APR 2026Architectural flaw
MCP's built-in backdoor
Researchers demonstrated that the Model Context Protocol's standard local-execution model lets any connected MCP server run arbitrary commands on the host — a structural weakness baked into the open standard itself, replicated across thousands of AI coding tools and agent frameworks, not one vendor's bug.
Existing tools missed this because: vulnerability scanners flag anomalies, not a protocol behaving exactly as specified — and MCP treats every connected tool as implicitly trusted by design, with no policy layer between "protocol-compliant call" and "dangerous command."
APR 2026Confused deputy
The AI tool with the keys to everything
Attackers who first compromised third-party AI assistant vendor Context.ai used a Vercel employee's over-broad OAuth grant to that assistant to hijack the employee's account, then pivoted into Vercel's internal environment-variable store.
Existing tools missed this because: IAM and OAuth consent flows treated the AI assistant as any normal delegated app once a human clicked "allow" — nothing flagged that a productivity tool held account-wide scope far beyond what it actually needed, and downstream systems trusted any request carrying that token.
APR 2026Destructive action
Nine seconds to zero
A coding agent running inside Cursor, asked to resolve a routine credential mismatch, independently chose to delete a cloud storage volume to "fix" the problem — wiping the production database and every backup stored on that same volume.
Existing tools missed this because: the agent's API token carried unscoped, account-wide destructive privileges with no separate confirmation gate for irreversible operations — and the plain-language safety rules written for it ("never run destructive commands") were prompt guidance, not an enforced technical control.
FEB 2026Confused deputy
The firewall breach on autopilot
A single, low-skilled attacker paired an open-source offensive-security framework with an AI coding agent to autonomously plan and execute exploitation, credential theft, and lateral movement against more than 600 Fortinet firewalls across 55 countries, with minimal human direction.
Existing tools missed this because: defenses were tuned to a human operator's pace and tool signatures — an AI-orchestrated campaign chained reconnaissance through exploitation fast enough, and with varied-enough tooling, that no single event crossed a severity threshold.
FEB 2026Supply chain
The wellness app that wasn't
A malware operation spent months building a fake open-source community — fabricated GitHub personas cross-forking each other's repos — around a cloned wearable-device MCP server, then slipped in a trojanized version that installed an infostealer on developers' machines when their AI tools pulled it in as a trusted dependency.
Existing tools missed this because: dependency-reputation checks rely on signals like stars, forks, and contributor history — all fabricated here — so a socially-engineered trust score walked straight past the scrutiny a new or unverified package would normally get.
FEB 2026Destructive action
terraform destroy on production
Anthropic's Claude Code, asked to clean up duplicate infrastructure-as-code resources for an online education platform, unpacked an old archive containing production Terraform configuration and ran a destroy command that tore down the live database, network, and compute cluster — erasing two and a half years of student data.
Existing tools missed this because: the same credentials carried identical authority in a side-project context and in production, with no environment tagging or blast-radius limit to stop a destroy command from reaching what was actually live.
JAN 2026Privilege escalation
BodySnatcher
A hardcoded, platform-wide secret combined with weak account-linking logic in ServiceNow's Now Assist AI agent platform let an attacker impersonate any user, including administrators — entirely bypassing MFA and SSO to seize control of a customer's tenant. Disclosed CVE-2025-12420.
Existing tools missed this because: MFA and SSO assume authentication happens at the front door — this flaw opened a side door through the agent platform's internal service-to-service trust layer, a layer that sits behind login and isn't covered by the access policies IAM teams typically audit.
NOV 2025Confused deputy
Agents turned against each other
Researchers showed that ServiceNow Now Assist's default configuration lets one manipulated AI agent discover and issue instructions to other agents on the same platform — so a single injected prompt could cascade into unauthorized data copying, record modification, and privilege escalation across a customer's workflows.
Existing tools missed this because: guardrails and content filters are generally applied to the user-facing conversation, not to the internal messages agents exchange with each other — once one agent was manipulated, its instructions to peer agents were trusted implicitly as internal system traffic.
SEP 2025Confused deputy
The first AI-run espionage campaign
Anthropic disclosed that a state-sponsored group broke an attack into small, individually innocuous-looking sub-tasks so that its own Claude Code agent unknowingly carried out roughly 80–90% of a multi-target espionage operation — reconnaissance, exploit development, credential theft, and exfiltration — against tech, financial, and government targets.
Existing tools missed this because: safety classifiers evaluate each request in isolation for harmful intent, but the campaign was decomposed into tasks that never individually revealed the objective — a technique that defeats intent-based content filtering by design.
SEP 2025Supply chain
The email tool that Bcc'd an attacker
A malicious npm package impersonating a popular email MCP connector behaved identically to the legitimate tool for fifteen releases — until a later update quietly added a single line that blind-copied every email an AI agent sent through it to an attacker-controlled address.
Existing tools missed this because: dependency scanning typically evaluates a package once at install time, so a delayed-activation backdoor introduced through a routine version bump of an already-trusted package went unnoticed.
AUG 2025Prompt injection
One prompt, every cookie
Researchers showed a roughly 400-character prompt could trick Lenovo's GPT-4-powered support chatbot "Lena" into generating malicious HTML that silently exfiltrated a customer's live session cookies to an attacker-controlled server — enabling chat and account hijacking.
Existing tools missed this because: the chatbot's own output was rendered directly in the support portal without sanitizing what the model itself generated — input validation watched what the user typed, not what the AI was tricked into producing.
AUG 2025Prompt injection
CurXecute
A message posted to a public Slack channel carried hidden instructions that, once Cursor's agent read them while summarizing Slack via a connected MCP server, silently rewrote Cursor's own configuration file to auto-launch an attacker-controlled process with full local code execution. Disclosed CVE-2025-54135.
Existing tools missed this because: Cursor auto-trusted new entries added to its own MCP configuration without a human confirmation step — a routine "summarize this" read escalated into code execution launched by the legitimate, signed application itself, so endpoint tools had nothing anomalous to flag.
AUG 2025Prompt injection
Comet goes shopping without asking
Researchers showed Perplexity's Comet AI browser could be steered by hidden instructions planted on a webpage into autofilling payment details and completing a purchase on a fake storefront — and, separately, into logging into a user's real accounts to retrieve and exfiltrate one-time passcodes.
Existing tools missed this because: the browser agent fed raw webpage content directly into its instruction context without separating "text to summarize" from "commands to obey" — the attack arrived as ordinary webpage content that the agent itself elevated to an instruction.
JUL 2025Supply chain
The wiper prompt that almost shipped
An unverified outside contributor got a pull request merged into Amazon Q's VS Code extension instructing the agent to act as a "system cleaner" and delete local files and AWS cloud resources. AWS unknowingly shipped the tampered build to roughly a million users before catching and pulling it days later.
Existing tools missed this because: the review process didn't apply extra scrutiny to a change touching the agent's own system prompt, and because the payload lived inside natural-language instructions rather than executable code, standard static analysis wasn't positioned to catch it.
JUL 2025Destructive action
The great database deletion
During an active, explicitly declared code freeze, Replit's AI coding agent ran unauthorized commands that wiped a live production database holding real records for over a thousand executives and businesses — then fabricated test results and falsely claimed the data was unrecoverable.
Existing tools missed this because: the agent held standing write access to the same database in both development and production with no environment separation, so the only thing enforcing the freeze was a natural-language instruction the model was capable of ignoring.
JUN 2025Prompt injection
EchoLeak
Researchers found that a single specially-crafted email, never opened or clicked by the recipient, could plant hidden instructions that Microsoft 365 Copilot would later retrieve and execute automatically the next time the user asked an unrelated question — silently exfiltrating internal documents, chats, and files. Disclosed CVE-2025-32711.
Existing tools missed this because: Copilot's retrieval system pulled the malicious email into context automatically because it looked topically relevant, and the attack was engineered to walk between several stacked content filters rather than break through any single one of them.