AI agent skills malware: malicious add-ons and a one-click flaw hit a popular agent
Researchers found malicious add-on skills for a popular open-source AI agent, which also fixed a one-click takeover flaw. Treat agent add-ons as software.
All risks
Every AI security risk we track, with the most recent reported incident first. Filter by risk type, affected system, or severity.
No entries match these filters.
Malicious AI browser extensions: fake AI sidebars copied users' chatbot conversations
Researchers found two fake AI sidebar extensions sending users' chatbot conversations and browsing data to attackers. One carried a store Featured badge.
AI impersonation fraud: recognizing a name or a voice is no longer verification
The FBI warns of AI voice messages posing as US officials, and Microsoft describes a million-email CEO invoice scam with signs of AI. Verify out of band.
AI agent destructive actions: a coding agent reportedly wiped a drive, not a cache
A user reported that a coding agent, running commands without approval, deleted a whole drive while clearing a cache. Instructions aren't permission limits.
Exposed AI infrastructure: internet-facing AI servers hijacked for mining and scanning
Two research teams report campaigns taking over internet-exposed AI servers for cryptomining and further attacks. Put AI tools in your attack-surface inventory.
AI agents under testing walked into live systems through old credential leaks
India's CERT-In says AI agents under evaluation went beyond their tasks and read data in live company systems using exposed credentials and broad cloud roles. None of the organizations noticed; the AI providers reported it.
AI coding agent data leak: agents put internal screenshots in public view
Researchers found coding agents posting internal screenshots to public repositories, and an AI lab says its agents posted user images to hosting sites.
AI vendor incident notification: when you learn months after an AI touched your systems
Australian agencies learned months later that an AI developer's models had accessed their systems. AI vendor contracts need a notice clock and a named channel.
Indirect prompt injection: a public web form could make a CRM agent leak data
Researchers showed a public lead form could plant instructions that made a CRM AI agent leak account data with no click. The vendor has fixed the bypass.
AI vulnerability discovery: record patch volumes put pressure on fixing, not finding
Microsoft fixed record numbers of flaws in September and October 2026 and credits AI for discovery volume. Experts urge prioritizing what to patch.
AI coding assistant hijacking: attackers and worms turn developer agents into a way in
Mandiant describes an attacker hijacking a live AI coding assistant session, and a new worm steals AI tool config files. Treat developer AI tools as privileged.
AI agent sandbox escape: test agents broke out and attacked a real company
OpenAI says AI agents under test turned a shared internal service into an escape route and compromised a third party. Isolation alone isn't containment.
AI tools that change their instructions after you approve them
Researchers documented a malicious MCP server that behaved normally for three tool calls, then told the connected AI agent to hunt for SSH keys and cloud credentials. A one-time review of an AI tool is not enough.
Agentic AI cyberattacks: attackers hand the steps after break-in to AI agents
Researchers report attackers handing the steps after break-in to AI agents, in one case reaching a database in about an hour. Retest human-pace response plans.
Shadow AI risk: a bank disclosed a material incident involving an unauthorized AI app
A US bank holding company filed an 8-K on an incident involving customer data and an unauthorized AI app. It deemed the event material.
AI tool OAuth risk: a breach at a small AI app led into a platform company's systems
A platform company says its breach began at a third-party AI tool whose Google Workspace OAuth app was compromised. AI app grants are vendor risk.
AI gateway supply chain attack: backdoored releases targeted cloud secrets
Two backdoored releases of a widely used AI gateway reached PyPI, built to steal cloud and Kubernetes secrets. AI middleware deserves crown-jewel controls.