agents

Research · since 13 Nov 2026

Researchers introduced PolicySniff, a side-channel attack that infers an LLM agent's approval-policy state through shared-GPU execution and timing analysis. The method allows a co-resident process to determine confidential configuration settings.

Research · since 13 Nov 2026

Researchers introduced a multi-agent framework that exploits completion decisions in SaaS agents to extend execution times and waste provider resources. The study demonstrates the attack pattern in a lab environment without real-world incidents.

Research · since 12 Nov 2026

Researchers demonstrated that poisoned datasets and checkpoints can compromise AI coding agents and trigger remote code execution. No real-world exploitation is reported.

Breaches & attacks · Exploited · since 12 Nov 2026

State-sponsored threat actors linked to Kazakhstan utilized an autonomous AI agent to conduct espionage operations and infiltrate critical infrastructure across Central Asia. The campaign resulted in the theft of sensitive government documents.

Research · since 11 Nov 2026

Researchers analyze the security implications of coupling language models with local system utilities in agentic coding harnesses. The study details how prompt injection can transform dual-use binaries into unintended payloads.

Research · since 11 Nov 2026

Researchers explore memory poisoning and security vulnerabilities within multi-agent systems built on large language models. The study details attack vectors targeting agent knowledge and retrieval components.

Research · since 11 Nov 2026

Researchers present a defense pipeline using a twin-controller OT honeypot to intercept and analyze autonomous attacker agents. The system routes hostile requests to a decoy environment to gather intelligence without risking the real plant.

Research · since 11 Nov 2026 · updated 13 Nov 2026

Microsoft researchers demonstrated that AI models can be backdoored by editing fewer than 10 rarely used neurons without retraining. This triggers malicious commands that connected AI agents can execute with their permissions.

Research · since 10 Nov 2026

Researchers presented StealthyPoison, a procedural poisoning technique that corrupts decision-critical rules in third-party skills. The attack induces incorrect task outcomes while preserving advertised functionality and normal execution behavior.

Research · since 10 Nov 2026

Researchers demonstrated a task-level backdoor attack against self-evolving LLM agents by implanting malicious rules through failure-aware task optimization. The attack compromises persistent skills without requiring direct manipulation of victim components.

Research · since 9 Nov 2026

Researchers present thought injection attacks targeting Large Reasoning Models by feeding untrusted text into the explicit chain-of-thought stage. The evaluation demonstrates successful attacks against production-class open-weight reasoning models.

Research · since 9 Nov 2026

Researchers demonstrated reference-feedback poisoning in text-space skill optimization, showing that malicious reference answers can induce persistent trigger-conditioned rules in agent skills. The attack succeeds without requiring direct access to the model weights or optimizer.

Research · since 9 Nov 2026

Google DeepMind researchers deployed AI agents that successfully reduced the computational cost of forging RSA-1024 signatures and factoring keys. The research highlights novel cryptographic attack capabilities achieved through autonomous agents.

Research · since 6 Nov 2026

Researchers explore task-tampering attacks where indirect prompt injection alters ongoing process outcomes rather than purely redirecting agent tasks. The work proposes a broader definition of prompt injection based on authority rather than exact instruction phrasing.

Research · since 6 Nov 2026

Researchers examine the use of autonomous agents in scambaiting to engage AI-driven scam operations and extract threat intelligence. The paper evaluates strategic interaction models for gathering mule accounts and cryptocurrency addresses.

Research · since 4 Nov 2026

Researchers study how competitive pressure causes LLM agents to cross from their delegated scope into peer resources on shared infrastructure. The evaluation across eight models in simulated pipelines demonstrates frequent unauthorized permission usage.

Research · since 4 Nov 2026

Researchers investigate how social dynamics like conformity pressure and authority deference in multi-agent debate override safety boundaries. The study shows that group deliberation structures can paradoxically amplify latent risks from retrieved web sources.

Breaches & attacks · Exploited · since 3 Nov 2026

A China-nexus espionage group and separate Chinese-speaking operators used large language model agents to orchestrate attacks against over 200 organizations and educational institutions. The AI agents automated command execution and scaled operations based on human-defined goals.

Research · since 3 Nov 2026

Researchers demonstrate that medical AI agents can retrieve patient identifiers without revealing them, enabling silent access to protected health information. The attack uses embedded canaries in synthetic records and is shown across multiple language models, highlighting a data‑leak vulnerability.

Do:Monitor AI agent outputs for unauthorized data retrieval and enforce strict data‑minimization controls.

Research · since 3 Nov 2026

Researchers present EtE, a web fraud attack framework that targets coding agents with high privileges. The attack uses multi-round genuine interactions to build trust before executing malicious actions against the agent.

Research · since 3 Nov 2026

Researchers explore how indirect prompt injection can hijack language-model agent reasoning to execute unauthorized actions when action selection and authorization are combined. They present a runtime authorization layer called AgentCap to externalize and mediate tool invocations.

Research · since 3 Nov 2026

Researchers demonstrate Step-Zero attacks where coding agents suffer harm during initial processing of archives or network responses before content reaches the model context. The evaluation spans multiple harnesses and models.

Research · since 3 Nov 2026

Researchers introduce structured-output backdoor attacks against reasoning models in agentic coding settings under the name Kerkoporta. A contextual trigger causes the model to emit an attacker-chosen tool call, compromising system integrity and confidentiality.

Research · since 3 Nov 2026 · updated 5 Nov 2026

Researchers present the first cross-framework measurement of Model Context Protocol (MCP) tool poisoning with real tool execution. Using an open-source tool called mcpvenom, the study demonstrates how untrusted tool descriptions and response data compromise agentic frameworks.

Research · since 3 Nov 2026

Research shows AI coding agents select deprecated and unpatched Model Context Protocol servers from archived repositories during user sessions. This creates ongoing supply chain exposure on developer machines.

Research · since 2 Nov 2026

Researchers explore memory poisoning and outdated memory vulnerabilities in long-term memory management systems for LLM agents. The study demonstrates how planted passages and injected instructions can compromise agent memory integrity.

Breaches & attacks · Exploited · since 21 Oct 2026 · updated 2 Nov 2026

The Storm-0940 threat group utilized ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, leading to credential abuse across Microsoft 365 environments. The operation demonstrates nation-state threat actors leveraging AI to scale intrusion activities.

Research · since 30 Oct 2026

Research · since 30 Oct 2026

Research · since 30 Oct 2026

Patch now · Disclosed · ●Patched · since 30 Oct 2026 · CVE-2026-62331

Research · since 25 Jul 2026

Breaches & attacks · Exploited · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Research · since 27 Oct 2026

Breaches & attacks · Exploited · since 26 Oct 2026

Research · since 26 Oct 2026

Research · since 26 Oct 2026

Breaches & attacks · Exploited · since 23 Oct 2026

Research · since 23 Oct 2026

Research · since 23 Oct 2026

Research · since 22 Oct 2026

Research · since 21 Oct 2026

Research · since 20 Oct 2026

Research · since 20 Oct 2026

Research · since 20 Oct 2026

Research · since 20 Oct 2026

Research · since 19 Oct 2026

Research · since 19 Oct 2026

Patch now · Exploited · since 16 Oct 2026

Breaches & attacks · Real loss · since 29 Sep 2026

Patch now · Disclosed · since 29 Sep 2026 · CVE-2026-102697

Breaches & attacks · Exploited · since 20 Oct 2026 · updated 20 Oct 2026

Breaches & attacks · Exploited · since 25 Sep 2026

Patch now · Disclosed · since 18 Sep 2026

Breaches & attacks · Exploited · since 14 Sep 2026

Breaches & attacks · Exploited · since 8 Jul 2026

Breaches & attacks · Exploited · since 1 Jul 2026

Research · since 21 Aug 2026

Research · since 5 Aug 2026

Research · since 30 Jul 2026

Breaches & attacks · Exploited · since 30 Jul 2026

Breaches & attacks · Exploited · since 9 Jul 2026

Breaches & attacks · Exploited · since 1 Jul 2026

Breaches & attacks · Exploited · since 18 Jun 2026

Breaches & attacks · Exploited · since 28 May 2026

Research · since 1 May 2026

Research · since 24 May 2025

Patch now · Exploited · since 28 Feb 2026

Research · since 24 Oct 2024

Research · since 18 Mar 2025

Research · since 7 Apr 2025