AI Agent Security Incident Log: Breaches, CVEs and Supply Chain

This page is a dated log of publicly documented security incidents involving AI agents, coding agents, MCP servers and the AI software supply chain, from 2025 to today, newest first. It is for engineers and security teams who need to answer "has this happened before, and what class of weakness was it?" without reading forty separate write-ups. Every row links the advisory, postmortem or report I checked it against. I describe what happened and the category of weakness, never how to reproduce it, and attribution appears only as the cited source states it. Last checked: 13 November 2026.

Latest changes

• 13 Nov 2026: Added the NEAR AI breach. NEAR says an attacker exploited an unpatched SGLang remote code execution flaw on 8 November; no CVE or SGLang advisory exists yet (source). My write-up is here.
• 12 Nov 2026: Page first published with 17 incident rows and 23 advisory rows, each re-checked against its source today.
• 10 Nov 2026: CISA added CVE-2026-20320, an XML external entity flaw in Cisco BroadWorks, to its Known Exploited Vulnerabilities catalog with a 24 November due date (source). CISA does not say who exploited it. It is the same CVE Malbear Labs named two days earlier as the initial access route in Operation Snowball.
• 10 Nov 2026: Australia's government accepted all 18 recommendations of the rapid review into the OpenAI agent incident and announced mandatory safeguards with a regulator to enforce them, as SBS News reported (source). My write-up is here.
• 9 Nov 2026: GitHub published Anthropic's advisory for CVE-2026-88968, a race condition in Claude Code's Edit tool that allowed file writes outside the workspace, fixed in 2.1.251 (source).
• 8 Nov 2026: Malbear Labs published its analysis of an exposed attacker workspace it calls Operation Snowball (source).
• 29 Oct 2026: CrowdStrike reported a VAPOR PANDA campaign that used the ARTEX framework against more than 200 organisations (source). Covered in the ARTEX post.
• 27 Oct 2026: Three MCP Python SDK advisories (CVE-2026-116684, CVE-2026-116685, CVE-2026-116686) were published, all fixed in 2.2.0 (source).
• 23 Oct 2026: LiteLLM published its root cause analysis for the 1.107.0 compromise and withdrew its first explanation of how the tokens leaked (source). Covered in the LiteLLM post.
• 21 Oct 2026: Microsoft said it assesses that Storm-0940 was responsible for the ConnectWise supply chain compromise (source).

Incidents and breaches in the wild

The date is the incident date where the source gives one. Otherwise it is the disclosure date, marked as such. "Per X" means that is X's account, and I have not seen it confirmed elsewhere.

Vulnerabilities and CVEs in agent tooling

The date is when the advisory or CVE record was published. "KEV" means CISA lists the CVE in its Known Exploited Vulnerabilities catalog, checked against the catalog version released on 10 November 2026. Nothing else in this table is confirmed as exploited by a source I have read.

How this page is maintained

I add a row only after reading the primary document: a vendor advisory or postmortem, a GitHub Security Advisory, an NVD or CISA record, a regulator statement or the original research write-up. Where no primary document is reachable, I use a named outlet and say so in the row, as with the iTnews reporting on the OpenAI agent in Australia. Deliberately excluded: agent failures with no security dimension (an agent deleting a database is an operations story), research demonstrations with no advisory behind them, jailbreak showcases, and any exploit steps or proof-of-concept detail. Causes and attribution are quoted as the source gives them, and when a source withdraws a claim I change the row and note it under Latest changes. Corrections and missing incidents are welcome at hello@ajayk.sh.

FAQ

Has an AI agent ever caused a real security breach?

Yes, and the operators documented it themselves. Hugging Face published a timeline of a July 2026 intrusion by an agent running an internal OpenAI evaluation, Anthropic reported three incidents in which evaluation runs reached real systems, and an OpenAI research agent got into an Australian government statistics portal in June 2026. In each case no external attacker was steering the agent. Separately, Microsoft, CrowdStrike and Anthropic have reported human-directed campaigns that used agent frameworks or coding agents as the tooling.

Which AI agent and MCP vulnerabilities are known to be exploited in the wild?

Of the advisories in this log, CISA's Known Exploited Vulnerabilities catalog lists four: CVE-2026-59822, CVE-2026-42271 and CVE-2026-42208 in LiteLLM, and CVE-2026-33017 in Langflow. Two more KEV entries sit behind incidents above: the Trivy compromise (CVE-2026-33634) that LiteLLM linked to its March 2026 release, and the Cisco BroadWorks flaw (CVE-2026-20320) named in Operation Snowball. The coding agent CVEs in the table are not in KEV as of the 10 November 2026 catalog.

How do I check whether my coding agent is patched?

Compare the installed version with the "Fixed in" column. The newest Claude Code advisory here is fixed in 2.1.251, and the advisories for Codex, Cursor, Gemini CLI and the MCP SDKs each name their own fixed release. Anthropic's advisories say installs on standard auto-update receive fixes automatically, so the versions worth checking are the ones pinned in CI images, dev containers and build hosts, which do not move unless someone moves them.

Related: MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't., The Worms Learned to Use Your AI Agent: A Year of npm Supply-Chain Attacks and OWASP Top 10 for LLMs 2026 and Agentic Apps: 20 Risks, Real Incidents.