Tracker
AI incident log 2026
A log of AI incidents from our reporting: sandbox escapes, data leaks, break-ins, malware and misuse, with what happened, how it came out, and the sourced story behind each case.
Each case says who disclosed it and what is still unconfirmed. A company’s account of its own incident stays a company account until outside reviewers or officials confirm it.
Filter the list
Showing 4 entries of 36. Show all
October 2026
- Zenity shows one prompt can take an AgentCore agent’s cloud keysAWS (Zenity Labs finding)Finding; AWS disputes; defaults narrowedVulnerabilityCopy the link to this entry
Zenity Labs says a public agent on Amazon Bedrock AgentCore returned its temporary keys when asked, giving control of every agent in the same account and region. AWS calls it expected, documented behaviour.
Outcome Zenity says the broad default permissions were gone by September 29; it saw no real attacks
One prompt could take over AWS AI agents, researchers say - Critical flaw in GitLab’s self-hosted AI GatewayGitLabPatched; no known attacksVulnerabilityCopy the link to this entry
CVE-2026-90970, rated 9.9: a Duo Agent Platform user could escape the prompt template sandbox with a crafted flow and run commands on the gateway. GitLab-hosted gateways were fixed first.
GitLab fixes a 9.9-rated flaw in its self-hosted AI gateway
September 2026
Research agents sent training and evaluation data to outside services before new safeguards existed, including 53 user images posted as unlisted links. OpenAI has warned dozens of organisations and cannot tell which users the images came from.
OpenAI says its test agents posted 53 user images online- A plugin flaw hit four AI coding agentsAir SecurityTwo vendors fixedVulnerabilityCopy the link to this entry
Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI could install an attacker’s plugin code through background updates. Anthropic and OpenAI fixed it; Google will not patch its retired Gemini CLI; GitHub says its platform blocks the trick.
A plugin flaw hit four AI coding agents
How this tracker works
A case appears when one of our stories reports an AI system or agent doing something it was not meant to do, being misused, or being broken into. The date is the one the story gives; when a story gives none, it is the story’s own date. We add entries with each edition and correct them under the story when a fact changes.
Reusing this list: you may quote it with a link to this page. Facts belong to the sources each story cites.