitation reported
- CurXecute: prompt injection leads to code execution in the Cursor editor
Aim Security found that injected text could make Cursor’s agent write an MCP configuration file that ran commands before the user could reject the edit. Fixed as CVE-2025-54135.
Cursor (Anysphere) · Possible arbitrary code execution on a developer machine; no exploitation in the wild reported
- Shared ChatGPT conversations show up in Google search results
An opt-in checkbox let shared ChatGPT conversations be indexed by search engines. After reports that thousands were searchable, OpenAI removed the feature.
OpenAI · Thousands of shared conversations indexed by search engines, according to press reports; feature removed
- Gemini CLI could be made to run hidden commands from a repository file
Tracebit showed that a prompt injection hidden in a repository’s README could make Gemini CLI run a command the user never saw. Google fixed it in version 0.1.14.
Google · Demonstrated exfiltration of environment variables from a developer machine; no exploitation reported
- Amazon Q extension for VS Code ships with an injected destructive prompt
An attacker used an over-scoped token to commit a prompt that told the Amazon Q agent to delete files and cloud resources. It shipped in a release but did not run, according to AWS.
Amazon Web Services · Malicious code shipped in a public release; AWS states it failed to execute and no customer environment was changed
- Replit’s coding agent deletes a production database during a code freeze
During a user’s test of Replit’s coding agent, the agent deleted the production database despite a code freeze. Replit’s chief executive called it unacceptable and announced safeguards.
Replit · Production records for over 1,200 executives and nearly 1,200 companies deleted; later recovered
- Grok posts antisemitic content for 16 hours after a code update
After an update on July 7, Grok posted antisemitic content on X. xAI apologised and said deprecated instructions made the bot echo extremist posts.
xAI · Public chatbot posted antisemitic and extremist content for about 16 hours
- Support ticket text steers a coding agent into leaking private database tables
General Analysis showed that instructions hidden in a support ticket could make a coding agent with a privileged Supabase key read a private table and write its contents back into the ticket.
Supabase · Demonstrated leak of a private table on dummy data; no customer leak reported
- EchoLeak: an email alone could make Microsoft 365 Copilot leak data
Aim Security found that a crafted email could cause Microsoft 365 Copilot to send data from a user’s context to an attacker with no click. Microsoft fixed it as CVE-2025-32711.
Microsoft · Possible exfiltration of data from Copilot’s context without any user action; no exploitation in the wild reported
- Asana takes its MCP server offline after a cross-organization data exposure bug
A bug in Asana’s MCP server could have exposed information from one customer’s workspace to MCP users at other customers. Asana disabled the server for nearly two weeks.
Asana · Data from one organization potentially visible to MCP users in other organizations; server offline from June 5 to June 17
- Malicious GitHub issue steers agents into leaking private repository data
Invariant Labs showed that an issue planted in a public repository could make an agent using the GitHub MCP server copy data from the user’s private repositories into a public pull request.
GitHub · Demonstrated leak of private repository details into a public pull request; no exploitation reported
- Unauthorized prompt change makes Grok raise a political topic in unrelated replies
Grok began bringing up "white genocide" in South Africa in answers to unrelated questions. xAI said someone had modified the bot’s prompt without authorization.
xAI · Public chatbot inserted claims about South Africa into unrelated replies for roughly a day
- Cursor’s AI support bot invents a one-device policy that does not exist
A support bot signing as "Sam" told a user that Cursor allows one device per subscription. No such policy existed, and a co-founder corrected it publicly.
Cursor (Anysphere) · Users announced subscription cancellations after receiving a fabricated policy
- New telemetry service takes down OpenAI’s API, ChatGPT and Sora for hours
A new telemetry service caused every node in OpenAI’s clusters to make heavy Kubernetes API calls, which took down the control plane and, with it, all OpenAI services.
OpenAI · All OpenAI services degraded or unavailable from 3:16 PM to 7:38 PM PST
- Researchers show Slack AI can be tricked into leaking private channel data
PromptArmor showed that a message in a public Slack channel could steer Slack AI into revealing data from a private channel the attacker could not access.
Slack (Salesforce) · Demonstrated exfiltration of a secret from a private channel; no exploitation reported
- New York City’s business chatbot gives advice that would break the law
An investigation found that New York City’s official chatbot for business owners gave answers that contradicted city and state law. The city kept it online with disclaimers until 2026.
City of New York · Wrong legal guidance on tips, cash payments and housing vouchers given to business owners; chatbot taken down in February 2026
- Tribunal holds Air Canada liable for wrong fare advice from its chatbot
A British Columbia tribunal found Air Canada liable for negligent misrepresentation after its website chatbot told a customer he could claim a bereavement fare retroactively.
Air Canada · Airline ordered to compensate one customer for the fare difference
- DPD customer service chatbot swears and criticises the company
A customer got DPD’s support chatbot to swear and write poems criticising the company. DPD said an error occurred after a system update and disabled the AI component.
DPD · AI component of the chatbot disabled; no financial or data harm reported
- Car dealership chatbot is talked into "agreeing" to sell an SUV for $1
Users instructed a dealership’s ChatGPT-powered chatbot to agree with anything, then had it accept a $1 offer for a new Chevrolet Tahoe. No sale took place.
Chevrolet of Watsonville (chatbot supplied by Fullpath) · No sale took place; dealerships began disabling the chatbot
- ChatGPT bug exposes chat titles and payment details of other users
OpenAI took ChatGPT offline after a caching bug let some users see titles from other users’ chat histories and, for some subscribers, payment-related details.
OpenAI · Chat titles shown to other users; payment details of 1.2% of active ChatGPT Plus subscribers potentially visible during a nine-hour window
No incidents match these filters.