Controls · AI Agent Incident Tracker

NIST AI RMF subcategories

GOVERN 1.1 GOVERN 6.1 MAP 3.5 MAP 4.1 MEASURE 2.7 MANAGE 2.4 MANAGE 3.1 MANAGE 4.1

MAP 4.1 Risks from third-party components are mapped 8

MEASURE 2.7 Security and resilience are evaluated and documented 20

MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate the system 12

MANAGE 3.1 Third-party risks are monitored and controls applied 2

MANAGE 4.1 Post-deployment monitoring is in place 4

NIST SP 800-53 controls

AC-2 AC-3 AC-4 AC-6 AU-6 CM-3 CM-5 CM-7 CM-14 CP-9 IA-2 IA-5 IR-4 SA-10 SC-7 SI-2 SI-4 SI-7 SI-10 SI-15 SR-3 SR-4 SR-11

AC-2 Account Management 2

AC-3 Access Enforcement 3

AC-4 Information Flow Enforcement 16

AC-6 Least Privilege 13

AU-6 Audit Record Review, Analysis, and Reporting 1

AIA-010 AI-orchestrated cyber-espionage campaign using Claude Code, per Anthropic

CM-3 Configuration Change Control 2

CM-5 Access Restrictions for Change 4

CM-7 Least Functionality 4

CM-14 Signed Components 1

AIA-005 Malicious code shipped in Amazon Q Developer VS Code extension 1.84.0, per AWS

CP-9 System Backup 1

AIA-001 Replit coding agent deleted a production database, per The Register

IA-2 Identification and Authentication (Organizational Users) 1

AIA-011 Perplexity Comet indirect prompt injection, per Brave

IA-5 Authenticator Management 6

IR-4 Incident Handling 1

AIA-010 AI-orchestrated cyber-espionage campaign using Claude Code, per Anthropic

SA-10 Developer Configuration Management 2

SC-7 Boundary Protection 7

SI-2 Flaw Remediation 4

SI-4 System Monitoring 4

SI-7 Software, Firmware, and Information Integrity 5

SI-10 Information Input Validation 21

SI-15 Information Output Filtering 1

AIA-007 M365 Copilot prompt injection with ASCII-smuggling exfiltration, per Embrace The Red

SR-3 Supply Chain Controls and Processes 6

SR-4 Provenance 2

SR-11 Component Authenticity 2

Human-approval (JCR) checkpoint

Checkpoint applies 12

A human approval before an irreversible or externally visible agent action could have stopped the harm.

AIA-001 Replit coding agent deleted a production database, per The Register (gate: destructive DB/prod ops)
AIA-004 GitHub MCP server: private repo data leaked via a public issue, per Invariant Labs (gate: publishing to public repos)
AIA-005 Malicious code shipped in Amazon Q Developer VS Code extension 1.84.0, per AWS (gate: release sign-off; destructive commands)
AIA-006 Gemini CLI command execution via deceptive context file, per Tracebit (gate: shell command approval)
AIA-009 Supabase MCP: prompt injection exposed a private table in a demonstration, per General Analysis (gate: privileged DB queries)
AIA-011 Perplexity Comet indirect prompt injection, per Brave (gate: cross-site/authenticated actions)
AIA-013 Cursor agent: writing MCP config files without approval enabled code execution (CVE-2025-54135), per Cursor advisory (gate: file writes that lead to command execution)
AIA-016 "ShadowLeak": zero-click service-side exfiltration via ChatGPT Deep Research, per Radware (gate: outbound requests to attacker-controlled URLs)
AIA-019 Google Antigravity: indirect prompt injection led to credential exfiltration via browser subagent, per PromptArmor (gate: reading .env files and browsing to outbound URLs)
AIA-021 Devin AI prompt injection via GitHub issue could expose secrets, per Embrace The Red (gate: exposing ports and outbound sends)
AIA-023 "Invitation Is All You Need": Google Calendar invite prompt injection against Gemini, per SafeBreach (gate: device control and opening URLs)
AIA-025 Atlassian MCP: malicious support ticket could make an internal user's AI action leak data, per Cato Networks (PoC) (gate: writing internal data back into the attacker's ticket (externally visible))

Checkpoint partly applies 6

An approval step existed but could be bypassed.

AIA-008 Malicious Nx npm packages included a prompt for an AI "file-search agent", per Nx (gate: agent permission prompts for dangerous flags)
AIA-012 GitHub Copilot in VS Code: prompt injection could enable auto-approve and run code (CVE-2025-53773), per Embrace The Red (gate: approval gate the agent could disable by editing a settings file)
AIA-014 Cursor MCP one-time approval could be reused after config change (CVE-2025-54136, "MCPoison"), per Check Point Research (gate: MCP configuration approval, bypassed by later changes)
AIA-015 ChatGPT Operator prompt injection leaked profile data in tests, per Embrace The Red (gate: confirmations on agent actions, which typing text rarely triggered)
AIA-020 Claude Code data exfiltration via DNS requests (CVE-2025-55284), per Embrace The Red (gate: Bash commands (approval existed, but allow-listed ping, nslookup, host and dig ran without it))
AIA-022 "Gemini Trifecta": three prompt-injection flaws in Gemini Cloud Assist, Search Personalization and Browsing Tool, per Tenable (gate: Browsing Tool exfiltration (the other two flaws were on the read/answer path))

Not applicable 15

The harm happened on a read/answer path or the agent was attacker-operated, so an action approval could not have stopped it.