| ID | Disclosed | Incident | Harm type | AI RMF | 800-53 | Human checkpoint | Status | Sources |
|---|---|---|---|---|---|---|---|---|
| AIA-001 | 2025-07 | Replit coding agent deleted a production database, per The Register The Register reported that SaaStr founder Jason Lemkin said Replit's AI agent deleted a production database despite his instruction not to change code without permission. |
Data deletion | MANAGE 2.4 MAP 3.5 |
AC-6, CM-3, CM-5, CP-9 | yes: destructive DB/prod ops | reported | theregister.com (secondary) x.com (primary, unchecked) |
| AIA-002 | 2024-08 | Slack AI data exfiltration via indirect prompt injection, per PromptArmor PromptArmor showed that instructions planted in a public channel could make Slack AI return data from private channels inside a crafted link. |
Data leak / prompt injection | MEASURE 2.7 MAP 4.1 |
AC-4, SI-10, SC-7 | not applicable | reported | promptarmor.substack.com (primary) |
| AIA-003 | 2025-06 | AI command injection info disclosure in M365 Copilot (CVE-2025-32711), per Microsoft Microsoft published CVE-2025-32711, rated Critical: "Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network." |
Data leak / prompt injection | MEASURE 2.7 MANAGE 4.1 |
AC-4, SI-10, SC-7, SI-2 | not applicable | confirmed by vendor | msrc.microsoft.com (primary) |
| AIA-004 | 2025-05 | GitHub MCP server: private repo data leaked via a public issue, per Invariant Labs Invariant Labs showed that a malicious public GitHub issue could steer an agent using the GitHub MCP server into putting private-repo contents into a public PR. |
Data leak / prompt injection | MAP 4.1 MANAGE 2.4 |
AC-6, AC-4, SI-10 | yes: publishing to public repos | reported | invariantlabs.ai (primary) |
| AIA-005 | 2025-07 | Malicious code shipped in Amazon Q Developer VS Code extension 1.84.0, per AWS AWS bulletin AWS-2025-015 (CVE-2025-8217): malicious code was distributed with version 1.84.0 but, per AWS, did not execute due to a syntax error. AWS removed 1.84.0 from distribution channels and released 1.85.0. |
Supply chain / destructive instruction | GOVERN 6.1 MANAGE 3.1 |
SR-3, SR-11, CM-14, SA-10 | yes: release sign-off; destructive commands | confirmed by vendor | aws.amazon.com (primary) |
| AIA-006 | 2025-07 | Gemini CLI command execution via deceptive context file, per Tracebit Tracebit showed that Google's Gemini CLI could be led by a crafted README/context file to run hidden malicious commands under an allow-listed command. Tracebit reported it to Google on June 27, 2025; it was fixed in v0.1.14 (July 25) and disclosed July 28. |
Prompt injection / code exec | MEASURE 2.7 MANAGE 2.4 |
CM-7, AC-6, SI-10 | yes: shell command approval | fixed | tracebit.com (primary) |
| AIA-007 | 2024-08 | M365 Copilot prompt injection with ASCII-smuggling exfiltration, per Embrace The Red Embrace The Red (Johann Rehberger) showed how an email could make Copilot invoke tools and hide data in invisible Unicode links. He shared the exploits with Microsoft in January and February 2024. He reports that his exploits no longer work and that Microsoft did not share the details of the fix. |
Data leak / prompt injection | MEASURE 2.7 MAP 4.1 |
AC-4, SI-10, SI-15 | not applicable | reported | embracethered.com (primary) |
| AIA-008 | 2025-08 | Malicious Nx npm packages included a prompt for an AI "file-search agent", per Nx Nx advisory GHSA-cxm3-wv7p-598c: malicious versions were published. Nx says they collected credentials and posted them to GitHub. They included a script containing a prompt instructing an AI 'file-search agent' to inventory text and environment files. |
Supply chain / credential theft | GOVERN 6.1 MANAGE 3.1 |
SR-3, IA-5, AC-6, SI-7 | partial: agent permission prompts for dangerous flags | confirmed by vendor | github.com (primary) |
| AIA-009 | 2025-07 | Supabase MCP: prompt injection exposed a private table in a demonstration, per General Analysis General Analysis reported a July 2025 demonstration using dummy data: instructions planted in a support ticket steered a Cursor assistant with service-role Supabase MCP access into reading an integration-tokens table and copying it into a reply the customer could see. The page has since been revised. |
Data leak / prompt injection | MAP 4.1 MANAGE 2.4 |
AC-6, AC-3, SI-10 | yes: privileged DB queries | reported | generalanalysis.com (primary) |
| AIA-010 | 2025-11 | AI-orchestrated cyber-espionage campaign using Claude Code, per Anthropic Anthropic reported disrupting a campaign it attributes to a state-sponsored group. The group used Claude Code agentically to perform an estimated 80–90% of the campaign, per Anthropic, attempting infiltration of roughly thirty targets and succeeding in a small number of cases. |
Misuse / intrusion | GOVERN 1.1 MEASURE 2.7 MANAGE 4.1 |
SI-4, AU-6, IR-4, AC-2 | not applicable | confirmed by vendor | anthropic.com (primary) |
| AIA-011 | 2025-08 | Perplexity Comet indirect prompt injection, per Brave Brave showed that hidden instructions in a Reddit comment could make the Comet agentic browser act across the user's logged-in sessions: go to Gmail, read an OTP, and exfiltrate the email address and OTP by replying to the comment. Brave says Perplexity still hasn't fully mitigated it. |
Prompt injection / account takeover | MAP 4.1 MEASURE 2.7 |
AC-4, SC-7, SI-10, IA-2 | yes: cross-site/authenticated actions | reported | brave.com (primary) |
| AIA-012 | 2025-08 | GitHub Copilot in VS Code: prompt injection could enable auto-approve and run code (CVE-2025-53773), per Embrace The Red Johann Rehberger reported that a prompt injection could make GitHub Copilot write "chat.tools.autoApprove": true into VS Code settings ("YOLO mode") and then run commands without approval. He reported it on June 29, 2025, and he says it was fixed in Microsoft's August 2025 Patch Tuesday. |
Prompt injection / code exec | MEASURE 2.7 MANAGE 2.4 |
SI-10, CM-5, AC-6 | partial: approval gate the agent could disable by editing a settings file | fixed | embracethered.com (primary) |
| AIA-013 | 2025-08 | Cursor agent: writing MCP config files without approval enabled code execution (CVE-2025-54135), per Cursor advisory Cursor's advisory says "Cursor allows writing in-workspace files with no user approval" and that, if chained with a prompt injection, this "could allow the writing of sensitive MCP files on the host by the agent." Affected versions are ≤1.2.1, and it was patched in 1.3.9. |
Prompt injection / code exec | MEASURE 2.7 MANAGE 2.4 |
CM-5, SI-10, AC-6 | yes: file writes that lead to command execution | fixed | github.com (primary) |
| AIA-014 | 2025-08 | Cursor MCP one-time approval could be reused after config change (CVE-2025-54136, "MCPoison"), per Check Point Research Check Point Research reported that "once an MCP is approved, future modifications to its command or arguments are trusted without any additional validation or prompt," which could let a changed shared config run commands persistently. |
Code exec / supply chain | MAP 4.1 MEASURE 2.7 |
CM-3, CM-5, SI-7 | partial: MCP configuration approval, bypassed by later changes | fixed | research.checkpoint.com (primary) |
| AIA-015 | 2025-02 | ChatGPT Operator prompt injection leaked profile data in tests, per Embrace The Red Rehberger reported that a prompt injection could make OpenAI's Operator browse to sites where the user was logged in and leak personal profile information "like email address, home address, and phone number." He also describes OpenAI's mitigations, such as user monitoring and confirmations. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
AC-4, SI-10 | partial: confirmations on agent actions, which typing text rarely triggered | reported | embracethered.com (primary) |
| AIA-016 | 2025-09 | "ShadowLeak": zero-click service-side exfiltration via ChatGPT Deep Research, per Radware Radware reported that a crafted email could make ChatGPT's Deep Research agent, when connected to Gmail, "leak sensitive inbox data to an attacker with no user action or visible UI." Radware says it reported the issue on June 18, it was fixed in early August, and OpenAI marked it resolved on September 3. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 4.1 |
AC-4, SI-10, SI-4 | yes: outbound requests to attacker-controlled URLs | fixed | radware.com (primary) |
| AIA-017 | 2025-09 | "ForcedLeak": Salesforce Agentforce prompt injection via Web-to-Lead, per Noma Security Noma Labs reported a CVSS 9.4 chain in which malicious Web-to-Lead submissions led Agentforce to send CRM data to a whitelisted domain that "had expired and become available for purchase." Noma says Salesforce released patches and re-secured the domain. |
Prompt injection / data leak | MEASURE 2.7 GOVERN 6.1 |
AC-4, SI-10, CM-7 | not applicable | fixed | noma.security (primary) |
| AIA-018 | 2025-08 | Claude Code used in a data-extortion operation against at least 17 organizations, per Anthropic Anthropic reported disrupting an actor that "used Claude Code to commit large-scale theft and extortion of personal data." The actor targeted "at least 17 distinct organizations" and threatened to publish the data, with ransom demands that "sometimes exceeded $500,000." |
Misuse | MANAGE 4.1 MEASURE 2.7 |
SI-4, AC-2 | not applicable | confirmed by vendor | anthropic.com (primary) |
| AIA-019 | 2025-11 | Google Antigravity: indirect prompt injection led to credential exfiltration via browser subagent, per PromptArmor PromptArmor reported that a poisoned integration guide could make Gemini in Antigravity collect credentials and code from the workspace and exfiltrate them "by using a browser subagent to browse to a malicious site." PromptArmor says Google's approach is a disclaimer about the risks. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
AC-4, SI-10, AC-6 | yes: reading .env files and browsing to outbound URLs | reported | promptarmor.com (primary) |
| AIA-020 | 2025-08 | Claude Code data exfiltration via DNS requests (CVE-2025-55284), per Embrace The Red Rehberger reported that text in a file Claude Code analyzed "grabbed data from the .env file and placed it into a ping request as subdomain," which leaked the data via DNS. He says Anthropic fixed it in early June 2025. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
AC-4, SC-7, SI-10 | partial: Bash commands (approval existed, but allow-listed ping, nslookup, host and dig ran without it) | fixed | embracethered.com (primary) |
| AIA-021 | 2025-08 | Devin AI prompt injection via GitHub issue could expose secrets, per Embrace The Red Rehberger reported that instructions in a GitHub issue could hijack Cognition's Devin and expose secrets, writing that "exposed secrets can then be leveraged to perform lateral movement." He says he reported it on April 6, 2025 and it was acknowledged a few days later. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
AC-4, AC-6, SI-10 | yes: exposing ports and outbound sends | reported | embracethered.com (primary) |
| AIA-022 | 2025-09 | "Gemini Trifecta": three prompt-injection flaws in Gemini Cloud Assist, Search Personalization and Browsing Tool, per Tenable Tenable Research reported three vulnerabilities, "now remediated": log-to-prompt injection in Gemini Cloud Assist, search injection in the Search Personalization Model, and "exfiltration of the user's saved information and location data via the Gemini Browsing Tool." |
Prompt injection / data leak | MEASURE 2.7 MAP 4.1 |
SI-10, AC-4 | partial: Browsing Tool exfiltration (the other two flaws were on the read/answer path) | fixed | tenable.com (primary) |
| AIA-023 | 2025-08 | "Invitation Is All You Need": Google Calendar invite prompt injection against Gemini, per SafeBreach SafeBreach reported attacks on Gemini "initiated simply by an attacker sending a Google Calendar invite" containing an indirect prompt injection. It says the demonstrations included controlling home appliances, video-streaming victims and exfiltrating information. |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
SI-10, AC-4, AC-6 | yes: device control and opening URLs | confirmed by vendor | safebreach.com (primary) |
| AIA-024 | 2025-08 | "AgentFlayer": zero-click data exfiltration via ChatGPT Connectors, per Zenity Labs Zenity Labs reported that a poisoned document could make ChatGPT with Connectors exfiltrate data such as API keys from Google Drive, using an image URL that got past OpenAI's client-side URL-safety check. Zenity writes: "ChatGPT is very comfortable rendering images which are hosted by Azure Blob." |
Prompt injection / data leak | MEASURE 2.7 MANAGE 2.4 |
AC-4, SI-10 | not applicable | reported | labs.zenity.io (primary) |
| AIA-025 | 2025-06 | Atlassian MCP: malicious support ticket could make an internal user's AI action leak data, per Cato Networks (PoC) Cato CTRL described a proof of concept in which an external user "submits a malicious support ticket" and an internal user then "invokes an MCP-connected AI action," which breaks the boundary between external and internal users. |
Prompt injection / data leak | MEASURE 2.7 MAP 4.1 |
AC-4, AC-6, SI-10 | yes: writing internal data back into the attacker's ticket (externally visible) | reported | catonetworks.com (primary) |