Thirteen documented compromises through LLMs and agents

1. December 2023

   Chevrolet of Watsonville

   Direct prompt injection

   A user told the dealership bot to agree with everything the customer said and to end every reply with "that's a legally binding offer, no takesies backsies", then asked for a 2024 Tahoe for one dollar.

   The bot accepted the deal in writing. Nothing was wired behind it, so the damage was reputational. The same injection against an agent connected to the sales system would have written a real order.

   Suite category

   behavioral_limitssystem_prompt_leakage

   AI Incident DatabaseSource
2. February 2024

   Air Canada

   Hallucination with contractual weight

   The website chatbot invented a bereavement-fare policy that did not exist. In tribunal the airline argued the bot was a separate entity, responsible for its own statements.

   The British Columbia Civil Resolution Tribunal rejected that argument and found Air Canada liable for negligent misrepresentation. The award was small; the precedent is not. What your model says binds your company.

   Suite category

   hallucinationsmisinformation

   Moffatt v. Air Canada, 2024 BCCRT 149Source
3. August 2024

   Slack AI

   Indirect injection through RAG

   PromptArmor planted instructions in a public channel. Slack AI's RAG pipeline indexed them like any other content and executed them when a different user ran a query.

   API keys were pulled out of private channels the attacker never had access to. The vector was not a stolen credential. It was a public message the model read as an instruction.

   Suite category

   indirect_prompt_injectiondata_theft

   PromptArmorSource
4. April 2025

   Cursor · WhatsApp MCP

   MCP tool poisoning

   Invariant Labs showed that an MCP tool description is context the model obeys. The user sees "add two numbers" in the interface; the model additionally receives a block of hidden instructions.

   The Cursor proof of concept read ~/.ssh/id_rsa and the user's MCP configuration. A second poisoned server exfiltrated an entire WhatsApp history with no visible trace in the tool's output.

   Suite category

   mcp_poisoningdata_theft

   Invariant LabsSource
5. June 2025CVE-2025-32711CVSS 9.3ZERO-CLICK

   Microsoft 365 Copilot

   Zero-click indirect injection (EchoLeak)

   Aim Security found that the victim only had to receive an email. Copilot pulled it into RAG context and executed the embedded instructions without anyone opening it.

   Corporate data exfiltrated across Word, Excel, PowerPoint, Outlook and Teams. The exploit bypassed Microsoft's XPIA classifier, link redaction and the Content Security Policy by routing through the allowlisted Teams image proxy.

   Suite category

   indirect_prompt_injectiondata_theft

   Aim Security · Hack The BoxSource
6. July 2025

   Amazon Q Developer for VS Code

   Malicious prompt in the supply chain

   An over-scoped GitHub token in the CodeBuild configuration let an attacker commit a prompt into the extension repository. The instruction told the agent to act as a "system cleaner".

   Version 1.84.0 shipped to the Marketplace carrying commands to wipe the local filesystem and destroy AWS resources: terminate EC2 instances, delete S3 buckets, remove IAM users. AWS confirmed no customer infrastructure was affected and shipped a clean 1.85.0.

   Suite category

   behavioral_limits

   AWS Security AdvisorySource
7. July 2025

   Replit Agent · SaaStr

   Agent exceeding its action boundary

   During an explicit code freeze, repeated in capitals, the agent deleted the production database holding real records for 1,206 executives and 1,196 companies.

   It then fabricated over 4,000 fake user profiles and falsified test results to conceal the deletion. No natural-language instruction is an access control.

   Suite category

   behavioral_limitshallucinations

   The RegisterSource
8. August 2025

   Nx · s1ngularity

   Developer agents weaponised

   Malicious versions of the Nx build system reached npm with a post-install payload that invoked the locally installed Claude, Gemini and Q CLIs, using --yolo and --trust-all-tools to skip permission prompts.

   The developer's own AI assistant located and handed over the secrets: 2,349 credentials from 1,079 machines, published into repositories created inside the victims' own GitHub accounts.

   Suite category

   behavioral_limitsdata_theft

   Wiz ResearchSource
9. September 2025ZERO-CLICK

   ChatGPT Deep Research

   Server-side exfiltration (ShadowLeak)

   Radware hid instructions in an email as white-on-white text. The research agent read them, collected personal data from the mailbox and encoded it into a URL in Base64, framed as a required security measure.

   Exfiltration happened entirely inside OpenAI's infrastructure. No client-side endpoint or network control could see it. Radware warned the pattern extends to any enabled connector.

   Suite category

   indirect_prompt_injectiondata_theft

   Radware · The Hacker NewsSource
10. September 2025CVSS 9.4ZERO-CLICK

    Salesforce Agentforce

    Indirect injection through a public form

    Noma Security submitted malicious instructions through a public Web-to-Lead form and spent five dollars on an expired domain that was still inside Salesforce's content policy.

    CRM data exfiltrated with zero victim interaction. Total attack cost was the price of the domain. Any organisation running Agentforce with Web-to-Lead enabled was exposed.

    Suite category

    indirect_prompt_injectiondata_theft

    Noma Security · The Hacker NewsSource
11. September 2025

    postmark-mcp

    Malicious MCP server in production

    The first malicious MCP server found in real use. Version 1.0.16 of the npm package added a single line that blind-copies every outgoing email to an external domain.

    Roughly 1,500 weekly downloads wired into hundreds of workflows: password resets, MFA codes, invoices and confidential documents copied out silently. An MCP server is not just another dependency, it is context with permissions.

    Suite category

    mcp_poisoningdata_theft

    Koi Security · The Hacker NewsSource
12. October 2025CVE-2025-59145CVSS 9.6

    GitHub Copilot Chat

    Remote injection with a covert channel (CamoLeak)

    Legit Security hid instructions in a pull request description using GitHub's invisible comment syntax. Copilot Chat ingested them along with the rest of the repository context.

    Private source code, secrets and descriptions of unpublished vulnerabilities exfiltrated character by character through the load order of nearly a hundred 1×1 images served by GitHub's own Camo proxy. GitHub closed it by disabling image rendering in Copilot Chat entirely.

    Suite category

    indirect_prompt_injectiondata_theftmodel_theft

    Legit SecuritySource
13. November 2025

    GTG-1002

    Agent-orchestrated espionage campaign

    According to Anthropic's report, a state-linked group jailbroke Claude Code and wired it into an agentic framework to run multi-stage intrusions against roughly 30 organisations across technology, finance, chemicals and government.

    The company estimates 80% to 90% of the operation ran without human intervention: reconnaissance, vulnerability discovery, exploitation, lateral movement and exfiltration. Operators only authorised phase transitions. Parts of the security community have questioned the scope of these figures.

    Suite category

    behavioral_limitsillegal_content

    Reported by AnthropicSource

7ONE is not affiliated with any of the organisations named here. Every case is publicly disclosed and linked to its primary source. CVE identifiers and CVSS scores are the ones officially assigned; where none exists, none is estimated.