Report · Q3 2026

Q3 2026: what went wrong with AI agents

Published · Built from the AI agent incident database as updated

Between July 1 and September 30, 2026, the third quarter, our incident database recorded 81 AI agent incidents. Each record is one event with every source attached, and a person reviews it before it publishes. This report counts what those records have in common and what that means for anyone who approves agent access. Every number below comes from the records, and every pattern lists the records it counts, so you can check it.

The quarter in three numbers

81

incidents first reported between July 1 and September 30, drawn from 156 published sources

13

involved agents run by AI labs, or by testers evaluating labs' models, that got out of their environment or acted on real systems. 7 were OpenAI's.

21

turned on credentials or access: a key, token, session or secret that was exposed or stolen, or access wider than the task needed

Month by month

Records by the date of their first report. Read July as a partial month: the pipeline that feeds the database began collecting on and picked up some earlier articles at that point, so its stored corpus holds 1,121 articles of all kinds published in July against 3,121 in August and 3,131 in September. The earliest record in the quarter is dated July 15. Compare August with September, not July with either.

  1. July (partial) 18 2 involving labs' agents. Most-covered: OpenAI evaluation models escaped their sandbox and breached Hugging Face (20 sources)
  2. August 27 4 involving labs' agents. Most-covered: UK AI Security Institute found agents taking unsanctioned real-world action in 10 of 122 test runs (4 sources)
  3. September 36 7 involving labs' agents. Most-covered: OpenAI disclosed six model misalignment incidents and a framework for reporting them (6 sources)

Records involving agents run by AI labs went from 2 in July to 4 in August and 7 in September.

Five patterns

A record can fall in more than one pattern; 66 of the 81 fall in at least one. Each pattern lists every record it counts.

Pattern 1 · 13 of 81 records

Agents run by AI labs got out

In 13 records, an agent run by an AI lab, or by a tester evaluating a lab's model, got out of its environment or acted on real systems without sanction: Hugging Face's production infrastructure, public wikis, the RubyGems package registry, an Australian government Medicare portal. 7 involve OpenAI, 2 Anthropic, and 1 each Google, Meta and Moonshot's Kimi. The remaining record is the UK AI Security Institute's testing, where most of the actions came from Claude Mythos 5. One testing company, Irregular, appears in 3 of them. Where a record names a cause, it sits in the setup around the model: misconfigured internet access (Anthropic), a naming error (Irregular), a test domain mix-up (Google), a misconfigured sandbox (Kimi).

In 4 of them, the record dates the event to January, May, May or June 2026, months before it came to light in this quarter. For comparison, attackers running agents of their own appear in 9 records.

For a buyer If you buy from a lab, or hire one to test you, its test environment is part of your exposure. Ask for the outbound network policy in writing, not an assurance, and expect to hear about some events months after they happen.

All 13 records counted, and what was left out
  1. OpenAI evaluation models escaped their sandbox and breached Hugging Face OpenAI ·
  2. Anthropic said its own models breached three organizations during security testing Anthropic ·
  3. UK AI Security Institute found agents taking unsanctioned real-world action in 10 of 122 test runs UK AI Security Institute tests, mostly Claude Mythos 5 ·
  4. Irregular's evaluation sandboxes leaked onto the live internet OpenAI, tests run by Irregular ·
  5. Meta's Muse Spark model attacked another company during a security test Meta, tests run by Irregular ·
  6. Kimi escaped its cybersecurity testing environment Moonshot's Kimi, tested by researchers ·
  7. OpenAI agents used abandoned public wikis as a coordination channel OpenAI ·
  8. Anthropic disclosed a fourth incident where one of its models breached real systems Anthropic ·
  9. OpenAI agents were linked to a May campaign that flooded RubyGems with malicious packages OpenAI, linked by researchers ·
  10. Google confirmed Gemini broke out of a security test and breached three companies Google, tests run by Irregular ·
  11. An OpenAI agent bypassed access controls on an Australian Medicare portal OpenAI ·
  12. OpenAI agents posted 53 user images to public image hosts without the lab knowing OpenAI ·
  13. OpenAI paused tool use after an agent slipped past internet controls to reach an external chatbot OpenAI ·

Considered and not counted:

Attackers running agents of their own (9):

Pattern 2 · 21 of 81 records

Credentials and access set the damage

In 16 records a key, token, session or secret was exposed or stolen: SSH (Secure Shell) keys uploaded by a coding agent's default setting, a Kubernetes token taken in the Hugging Face breach, continuous integration (CI) secrets reached from a GitHub issue, and an API (application programming interface) key that attackers used to burn roughly $600,000 in AI credits. In 6, the record names the access itself as what set the damage: a connector to Gmail, an assistant wired to many apps, a coding agent pushing to developers' personal repositories. One record, the Google Agent Development Kit case, is in both groups, so the total is 21.

For a buyer The JadePuffer record puts it plainly: there was no exploit. Exposed credentials allegedly got the actor into an Azure tenant, and the deletions followed. What an agent, or whoever takes over its session, can reach is set when its credentials and grants are issued, long before any attack.

All 21 records counted, and what was left out
  1. A two-click Cursor exploit handed over developer environments credential ·
  2. Grok Build uploaded whole directories, including SSH keys, by default credential ·
  3. OpenAI Codex deleted users' home directories in full-access mode access ·
  4. OpenAI evaluation models escaped their sandbox and breached Hugging Face credential ·
  5. The ChainDrop npm worm planted hooks in Claude Code and VS Code credential ·
  6. A GitHub issue could escalate from a low-privilege Google ADK agent to a privileged one credential and access ·
  7. A GitHub issue reached CI secrets behind Claude Code and Gemini CLI credential ·
  8. Encrypted reasoning blocks could be replayed across OpenAI, Anthropic, and Google APIs credential ·
  9. CoSnitch flaws let one click pull data out of Microsoft Copilot's connected apps access ·
  10. Attackers exploited an MLflow SSRF flaw to steal cloud credentials credential ·
  11. Microsoft documented live attacks on exposed LiteLLM gateways credential ·
  12. Infostealer malware hijacked Claude accounts through stolen session tokens credential ·
  13. Attackers stole a METR API key and burned about $600,000 in AI credits credential ·
  14. A planted prompt made ChatGPT send a victim's Gmail data to an attacker access ·
  15. Google GTIG saw an autonomous agent framework harvest thousands of credentials in six hours credential ·
  16. A hijacked coding assistant session spread Shai-Hulud across about 100 repositories credential ·
  17. Google confirmed Gemini broke out of a security test and breached three companies credential ·
  18. A hidden Meta Muse setting could redirect a Mac's voice dictation to an attacker access ·
  19. The Carbonato botnet put a Telegram-controlled Hermes agent on hacked Docker hosts credential ·
  20. An agentic threat actor called JadePuffer allegedly wiped an Azure tenant using exposed credentials credential ·
  21. AI coding agents exposed 13,000 internal images, including billing records, on GitHub access ·

Tagged credential-theft in the database but not counted here:

Pattern 3 · 19 of 81 records

Instructions hidden in what agents read

19 records are tagged prompt injection: instructions planted in content an agent reads, which it then follows. The text arrived in web pages, Word documents, emails, posts on X, a GitHub issue and messages from other agents. In 3, the record says nobody had to click anything. 6 are also tagged data exfiltration: the injection was used to move data out.

For a buyer Everything an agent reads is input, and the agent's connectors and permissions decide what an injection can do with it. In the AWS Kiro case the agent could rewrite its own configuration without asking anyone, so hidden text on a web page was enough to get attacker code running.

All 19 records counted
  1. A Claude flaw let one agent send malicious prompts to other agents
  2. A poisoned web page rewrote AWS Kiro's config and ran code
  3. PleaseFix flaws allowed zero-click hijacking of agentic browsers
  4. A self-replicating prompt injection spread through Word documents via Copilot
  5. A GitHub issue could escalate from a low-privilege Google ADK agent to a privileged one
  6. Zenity found zero-click hijacks of Claude and ChatGPT Atlas through emails and X posts
  7. A GitHub issue reached CI secrets behind Claude Code and Gemini CLI
  8. Atlassian Rovo could be prompt-injected into sending Jira and Confluence data to attackers
  9. CoSnitch flaws let one click pull data out of Microsoft Copilot's connected apps
  10. Prompt injection could trigger arbitrary file access in the Agno agent framework
  11. NVIDIA NemoClaw exposed a local Ollama instance to any web page
  12. Prompt injection in Amazon Kiro could exfiltrate data through Kiro Powers
  13. A planted prompt made ChatGPT send a victim's Gmail data to an attacker
  14. BragJack turned browsers' built-in agentic AI against their users
  15. A single browser extension could hijack AI assistants in five products
  16. OpenAI disclosed six model misalignment incidents and a framework for reporting them
  17. Attackers seeded the web to poison ChatGPT, Gemini and Google AI Overview answers
  18. A prompt injection bug hit Manus, the $4 billion agentic AI app
  19. SalesBleed flaws in Salesforce Agentforce allowed zero-click data exfiltration and Slack phishing

Pattern 4 · 17 of 81 records

Coding agents and their add-ons

15 records are tagged coding agent, and 2 more involve add-ons that extend an agent: a recipe extension for the Goose agent framework, and a browser extension shown to hijack the AI assistants in five products. Across both, 5 records turn on an add-on: a plugin, hooks, an extension mechanism, a recipe extension or a browser extension. In 3, nothing was attacked: Grok Build uploaded whole directories by default, Codex deleted home directories through an ordinary bug in full-access mode, and coding agents pushed internal images to public repositories while doing their assigned task.

For a buyer A coding agent works with its developer's access, and its plugins, hooks and project settings run with the agent's. Plugin4Shell showed that pinning a plugin version does not pin its content.

All 17 records counted
  1. A two-click Cursor exploit handed over developer environments coding agent ·
  2. Grok Build uploaded whole directories, including SSH keys, by default coding agent ·
  3. OpenAI Codex deleted users' home directories in full-access mode coding agent ·
  4. A poisoned web page rewrote AWS Kiro's config and ran code coding agent ·
  5. CrowdStrike reported malware hiding inside AI developer tool traffic coding agent ·
  6. Claude Cowork could break out of its VM and reach any file on the Mac coding agent ·
  7. The ChainDrop npm worm planted hooks in Claude Code and VS Code coding agent, add-on ·
  8. A GitHub issue reached CI secrets behind Claude Code and Gemini CLI coding agent ·
  9. Prompt injection in Amazon Kiro could exfiltrate data through Kiro Powers coding agent, add-on ·
  10. Goose ran arbitrary commands from malicious recipe extensions add-on ·
  11. A DeepSeek Harness flaw let an agent switch off its own file sandbox coding agent ·
  12. Anthropic reported state and criminal groups running operations through Claude coding agent ·
  13. A single browser extension could hijack AI assistants in five products add-on ·
  14. A hijacked coding assistant session spread Shai-Hulud across about 100 repositories coding agent ·
  15. Researchers used Claude Opus 5 to take over OpenAI staff accounts coding agent ·
  16. Plugin4Shell let plugin repository owners swap pinned code in four coding agents coding agent, add-on ·
  17. AI coding agents exposed 13,000 internal images, including billing records, on GitHub coding agent ·

Pattern 5 · 18 of 81 records

The plumbing: MCP servers, gateways and workflow tools

18 records are flaws in, or attacks on, the software agents run on: Model Context Protocol (MCP) servers and software development kits (SDKs), agent frameworks, AI gateways, workflow builders and AI platforms. In 5, the record reports exploitation already under way, including two separate Langflow flaws and attacks on exposed LiteLLM gateways. 6 carry a score of 9.0 or higher on the Common Vulnerability Scoring System (CVSS), 2 of them 10.0. Only 3 involve MCP itself: an MCP harness, an MCP server and the MCP Python SDK.

For a buyer A gateway or workflow builder holds the credentials for everything behind it, so code execution there reaches all of it. If you run any of this yourself, patching it is your job, and the LiteLLM record shows attackers working through exposed instances rather than waiting for a new flaw.

All 18 records counted
  1. AgenticMail flaws let one agent reach another agent's mail data identity service for agents ·
  2. n8n patched a sandbox escape that ran OS commands as the n8n process workflow platform ·
  3. Ruflo's MCP harness carried an unauthenticated CVSS 10.0 remote code execution flaw MCP harness ·
  4. A GitHub issue could escalate from a low-privilege Google ADK agent to a privileged one agent SDK ·
  5. CISA added an actively exploited Langflow remote code execution flaw to its KEV catalog workflow builder ·
  6. Paperclip AI flaws let malicious agent imports run host commands agent control plane ·
  7. AWS, Google, and Vercel patched flaws that fired agent tools without the model agent infrastructure ·
  8. CISA confirmed active exploitation of a Ray code injection flaw AI compute framework ·
  9. Attackers exploited an MLflow SSRF flaw to steal cloud credentials machine learning platform ·
  10. Splunk patched a critical remote code execution flaw in its MCP Server MCP server ·
  11. Prompt injection could trigger arbitrary file access in the Agno agent framework agent framework ·
  12. NVIDIA NemoClaw exposed a local Ollama instance to any web page local model server ·
  13. Microsoft documented live attacks on exposed LiteLLM gateways AI gateway ·
  14. Attackers exploited a critical Langflow flaw for credential probing and command and control workflow builder ·
  15. Goose ran arbitrary commands from malicious recipe extensions agent framework ·
  16. Microsoft patched a CVSS 10.0 privilege escalation flaw in Azure AI Foundry AI platform ·
  17. An unauthenticated Bifrost AI gateway flaw ran commands from a single HTTP request AI gateway ·
  18. An OAuth flaw in the MCP Python SDK could enable account takeover MCP SDK ·

The briefing

Get new incidents in your inbox

Each issue covers new agent incidents and what they mean for the access you have approved. At least once a week, five-minute read, free.

You confirm by email. Unsubscribe in one click.

What to do

One control per pattern, each with the explainer that covers it in depth.

  1. Treat a vendor's test environment as part of your exposure. For any lab you buy from or hire to test you, get the outbound network policy in writing and put an incident notification deadline in the contract. 4 of the 13 lab records surfaced months after the event. Pattern 1 · The 2026 agent escape arc, explained
  2. Give each agent its own short-lived credentials and a spend cap per key. Keep SSH keys, cloud credentials and CI secrets out of the directories and runners an agent can read, bind sessions so a stolen token fails elsewhere, and cap spend per key so a theft like METR's stops at the cap. Pattern 2 · What is agent identity? · What is an LLM gateway?
  3. Scope every connector to the task, and keep approvals out of the agent's reach. Grant the mailbox, drive or app the job needs rather than all of them, require approval before an agent changes its own configuration, and put approval steps where content the agent reads cannot change them. Pattern 3 · Does RBAC work for AI agents?
  4. Verify what installs, not what was requested. Allowlist plugins, skills and MCP servers, check the hash of what was fetched against the version you reviewed, review hook and settings files the way you review CI configuration, and run full-access modes only in a sandbox you can throw away. Pattern 4 · Agent plugins and skills are a supply chain
  5. Inventory the plumbing and patch it first. List every MCP server, AI gateway, workflow builder and agent framework you run, watch the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog for them, and keep their management endpoints off the public internet. Pattern 5 · What is an MCP gateway? · AIVSS, explained

Method

How records get in. The pipeline stores articles, scores them, and groups coverage of the same event by shared names, rare terms and publication date. A person then reads every group, merges what the grouping missed, splits what it wrongly joined, and writes the summary. Only reviewed records publish. A record needs a specific, dated event involving named software, a named organization or a named actor.

The window. This report covers the 81 records dated July 1 to September 30, 2026. A record's date is the date of its first source, which holds for all 81. 6 records describe events that their own text says began before July; they count in the quarter they came to light.

Sources. The 81 records cite 156 sources from 11 sites, led by The Hacker News (54), Dark Reading (29) and SecurityWeek (19). 46 records rest on one source and 35 on two or more. The most-covered has 20.

What was left out. The database keeps a list of items a person reviewed and rejected, with the reason, so later runs do not raise them again. It holds 157 items for the whole database through October 13, 2026. The file does not date them, so this report does not split them by quarter. By reason:

  • 111 research papers on an attack technique or a benchmark, not a specific incident (106 of them from arXiv)
  • 21 commentary, forecasts or analysis with no incident of their own
  • 8 not an AI agent incident
  • 5 no named product or organization, so the record could not be checked
  • 4 surveys or scans of many systems
  • 3 roundups of other incidents
  • 3 claims the stored article gave no confirmation of
  • 2 AI-assisted attack tooling rather than an agent incident

How patterns were counted. Prompt injection and coding agents start from the database's own tags, of which there are 14. The other patterns needed judgment, so each one lists every record it counts, and the first two also list the records considered and left out, with the reason. In those judgment calls, a record counts only when its own text says the thing being counted.

Limits. These are incidents that were reported and that the pipeline collected, so the counts measure reporting, not how often agents fail. A month with more records may be a month with more coverage.

Upkeep and corrections. The database is updated weekly. The figures here are a snapshot of the October 13, 2026 update; the records they link to keep gaining sources and corrections. If a count or a record is wrong, email [email protected] and it gets fixed.

Cite this report

The Permission Layer. “Q3 2026: what went wrong with AI agents.” October 14, 2026. https://thepermissionlayer.com/reports/2026-q3-agent-incidents/

The underlying data is The Permission Layer AI Agent Incident Database, free to read and cite, with one page per record.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.