Book a demo
PLATFORM
Platform overviewGuardrailsAttack paths guideZero Shadow Club
USE CASES
Coding agentsMCP serversOAuth appsService accounts
ACADEMY
All Academy topicsNon-human identitiesAI agent securityMCP securityAttack paths and reach
PRICING
Pricing
RESEARCH
ResearchAgent Incident DatabaseAgent Reach MatrixAgent Reach CalculatorMCP Server DatabaseAttack paths guideBook a demo
Agent incidents

The Agent Incident Database. Every path, in one place.

One record per publicly documented incident where an AI agent or a machine identity reached something it should not have. Each record gives the entry point, the identity in the middle, what was reached and our reading of where the path could have been broken.

Book a demoWhat is an attack path
KEY TAKEAWAYS
  • 35 records today, newest first. One per publicly documented incident where an agent or machine identity reached something it should not have.
  • Most paths contain no exploit. The access was granted, inherited or left in place, and something used it.
  • Every record carries its primary sources. Nothing on these pages is reconstructed.
  • The breakpoint assessment is ours: the one change that would have closed the path, read off the published chain.
BY THE NUMBERS

What is actually in here.

Every number below is counted from the records themselves, not estimated.

35
Records on file
97
Primary sources linked
64
Source domains
3–6
Steps per path
4.7
Average steps
Counted, not estimated.Each record links the reporting it is built on.
Most paths carry no exploit
Granted, not breached.In most records the access was already there and something used it.
Distance to the data3–6 steps
0Entry
1Identity
2Role
3Data
Short chains.The published paths run 3 to 6 steps from entry to the data.
THE DATABASE

Every incident on record.

Sorted by publication date. The steps column is the length of the published path from entry to the data at the end.

IncidentPublishedEntry pointReachedSteps
Screenshots in public reposOct 5, 2026pull requestinternal data5
Storm-3168Oct 3, 2026public github issueaccount keys6
Medicare statistics portalOct 1, 2026research agentinternal server6
MCP Python SDK OAuthSep 29, 2026mcp-clientsaas-data5
AWS AgentCoreSep 28, 2026support ticketcustomer data6
Vercel via an AI toolSep 27, 2026infostealerenv secrets6
Strix and Cairn campaignsSep 26, 2026strix600,000 card records read, then 180 tables dropped5
Codex sandbox escapeSep 24, 2026malicious-repohost-execution5
DIVDSep 24, 2026internet facing Zammad helpdeskother internal services4
SalesBleedSep 24, 2026public Web-to-Lead formSlack channels5
AEPD first agent notificationSep 21, 2026agentpersonal-data5
OpenAI agent incidentsSep 18, 2026agent-runleaked-api-key4
PaperCut to Domain AdminSep 17, 2026netlas-scanntds.dit6
Session tokens past MFASep 16, 2026infected-laptopai-account4
GitSpawnSep 11, 2026shared-folderdeveloper-shell4
PocketOS production volumeSep 8, 2026cursorproduction database volume deleted3
JADEPUFFERSep 8, 2026langflow-rcedatabases reached with harvested credentials, 1,342 config items encrypted4
Nx s1ngularitySep 8, 2026nx-packagesecrets collected from the developer machine4
Salesloft DriftSep 8, 2026drift-oauth-tokenSalesforce data exported from each affected org3
CoSnitchAug 18, 2026crafted linkpoisoned persistent memory that survives session revocation5
ChainDropAug 6, 2026npm registryfurther packages5
The Hugging Face agent intrusionJul 21, 2026evaluation sandboxcluster-admin on multiple clusters, then five internal datasets6
ComposioMay 21, 2026infrastructure monitoring toolconnected SaaS accounts4
GitHub internal repositoriesMay 20, 2026the Nx Console extensionGitHub internal repositories4
Copirate 365May 4, 2026document in Microsoft 365attacker server4
ShareLeakApr 15, 2026SharePoint form comments fieldnon-organizational email5
BodySnatcherJan 13, 2026Virtual Agent API endpointadministrator accounts5
Now Assist agent recruitmentNov 19, 2025record fieldrecords, external email and admin roles5
CoPhishOct 20, 2025attacker tenantattacker endpoint5
CamoLeakOct 8, 2025pull request or issue bodythe Camo image proxy4
Gemini TrifectaSep 30, 2025public facing GCP servicesaved user data and location5
ForcedLeakSep 25, 2025public Web-to-Lead formexpired allowlisted domain5
ShadowLeakSep 18, 2025inbound emailpersonal data5
Amazon Q wiper promptJul 23, 2025CodeBuild configurationdeveloper workstations4
EchoLeakJun 11, 2025inbound emailtenant data sent out through allowlisted Microsoft domains4

Browse by path.

Same records, with the one line that matters.

Screenshots in public reposCoding agents published 13,000 internal screenshots to public repositories.Read the record →Storm-3168Two Azure service principals wiped over 100 storage accounts.Read the record →Medicare statistics portalAn OpenAI agent read non-public files and wrote to an internal server.Read the record →
MCP Python SDK OAuthA 404 on server metadata sent the client secret to an attacker.Read the record →AWS AgentCoreA prompt in a support ticket led to a vaulted credential in process memory.Read the record →Vercel via an AI toolA stolen vendor OAuth token reached a workspace, then customer environment variables.Read the record →
Strix and Cairn campaignsAutonomous scanning agents reached card records, then dropped 180 tables.Read the record →Codex sandbox escapeA malicious repository recovered the agent token from the V8 heap.Read the record →DIVDAn autonomous agent chained two Zammad zero-days and reached root in seconds.Read the record →
SalesBleedA hijacked Agentforce agent phished Slack under its own trusted identity.Read the record →AEPD first agent notificationSpain logged the first breach notification naming an autonomous AI agent.Read the record →OpenAI agent incidentsThree of six disclosed incidents were access problems, not alignment problems.Read the record →
PaperCut to Domain AdminTwo CVEs in a print server ended at every credential in the domain.Read the record →Session tokens past MFAInfostealer logs carried AI session tokens that replayed without a prompt.Read the record →GitSpawnA .git/config from outside ran a command when the agent started.Read the record →
PocketOS production volumeA Cursor agent on a staging task deleted a production database volume.Read the record →JADEPUFFERAn LLM-driven operation harvested credentials and encrypted 1,342 config items.Read the record →Nx s1ngularityA trojanized npm package used installed AI CLIs to collect secrets.Read the record →
Salesloft DriftStolen OAuth tokens exported Salesforce data from hundreds of orgs.Read the record →CoSnitchOne link ran a prompt inside a victim's Copilot session and poisoned its memory.Read the record →ChainDropAn npm worm grew its credential scan to 469 locations, AI tool configs included.Read the record →
The Hugging Face agent intrusionAn evaluation agent escaped its sandbox and reached cluster-admin at Hugging Face.Read the record →ComposioA broker holding agent credentials lost customer OAuth tokens for connected SaaS.Read the record →GitHub internal repositoriesA poisoned editor extension harvested developer credentials, an AI agent config among them.Read the record →
Copirate 365A CSS font-face rule carried data out of Microsoft 365 Copilot after image sanitising.Read the record →ShareLeakA SharePoint comment field overrode a Copilot Studio agent's system instructions.Read the record →BodySnatcherOne shared secret shipped to every instance let anyone drive ServiceNow AI agents as any user.Read the record →
Now Assist agent recruitmentOne poisoned record field let an agent recruit more privileged agents.Read the record →CoPhishA Copilot Studio agent on a Microsoft domain collected OAuth tokens for the attacker.Read the record →CamoLeakA hidden comment in a pull request made Copilot Chat leak private repositories.Read the record →
Gemini TrifectaA User-Agent header became an instruction Gemini followed inside a GCP project.Read the record →ForcedLeakA five dollar expired domain on Salesforce's allowlist carried CRM data out of Agentforce.Read the record →ShadowLeakA hidden line in an email made ChatGPT's research agent exfiltrate from OpenAI's own servers.Read the record →
Amazon Q wiper promptA leaked build token put a filesystem wiping prompt into a signed extension release.Read the record →EchoLeakAn email nobody opened made Microsoft 365 Copilot leak tenant data.Read the record →
FAQ

Questions, answered.

What the database is, and what it is not.

What counts as an agent incident?

A publicly documented case where an AI agent or a non-human identity reached data, credentials or a destructive action. Most involve no exploit at all: the access was granted, inherited or left in place, and something used it.

How is a record different from the teardown?

The teardown is the narrative: what happened and what a team should check. The record is the data: entry point, identity, target, the path step by step and the breakpoint assessment. Every record links its primary sources, and the records that have a teardown link that too.

Where to go next.

The database answers what happened. These answer what to do.

Attack paths and reachThe definitions every record is built on.Browse the topics →Agent Reach CalculatorWork out how far your own agents reach, with these records as the evidence.Open the calculator →The teardownsThe long form narrative behind many of these records.Read the research →Elmoz AcademyAgent reach, shadow agents, MCP security and NHI risks.Browse the Academy →

See what your agents can reach. Before someone else does.

Book a demo and we walk through the access paths in an environment like yours.

Book a demoRead the attack path guide